Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

说明与用途

Lantunnel 通过直接 QUIC 连接和加密中继，允许在不使用端口转发、公共 URL 或 VPN 集中器的情况下安全访问 LAN 设备。

问题

Devices behind NAT cannot be accessed from outside without exposing them to the public internet or using a VPN concentrator.

结果

Lantunnel enables secure, private access to LAN devices without port forwarding, public URLs, or a VPN concentrator, using direct QUIC paths when possible and an encrypted relay otherwise.

工作流

• Install lantunnel-client on each device.
• Create a tunnel offline with lantunnel-admin init-tunnel and add-peer to generate signed .peer profiles.
• Import the .peer profile into lantunnel-client on each device.
• Run lantunnel-client to expose a SOCKS5 proxy on 127.0.0.1:1080 or native routes.
• If direct QUIC hole punching succeeds, traffic flows peer‑to‑peer; otherwise it falls back to the lantunnel-gateway relay.
• Configure the lantunnel-gateway on a public host with lantunnel-gateway init and run it with the public scope.
• Use the gateway for NAT traversal and encrypted relay when direct path is unavailable.

证据

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

来源

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

来源

Every peer holds its own Ed25519 key, proves possession of it on every attachment, and that key never leaves the machine that generated it.

来源