Tunnel

tunnet tunnel gives a local port a public HTTPS URL through a Tunnet edge. The URL is reachable from the public internet, but the traffic flows through the edge to your agent - no inbound firewall rules needed.

How it competes

Tunnel competes directly with ngrok (public tunnels to local services), Cloudflare Tunnel (exposing internal services to the internet), and Tailscale Funnel (public access to tailnet services). Tunnet's advantage is self-hosted edge infrastructure and integration with the mesh network.

Quick start

# Expose port 3000 to the internet
tunnet tunnel 3000

# Capture HTTP traffic in a local inspector (like ngrok)
tunnet tunnel 3000 --inspect
# → public URL + Inspector at http://127.0.0.1:4040

# Optional: bind the inspector elsewhere
tunnet tunnel 3000 --inspect --inspect-addr 127.0.0.1:4041

# Check active tunnels
tunnet tunnel status

# Stop the tunnel
tunnet tunnel off 3000

The CLI outputs a public URL like https://abc123.your-edge.example.com that anyone can access.

Traffic inspection & replay

With --inspect, the agent captures plaintext HTTP (headers and bodies, up to 1 MiB each) on the machine and serves a local UI at http://127.0.0.1:4040 by default. The CLI stays attached and streams each request to the console (Ctrl+C stops the tunnel). You can also open the UI to inspect details and Replay any captured request against your local upstream. Bodies never leave the machine.

--inspect works in Managed mode (public HTTPS URL via edge) and Direct mode. In Direct mode Tunnet binds your mesh IP:port (same idea as tunnet serve) and proxies to 127.0.0.1:port, so peers keep curling http://100.x.x.x:3000 and requests show up in the inspector. Bind the app to localhost only - not 0.0.0.0 - so Tunnet can own the mesh port.

Without --inspect, public tunnels still require Managed mode.

How it works

Loading diagram...

When you create a tunnel, the agent establishes a persistent reverse tunnel to the assigned edge. The edge terminates public HTTPS and forwards incoming requests to the agent through the reverse tunnel. The agent proxies the request to your local service.

Dashboard management

Tunnels can also be created from the dashboard. Navigate to Tunnels to see all active tunnels and create new ones. The tunnel detail page provides controls for path-based redirects and TCP port mappings.