TunPurl
In development · pre-releaseReach SSH, remote desktop, VNC, a database or a web app on a machine behind NAT, a router or a firewall. The private machine connects out to an SSH server you already run. The service appears only on that server's loopback interface, so nothing is exposed to the internet.
private machine your SSH server your computer 127.0.0.1:22 ── outbound SSH ──> 127.0.0.1:2222 <── SSH / ProxyJump ──
What it does
- No inbound ports. The private machine only makes outbound connections.
- Nothing public. Forwarded ports are bound to the server's loopback address only. Public binds are refused.
- Runs as a service. A background service on Linux (systemd), macOS (launchd) and Windows. It reconnects after network loss and restarts after a crash.
- Strict by default. The server's host key must be pinned before the first connection, and changed keys are refused. Each profile has its own key.
- Least privilege. The generated server settings allow only the exact forwarded ports: no shell and no other forwarding.
- No telemetry.
Who it is for
- People who support machines at home or in small offices that have no public address.
- Developers who need to reach a test machine behind a firewall.
Status and availability
TunPurl is in pre-release. Its version 1 features are built and tested automatically on Linux, macOS and Windows. The first public release is being prepared.
| Private machine | Linux with systemd, Windows 10 22H2 or 11, Windows Server 2019 or later, macOS 13 or later; amd64 or arm64 |
|---|---|
| Server | Any host running OpenSSH 8.0 or later |
Note: a tunnel doesn't replace security. Keep the services you reach patched, with strong passwords or keys.