How to Use Localtonet: Complete First Setup Guide
This guide explains how to start using Localtonet from scratch. You will learn how to create an account, install the client, associate a device with its AuthToken, configure a tunnel, and start it from the dashboard. Localtonet exposes a service running on your machine through a public URL or public host and port without requiring inbound router port forwarding, firewall changes, a public IP address, or VPN setup. The tunnel is available only while the selected client is connected and the tunnel is running.
What You Will Learn
If you are new to Localtonet, this guide walks through the general onboarding workflow from account registration to a running tunnel. The Localtonet client runs on the device that hosts your application or can reach it over the local network. That client establishes an outbound connection to a Localtonet relay server, so you do not need to configure inbound router port forwarding for the tunnel.
A standard HTTP, TCP, UDP, combined UDP/TCP, or TLS tunnel points to a local IP address and port that the client device can reach. File Server tunnels work differently because they publish a local folder path. Proxy tunnel types also work differently because the connected device becomes the proxy exit node rather than forwarding traffic to a conventional local IP-and-port target.
Video Tutorial
Step-by-Step Localtonet Setup
Create your Localtonet account
If you do not already have an account, register and then sign in. Registration is available with account credentials or the currently displayed supported sign-in providers. After signing in, open the dashboard to manage device tokens and tunnels.
- Create an account.
- After registration, open your Dashboard.
Install Localtonet on the device
Install or run Localtonet on the device that hosts your service or can reach that service over the local network. The current download page provides options for Windows, macOS, Linux, Android, Docker, and Zero-install SSH. Follow the platform-specific instructions shown on that page because installation and background-service commands differ by operating system.
- Open the Download page and select your platform.
- Use the architecture and installation method appropriate for your device.
- Keep the client available on the device that must originate the tunnel connection.
Create and copy a device AuthToken
An AuthToken identifies the client device that will run the tunnel. Open the My Tokens page, create a token for the device, and copy its value for use in the client. Give tokens descriptive names so you can distinguish devices in the dashboard.
- Open the My Tokens page after signing in.
- Create a token and name it after the relevant device or environment.
- Copy the AuthToken without publishing it or placing it in shared screenshots.
Authenticate the Localtonet client
Start the application and provide the device-specific token. On supported desktop command lines, the current download instructions show the command below. The placeholder must be replaced locally with the real token and must not be copied into public documentation, source control, chat messages, or support posts.
- Desktop client: Paste the token into the screen that opens, or run
localtonet --authtoken <YOUR_TOKEN>. - Android: Follow the token entry flow provided by the current Android application and documentation.
- Docker: Pull the current image and pass the token as documented in the Docker documentation.
Once authentication succeeds, the device can appear as an available client for tunnel configuration. Authentication alone does not create or start a tunnel.
Choose the correct tunnel family and local target
Open the dashboard and choose the tunnel family that matches the service. For an ordinary HTTP, TCP, UDP, combined UDP/TCP, or TLS tunnel, select the authenticated device and enter the local IP address and port that the client can reach. For example, a web application listening only on the same device might use 127.0.0.1 and its actual listening port.
- Use an HTTP/s tunnel for a local web application or HTTP endpoint.
- Use the matching raw port tunnel for TCP, UDP, combined UDP/TCP, or TLS traffic.
- Use File Server when the target is a folder path rather than a listening application.
- Use a proxy tunnel only when the connected device is intended to act as the proxy exit node.
Select an available relay server and create the configuration
Select the device AuthToken and an available relay server or region from the current product interface. Do not rely on a hardcoded server code from an old tutorial because available values may change. Enter the required local target details and save or create the tunnel configuration.
Creating the configuration does not mean the tunnel is running. Review the device, tunnel type, local address or folder path, and any access settings before starting it.
Start and test the tunnel
Press Start for the tunnel and confirm that the selected Localtonet client remains connected. A running HTTP tunnel provides a public web address, while raw port tunnels provide the applicable public host and port. Test the endpoint with a client appropriate for the protocol rather than assuming that every endpoint can be opened in a web browser.
- Confirm the local service is already running and listening on the configured address and port.
- Confirm the Localtonet device remains connected.
- Confirm the tunnel status shows that it is running.
- Test only with authorized users and the correct protocol client.
Stop or delete the tunnel when it is no longer needed
Stop a tunnel when the public endpoint should no longer be available. Delete configurations you no longer need, and revoke or replace a device token if it may have been exposed. A tunnel also stops being available when its selected client disconnects, but intentionally stopping unused exposure is the safer operational practice.
An AuthToken identifies a Localtonet client device. Never publish a real token in an article, repository, screenshot, container image, command history shared with others, or support message. Use placeholders in examples and replace a token if you believe it has been disclosed.
How the Tunnel Lifecycle Works
Localtonet separates tunnel configuration from tunnel operation. First, you create a configuration that identifies the tunnel type, device, relay selection, and target. You must then start that configuration. The public endpoint remains usable only while the selected client device is connected and the tunnel is running. You can later stop the tunnel without deleting its configuration, or delete it when it is no longer required.
| State or action | Meaning | Public availability |
|---|---|---|
| Created | The tunnel configuration has been saved. | Not necessarily available because it still must be started. |
| Started and connected | The selected client is connected and the tunnel is running. | The assigned public URL or host and port can accept traffic. |
| Stopped | The configuration remains, but the tunnel is not running. | Unavailable through that tunnel. |
| Deleted | The tunnel configuration has been removed. | Unavailable through that deleted configuration. |
Protect Services You Expose
A public endpoint makes the configured service reachable from the internet. Do not treat the tunnel itself as a replacement for application authentication or authorization. Before sharing an endpoint, verify that the application requires appropriate credentials, exposes only the functions intended for remote use, and does not reveal development secrets, administrative panels, private files, or debugging information.
Apply least privilege and use current Localtonet access controls where they are available for your selected tunnel type and plan. Keep the local application patched, review its own security configuration, and share the endpoint only with intended users. Stop the tunnel after a demonstration, webhook test, support session, or temporary remote-access task has ended.
Localtonet does not move your application to hosted storage. The application continues running on your device, and the Localtonet client provides connectivity through a relay. Availability therefore depends on the local application, the client device, its network connection, and the running tunnel.
Common First-Tunnel Checks
Next Steps
After your first tunnel works, review the documentation for the specific tunnel family you intend to use. Localtonet supports web application exposure, raw TCP and UDP forwarding, combined UDP/TCP tunnels, TLS tunnels, File Server publishing, HTTP and SOCKS5 proxy use cases, and VPN Manager. VPN Manager is the private mesh VPN feature. Standard HTTP, TCP, UDP, TLS, and File Server tunnels should not be described as VPN connections.
For current tunnel options, operating-system instructions, and service-specific guides, visit the Localtonet Documentation. Check the live dashboard for currently available relay servers, regions, plan-dependent options, and configuration fields rather than relying on values copied from an older tutorial.
FAQ
What is an AuthToken in Localtonet?
An AuthToken identifies the Localtonet client device that will run a tunnel. It is device-specific and must be kept secret. Authenticating a device does not automatically create or start a tunnel.
Do I need to keep Localtonet running?
Yes. The selected client device must remain connected and the tunnel must remain started for the public endpoint to function. The local application must also remain available.
Can I run Localtonet on multiple devices?
Yes. Devices can use their own AuthTokens and can be selected when configuring tunnels in the dashboard. Available usage may vary by the current account plan.
Does creating a tunnel make it active immediately?
No. Creating a tunnel saves its configuration. You must start it, and its selected client must be connected, before the endpoint is available.
Does a public tunnel automatically protect my application with authentication?
Do not assume that it does. Protect the application with suitable authentication and authorization, configure applicable tunnel access controls, expose only necessary functionality, and stop the tunnel when it is no longer needed.
What should I enter as the local target?
For HTTP, TCP, UDP, combined UDP/TCP, and TLS tunnels, enter the local IP address and port reachable from the client device. A File Server tunnel uses a local folder path instead. Proxy tunnel types make the connected device the proxy exit node and do not use a conventional local service target.
Start Using Localtonet
Create an account, connect a device, configure the correct tunnel type, and start the tunnel when you are ready to make the service available.
Get Started Free →
