Open-source alternative to Tailscale, ngrok, and Cloudflare mesh. One stack, fully open control plane.
Encrypted P2P connectivity over QUIC (iroh). Every machine gets an internal IP and can reach every other - SSH, ping, curl, anything.
Expose local services to your mesh with internal TLS from your org's CA. ACL-protected, hostname-addressable. Like an internal load balancer.
Give any local port a public HTTPS URL through an edge - webhooks, demos, or permanent endpoints without touching firewall rules.
Transfer files peer-to-peer over the mesh. BLAKE3-verified, consent-based, with multicast to tagged machines.
Identity-based SSH with no keys to distribute. Works with stock OpenSSH, session recording, re-auth policies, and full audit trails in the dashboard.
HCL, JSON, or YAML in Git. Offline validate and simulate, semantic PR diffs, Terraform, drift detection, and one-click rollback - same policy the dashboard edits.
Run your own public tunnel edge. ACME support, bring your own certs, full control over your tunnel infrastructure.
Pick your OS - Copy, paste, done.
curl -fsSL https://get.tunnet.io/linux | shThen enroll and start the service. Needs root for the TUN interface.