Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

说明与用途

Lantunnel 通过直接 QUIC 连接和加密中继回退，安全访问 NAT 后的设备，无需端口转发或 VPN。

问题

Users with devices behind NAT need secure, private access to each other without exposing services to the public internet or relying on a VPN concentrator.

结果

Users can securely access LAN devices from anywhere without exposing services to the public internet, using direct peer-to-peer QUIC when possible and encrypted relay only as a fallback.

工作流

• 1. Install lantunnel binaries (client, gateway, admin).
• 2. On a public host, run lantunnel-gateway init --public-ip <PUBLIC_IP> to create the gateway.
• 3. On a trusted machine, run lantunnel-admin init-tunnel with gateway details to generate a tunnel and a signed .peer profile for each device.
• 4. Copy the public .scope file to the gateway host and start the gateway with lantunnel-gateway --config configs/gateway.yaml.
• 5. On each device, import the .peer profile with lantunnel-client tunnel import ./device.peer and start the client (desktop UI or headless).
• 6. Applications connect to services via the local SOCKS5 proxy at 127.0.0.1:1080 or via native routes exposed by the client.
• 7. The gateway performs NAT traversal and, if direct QUIC fails, relays encrypted traffic using XChaCha20-Poly1305.
• 8. Optional: use the hosted gateway at lantunnel.app for a free, managed option.

证据

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

来源

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

来源