QUIC · HTTP/3 · WebSocket-ready

Tug your localhost to the internet

Expose local HTTP services through a QUIC control tunnel and streaming-optimized public ingress. Subdomain routing, automatic TLS, and long-lived connections built in.

Open DashboardRead the Docs

Why TunnelTug?

⚡

QUIC control channel

Tunnel clients connect over UDP with TLS (ALPN: tunneltug). Low latency, connection migration, and multiplexed streams via Yamux.

📡

Streaming ingress

Reverse proxy tuned for SSE, WebSocket upgrades, and long-lived HTTPS connections — not just request/response.

🔒

ACME / Let's Encrypt

Production mode provisions certificates automatically. HTTP-01 on :80, HTTPS and optional HTTP/3 on the public edge.

🌐

Subdomain routing

Multi-tenant tunnels via host-based routing — myapp.tunneltug.com points at your local :3000 without a VPN.

🛡️

0Trust identity

Dashboard secured with hardware-bound DBSC sessions via the 0Trust mesh identity plane.

📊

0 tunnels registered on this edge

Architecture

Browser ──HTTPS/HTTP3──▶ Public Ingress (:443)                              │                         Yamux stream                              ▼                      Tunnel Server                              │                         QUIC + TLS                              ▼                      Tunnel Client                              │                            TCP                              ▼                      Local App :3000

Quick start

Server

tunneltug -mode server -prod \\
  -domain tunneltug.com \\
  -email admin@tunneltug.com \\
  -token \"$(openssl rand -hex 32)\"

Client

tunneltug -mode client \\
  -server tunnel.tunneltug.com \\
  -domain tunneltug.com \\
  -subdomain myapp \\
  -local 3000 \\
  -token \"\"

Visit https://myapp.tunneltug.com after the client connects.