Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

Description and use

Lantunnel enables secure access to devices behind NAT using direct QUIC connections and an encrypted relay fallback, eliminating the need for port forwarding or VPNs.

Problem

Users with devices behind NAT need secure, private access to each other without exposing services to the public internet or relying on a VPN concentrator.

Outcome

Users can securely access LAN devices from anywhere without exposing services to the public internet, using direct peer-to-peer QUIC when possible and encrypted relay only as a fallback.

Workflow

• 1. Install lantunnel binaries (client, gateway, admin).
• 2. On a public host, run lantunnel-gateway init --public-ip <PUBLIC_IP> to create the gateway.
• 3. On a trusted machine, run lantunnel-admin init-tunnel with gateway details to generate a tunnel and a signed .peer profile for each device.
• 4. Copy the public .scope file to the gateway host and start the gateway with lantunnel-gateway --config configs/gateway.yaml.
• 5. On each device, import the .peer profile with lantunnel-client tunnel import ./device.peer and start the client (desktop UI or headless).
• 6. Applications connect to services via the local SOCKS5 proxy at 127.0.0.1:1080 or via native routes exposed by the client.
• 7. The gateway performs NAT traversal and, if direct QUIC fails, relays encrypted traffic using XChaCha20-Poly1305.
• 8. Optional: use the hosted gateway at lantunnel.app for a free, managed option.

Evidence

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

Source

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

Source