Lantunnel

Reach the machines and services on your own LANs from anywhere — peer-to-peer first, end-to-end encrypted, no port forwarding, no public URLs.

Your NAS is at home. Your GPU box is in the office. Your ollama instance is on the desktop you left behind. All of them are behind NAT, and none of them should be on the public internet.

Lantunnel puts those machines into one small private mesh — a Tunnel — that only the people you hand a profile to can join. Peers find each other and talk directly when the network allows it. When it does not, they fall back to an encrypted relay through a Gateway that carries ciphertext it cannot read. Either way nothing is published, no router port is opened, and no traffic is decrypted in the middle.

And if you'd rather host the Gateway yourself, that path is in this repository, it is Apache-2.0, and it is not metered at all.

Direct-first New flows try a direct peer-to-peer QUIC path with UDP hole punching. Relay is the fallback, not the default.

End-to-end encrypted Relayed payloads are sealed with XChaCha20-Poly1305 under keys from an X25519 exchange between the two Peers. The Gateway relays bytes it cannot decrypt.

No port forwarding Peers dial out. Nothing on your LAN needs an inbound rule, a public IP, or a hostname.