Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

Description and use

Lantunnel enables secure access to LAN devices behind NAT without port forwarding, public tunnels, or VPN concentrators, using a self-hosted gateway and encrypted peer‑to‑peer connections.

Problem

Users with devices behind NAT need secure, private access to LAN services without exposing them to the public internet or relying on VPN concentrators.

Outcome

Users can securely access LAN services from anywhere without exposing them to the public internet, using a self-hosted gateway and encrypted peer-to-peer connections.

Workflow

• 1. Install lantunnel-gateway on a publicly reachable host. 2. Run lantunnel-gateway init --public-ip <PUBLIC_IP> to generate gateway keys. 3. On a trusted machine, run lantunnel-admin init-tunnel with gateway details to create a tunnel. 4. Use lantunnel-admin add-peer to generate a signed .peer profile for each device. 5. Copy the .peer profile to the device and run lantunnel-client tunnel import ./device.peer. 6. Start lantunnel-client (desktop UI or --headless for servers).
• 7. Devices connect to the gateway via the signed profile; direct QUIC path is attempted first. 8. If hole punching fails, traffic is sealed with XChaCha20-Poly1305 and relayed through the gateway.
• 9. Access control is enforced locally on each target device; the gateway never sees plaintext or private keys.

Evidence

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

Source

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

Source

The gateway never holds peer private keys and never sees plaintext.

Source