Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

Описание и применение

Lantunnel позволяет безопасно подключаться к устройствам за NAT без проброса портов, публичных туннелей или VPN‑концентраторов, используя самодостаточный шлюз и защищённые P2P‑соединения.

Задача

Users with devices behind NAT need secure, private access to LAN services without exposing them to the public internet or relying on VPN concentrators.

Результат

Users can securely access LAN services from anywhere without exposing them to the public internet, using a self-hosted gateway and encrypted peer-to-peer connections.

Рабочий процесс

• 1. Install lantunnel-gateway on a publicly reachable host. 2. Run lantunnel-gateway init --public-ip <PUBLIC_IP> to generate gateway keys. 3. On a trusted machine, run lantunnel-admin init-tunnel with gateway details to create a tunnel. 4. Use lantunnel-admin add-peer to generate a signed .peer profile for each device. 5. Copy the .peer profile to the device and run lantunnel-client tunnel import ./device.peer. 6. Start lantunnel-client (desktop UI or --headless for servers).
• 7. Devices connect to the gateway via the signed profile; direct QUIC path is attempted first. 8. If hole punching fails, traffic is sealed with XChaCha20-Poly1305 and relayed through the gateway.
• 9. Access control is enforced locally on each target device; the gateway never sees plaintext or private keys.

Доказательства

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

Источник

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

Источник

The gateway never holds peer private keys and never sees plaintext.

Источник