Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

说明与用途

Lantunnel 通过直接 QUIC 路径和加密中继，允许 NAT 后的设备安全私密互联，无需端口转发、公共隧道或 VPN 集中器。

问题

Users with devices behind NAT need secure, private access to each other without exposing services to the public internet or relying on a VPN concentrator.

结果

Lantunnel enables secure, private, direct or encrypted relay communication between devices behind NAT without exposing services to the public internet, eliminating the need for port forwarding or a VPN concentrator.

工作流

• 1. Run lantunnel-admin init-tunnel on the owner machine to create a tunnel and generate a gateway public scope.
• 2. Run lantunnel-admin add-peer to issue a signed .peer profile for each device.
• 3. Deploy lantunnel-gateway on a public host (or use the hosted service) and configure it with the public IP and ports.
• 4. Copy the public .scope file to the gateway host and start the gateway with lantunnel-gateway --config configs/gateway.yaml.
• 5. On each device, run lantunnel-client tunnel import <peer-file> to import the profile.
• 6. Start the client (lantunnel-client connect '<tunnel_id>' or --headless for servers).
• 7. Applications use the local SOCKS5 proxy at 127.0.0.1:1080 or native routes to reach peers.
• 8. When two devices are on networks that allow hole punching, traffic flows directly; otherwise it is sealed and relayed through the gateway.
• 9. Manage access control locally on each target device; the gateway never sees plaintext.
• 10. Optional: use the hosted Lantunnel service for a free, unmetered gateway.
• 11. Monitor and revoke peers by deleting their .peer files or updating the gateway configuration.

证据

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

来源

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

来源

There is no tunnel password, no group secret, no bearer token to leak into a wiki page.

来源