towonel

Self-hosted tunnels for services behind NAT, CGNAT, and dynamic IPs.

Released.Latest release v1.11.2, 4 October 2026.

• Website
• Documentation
• Service status
• Source code

Towonel gives a service running at home, such as a media server, a game server or Home Assistant, a public hostname without opening ports on the router or exposing the home IP address.

Unlike hosted tunnel services, it never decrypts the traffic it carries. The public edge only reads the TLS server name and passes the encrypted stream to your own machine.

Features

Transport

TLS passthrough. The edge sees source IPs, byte counts and hostnames, never paths, headers or bodies.

Protocols

TCP and UDP: SSH, Postgres, WireGuard, TURN, game servers.

Private network

Laptops, phones and servers join with towonel mesh up and reach each other by name. Each tunnel’s network is separate, and the relay only forwards encrypted packets. How it works

Control plane

Routes are signed with ML-DSA-65 (FIPS 204), so a shared hub cannot forge them.

Access

Invite-only. Each invite is limited to a set of hostnames and ports.

Deployment

One container for the hub and edge, a stateless agent that scales in Kubernetes.

Platforms

Linux

amd64 and arm64 binaries

Container

git.ow-ops.eu/towonel/towonel-node, hub and edge in one image

Storage

SQLite by default, PostgreSQL when you outgrow it

Quick start

You need a VPS with a public IP, a domain pointed at it, and Docker. Start a node, then invite someone.

docker run -d --name towonel \
  -p 443:443 -p 8443:8443 -p 51820:51820/udp \
  -v towonel-data:/data \
  -e TOWONEL_HUB_PUBLIC_URL=https://hub.example.eu \
  -e TOWONEL_EDGE_ADVERTISED_ADDRESSES=hub.example.eu:443 \
  -e TOWONEL_EDGE_TLS_ACME_EMAIL=ops@example.eu \
  git.ow-ops.eu/towonel/towonel-node:latest

docker exec towonel \
  towonel invite create \
  --name alice \
  --hostnames 'app.alice.example.eu,*.alice.example.eu'

Recent releases

1. v1.11.24 October 2026

   • Agent: Close edge session on supervisor cancellation
   • Agent: Release forwarding tasks when a saturated session closes
   • Edge: Wait for fragmented ClientHello until the peek timeout
   • Hub: Fence stale edge links from clearing live state

2. v1.11.11 October 2026

   • Tunnel: Use BBR3 congestion control

3. v1.11.028 September 2026

   • CLI: Manage mesh policy and devices without the console

All releases

Details

License

MIT

Language

Rust

Bug reports

Issue tracker

Security issues

Report privately