The network is
the network.
Everything else just works. Install one agent on every laptop, server and CI runner - get an internal IP, SSH by hostname, expose services with TLS, and share public tunnels. All under one identity.
curl -fsSL https://get.tunnet.io | shPlugs into what you already run
Six verbs in One mesh
Every primitive is a verb that shares the same identity, policy and audit. Learn six commands, run a network.
Mesh · Every machine on one private network.
Direct paths when possible, relayed automatically when NAT blocks. Hostnames for every machine - no IPs to remember.
- Identity-based paths
- Auto relays when NAT blocks
$tunnet status --peers$# 14 peers · 12ms p50 · all directSolo hackers and 5,000-person orgs.
Same tool. Same commands.
Direct mode
Spin up a mesh from your laptop with a passphrase. No control plane, no server, no billing.
- SETUP
- one command
- INFRA
- no servers
- AUTH
- a passphrase
- COST
- free forever
$sudo tunnet create --name my-net --secret "a-strong-passphrase"$tunnet invite --name my-net$sudo tunnet join <INVITE_CODE>Free, forever.
Managed mode
Full control plane with SSO, audit and API. Deploy on your infra or self-host with Docker.
- IDENTITY
- SSO · OIDC
- CONTROL
- dashboard + API
- TRUST
- audit + recording
- HOSTING
- cloud or self-hosted
$docker compose up -d$sudo tunnet enroll \$ --control-url https://control.acme.dev \$ --token $TOKENCloud or self-hosted.
Outgrowing Direct?tunnet upgrade-to-managedmigrates your network without losing connectivity.
Global edge.
Your control plane.
Tunnet's public tunnels ride on edges you can run yourself. Point DNS, configure ACME, and your team gets public HTTPS endpoints on infrastructure that never leaves your account.
- Anycast public HTTPS endpoints for every tunnel
- ACME out of the box, BYO cert supported
- Regional pinning, health checks, graceful drain
- Same identity everywhere - one policy engine
The network doesn't have to be
the weakest link.
Tunnet ships with the posture your auditors ask for on day one - identity everywhere, encryption everywhere, audit everywhere. Because everything is open source, you never have to take our word for it.
Every link is encrypted end to end. No unencrypted paths, no shared secrets on the wire.
Machines enroll with verifiable identity. No SSH keys to distribute, rotate, or leak.
ACLs, roles, and tags decide reachability. Zero trust isn't a mode - it's the default.
Every session, tunnel, and file transfer is logged. SSH sessions can be replayed on demand.
Agent, control plane, dashboard, edge - AGPL, MPL and Apache by component. Self-host the entire stack.
Send verifies every transfer cryptographically. Consent-based receiving, per-rule.
From install to
full-fleet zero-trust.
Every primitive is a verb. Every verb does one thing. Follow a machine from its first enroll to running a fleet-wide policy.
- 01 · JOIN THE MESHzsh - join the mesh$sudo tunnet enroll --control-url https://control.acme.dev --token $TOKEN$tunnet status --peers
Enroll
- 02 · ADVERTISE A SUBNETzsh - advertise a subnet$tunnet route add 192.168.1.0/24$tunnet route list$tunnet netcheck
Route a LAN
- 03 · SERVE TO THE MESHzsh - serve to the mesh$tunnet serve 3000 \$ --hostname grafana.acme.mesh \$ --acl "role:ops"$tunnet serve status
Expose internal
- 04 · PUBLIC TUNNEL VIA EDGEzsh - public tunnel via edge$tunnet tunnel 3000$# → https://demo-api.rl.acme.tunnet.io$tunnet tunnel status
Public in one command
- 05 · PASSWORDLESS, KEYLESS SSHzsh - passwordless, keyless SSH$tunnet ssh db-server$tunnet ssh sessions$tunnet ssh play <session_id>
SSH by identity
- 06 · DIRECT → MANAGEDzsh - direct → managed$tunnet upgrade-to-managed$# Migrates your network to the full control plane$# without losing connectivity
Grow up
Not just the agent.
Every line.
Agent, control plane, management API, dashboard, edge - read every line, audit every path, self-host the whole thing. Commercial licenses exist for AGPL components when AGPL doesn't fit; the freedom stays either way.
0
lines of open Rust
0 licenses
components
0
contributors
0+
GitHub stars
Loved by the engineers.
Trusted by the auditors.
I stopped writing VPN docs. New engineers install one binary and can SSH to prod within an hour - with audit and re-auth already on. It's the closest thing to a magic packet I've seen.
Our auditors saw identity-scoped access, encrypted transport, and session recording out of the box. Deployment went from six weeks of ZTNA rollout to one afternoon per office.
The questions everyone asks first.
Ship the mesh
your team can trust.
Start free with Direct mode. Grow into Managed when you're ready. Self-host the whole thing whenever you want.
$curl -fsSL https://get.tunnet.io | sh$sudo tunnet enroll --control-url https://control.acme.dev --token $TOKEN$tunnet status --peers