StartTunnel
A virtual private router: a minimal router that runs on a VPS instead of at home. Private access to your services from anywhere, and public hosting with your home's address hidden behind the VPS. Free and open source; it runs on a VPS you rent.
Your own router in the cloud
A home router creates a private network, gives devices addresses, and forwards ports from the internet to the devices you choose. StartTunnel does the same three things on a rented server with a public address, using encrypted WireGuard tunnels where a home router uses cables. Your server at home and your phone on the move join it from wherever they are, and because it runs in a data center, it works whether or not your home connection accepts visitors.
Your address stays private
Visitors reach your services at the VPS's address. Your home's address is never revealed to them.
Works on any connection
Satellite, cellular and other connections that turn visitors away still work. Your server connects out, and the VPS takes visitors in.
Nothing in the middle
A published port is forwarded packet by packet, never decrypted. HTTPS ends at your own service, not at the VPS.
Yours alone
It runs on a VPS you rent from a provider you choose, with no account and no telemetry. The software is free; the VPS is typically $5 to $10 a month.
Subnets
A subnet is a private network of its own, like the one a home router creates: one for your own devices, another for friends who should reach one shared server and nothing more. Devices on a subnet reach each other by address, wherever each of them is.
Devices
Add a phone, a laptop or a server, and StartTunnel creates its WireGuard keys and configuration. Scan the QR code with the WireGuard app, download the file for a computer, or add it to StartOS as a gateway.
Published Ports
Publish a port and the internet reaches your service through the VPS, at the VPS's address, the way a home router forwards a port. Your home's address never appears. Traffic is forwarded packet by packet, so HTTPS ends at your own service. Publishing over IPv4 needs a VPS with a dedicated public IPv4 address.
Made for StartOS
Add StartTunnel to StartOS as a gateway and the server takes care of itself: it opens the ports its public addresses need and closes them when you turn the addresses off. Any service, or the whole server, can also send its outbound traffic out through the VPS.
Private DNS
StartTunnel answers DNS for your tunnel, so every connected device reaches your services by name. The names are private to the tunnel and never published to the internet. A StartOS server adds its own, and you can add others by hand.
A Way Through CGNAT
Satellite, cellular and some fiber and cable connections sit behind carrier-grade NAT, which turns visitors away before they reach the home router. StartTunnel needs no inbound connection: your server connects out to the VPS, and the VPS takes visitors in on its behalf.
For developers
StartTunnel is a Rust server binary built on the same backend as StartOS, with an Angular web interface. The tunnels are WireGuard, with a pre-shared key on every peer, and a published port is kernel-level NAT that never reads the payload. StartTunnel owns the VPS's firewall, disabling UFW and managing its own iptables rules, which is why it expects to be the only application on the machine. Issues and pull requests are accepted.