Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

Description and use

Lantunnel enables secure access to LAN devices without port forwarding, public URLs, or a VPN concentrator, using direct QUIC paths and an encrypted relay.

Problem

Devices behind NAT cannot be accessed from outside without exposing them to the public internet or using a VPN concentrator.

Outcome

Lantunnel enables secure, private access to LAN devices without port forwarding, public URLs, or a VPN concentrator, using direct QUIC paths when possible and an encrypted relay otherwise.

Workflow

• Install lantunnel-client on each device.
• Create a tunnel offline with lantunnel-admin init-tunnel and add-peer to generate signed .peer profiles.
• Import the .peer profile into lantunnel-client on each device.
• Run lantunnel-client to expose a SOCKS5 proxy on 127.0.0.1:1080 or native routes.
• If direct QUIC hole punching succeeds, traffic flows peer‑to‑peer; otherwise it falls back to the lantunnel-gateway relay.
• Configure the lantunnel-gateway on a public host with lantunnel-gateway init and run it with the public scope.
• Use the gateway for NAT traversal and encrypted relay when direct path is unavailable.

Evidence

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

Source

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

Source

Every peer holds its own Ed25519 key, proves possession of it on every attachment, and that key never leaves the machine that generated it.

Source