Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

Описание и применение

Lantunnel позволяет безопасно подключать устройства за NAT без проброса портов, публичных туннелей или VPN‑концентраторов, используя прямой QUIC‑путь и зашифрованный ретранслятор.

Задача

Users with devices behind NAT need secure, private access to each other without exposing services to the public internet or relying on a VPN concentrator.

Результат

Lantunnel enables secure, private, direct or encrypted relay communication between devices behind NAT without exposing services to the public internet, eliminating the need for port forwarding or a VPN concentrator.

Рабочий процесс

• 1. Run lantunnel-admin init-tunnel on the owner machine to create a tunnel and generate a gateway public scope.
• 2. Run lantunnel-admin add-peer to issue a signed .peer profile for each device.
• 3. Deploy lantunnel-gateway on a public host (or use the hosted service) and configure it with the public IP and ports.
• 4. Copy the public .scope file to the gateway host and start the gateway with lantunnel-gateway --config configs/gateway.yaml.
• 5. On each device, run lantunnel-client tunnel import <peer-file> to import the profile.
• 6. Start the client (lantunnel-client connect '<tunnel_id>' or --headless for servers).
• 7. Applications use the local SOCKS5 proxy at 127.0.0.1:1080 or native routes to reach peers.
• 8. When two devices are on networks that allow hole punching, traffic flows directly; otherwise it is sealed and relayed through the gateway.
• 9. Manage access control locally on each target device; the gateway never sees plaintext.
• 10. Optional: use the hosted Lantunnel service for a free, unmetered gateway.
• 11. Monitor and revoke peers by deleting their .peer files or updating the gateway configuration.

Доказательства

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

Источник

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

Источник

There is no tunnel password, no group secret, no bearer token to leak into a wiki page.

Источник