Reaching your own LAN without port forwarding, public URLs, or a VPN concentrator

说明与用途

Lantunnel 通过自托管网关和加密的点对点连接，允许在不进行端口转发、公共隧道或 VPN 集中的情况下安全访问位于 NAT 后的 LAN 设备。

问题

Users with devices behind NAT need secure, private access to LAN services without exposing them to the public internet or relying on VPN concentrators.

结果

Users can securely access LAN services from anywhere without exposing them to the public internet, using a self-hosted gateway and encrypted peer-to-peer connections.

工作流

• 1. Install lantunnel-gateway on a publicly reachable host. 2. Run lantunnel-gateway init --public-ip <PUBLIC_IP> to generate gateway keys. 3. On a trusted machine, run lantunnel-admin init-tunnel with gateway details to create a tunnel. 4. Use lantunnel-admin add-peer to generate a signed .peer profile for each device. 5. Copy the .peer profile to the device and run lantunnel-client tunnel import ./device.peer. 6. Start lantunnel-client (desktop UI or --headless for servers).
• 7. Devices connect to the gateway via the signed profile; direct QUIC path is attempted first. 8. If hole punching fails, traffic is sealed with XChaCha20-Poly1305 and relayed through the gateway.
• 9. Access control is enforced locally on each target device; the gateway never sees plaintext or private keys.

证据

Lantunnel is my attempt at a fourth option: a small private mesh where peers talk directly whenever the network allows it, and where the fallback path still cannot read your traffic.

来源

Relayed payloads are sealed with XChaCha20-Poly1305 under keys derived from an X25519 exchange between the two peers.

来源

The gateway never holds peer private keys and never sees plaintext.

来源