Skip to content
Localtonet Localtonet Dashboard

Control who can reach a tunnel

On this page 6 sections
  1. Which protection is available where
  2. Basic Authentication
  3. Turn it on
  4. Open the tunnel settings
  5. Switch Basic Authentication? to Yes
  6. Enter the sign-in details
  7. Copy the details and save
  8. Rules for the username and password
  9. Change the password or turn it off
  10. Call a protected tunnel from a script
  11. IP Restriction
  12. Add addresses
  13. Open the IP restriction dialog
  14. Choose what the list means
  15. Enter the addresses and select Add
  16. Address syntax
  17. Remove addresses
  18. Example: SSH for the office only
  19. Proxy tunnels
  20. Troubleshooting
  21. Related pages

Until you protect it, an HTTP, TCP or UDP tunnel is reachable by anyone who has its address. Basic Authentication asks visitors for a username and password, and IP Restriction limits the tunnel to the IP addresses you choose. This page explains both and points to the other protections.

Which protection is available where #

ProtectionWhat it doesTunnel types
Basic Authentication?Visitors enter one shared username and password before anything loads.HTTP, File Server (type Default), MCP Gateway
IP RestrictionOnly the listed IP addresses can connect, or the listed addresses are blocked.Every tunnel type. Needs Balance.
SSO ProvidersVisitors sign in with one of your identity providers.HTTP. See Single Sign-On.
Web Application FirewallFilters malicious requests.HTTP, MCP Gateway. See Web Application Firewall.
Proxy Authentication and Access ControlA username and password for proxy clients, and a list of destinations the proxy may reach.Proxy Server. See Proxy Server.

The AuthToken of your device is not one of these protections: it connects the Localtonet app to your account and does not authenticate visitors.

Basic Authentication #

With Basic Authentication on, visitors see a sign-in prompt from their browser and must enter the username and password before anything loads. A tunnel has one username and one password, shared by everyone you give them to.

Turn it on #

  1. Open the tunnel settings #

    Open the page of the tunnel type, for example My Tunnels › HTTP, and select Settings in the row of the tunnel.

  2. Switch Basic Authentication? to Yes #

    The Basic authentication dialog opens.

  3. Enter the sign-in details #

    Fill in Username and Password, or select Generate a strong password to get a random 16-character password. The dialog rates the password as Too short, Fair, Good or Strong while you type.

  4. Copy the details and save #

    Copy puts the address, username and password on the clipboard so you can share them. Select Save. A running tunnel is restarted with the new setting.

Rules for the username and password #

FieldRulesMessage when it is wrong
UsernameRequired, up to 100 characters, no colon."Enter a username." or "Usernames can’t contain a colon (:)."
PasswordRequired."Enter a password, or use Generate."

Change the password or turn it off #

Switch Basic Authentication? to No and confirm Turn off basic authentication?. Visitors will no longer be asked for a username and password. To change the username or password, turn the switch off, then on again, and enter the new details.

Call a protected tunnel from a script #

Tools send the same credentials in the standard HTTP Authorization header. With curl:

Terminal
curl -u <USERNAME>:<PASSWORD> https://<YOUR_TUNNEL_ADDRESS>/

IP Restriction #

Needs Balance

IP Restriction decides which IP addresses can connect to the tunnel. It works on the address the visitor connects from, so it protects services that have no login of their own, such as a database or a remote desktop port.

Add addresses #

  1. Open the IP restriction dialog #

    In the tunnel settings, select IP Restriction › Manage.

  2. Choose what the list means #

    Under Listed addresses choose a mode:

    • Allow only these: only the addresses in the list can connect. Everyone else is blocked.
    • Block these: the addresses in the list can’t connect. Everyone else can.

    When the list already has entries, the dialog asks you to confirm the switch, for example Allow only the listed addresses?

  3. Enter the addresses and select Add #

    Type into Add IP addresses, or select Use my IP to insert the address you are browsing from, then select Add.

Changes apply right away. There is no Save button and the tunnel is not restarted.

Address syntax #

You enterExampleMeaning
A single IPv4 address203.0.113.10That address.
An IPv4 range in CIDR notation198.51.100.0/24Every address in the range. The number after the slash is from 0 to 32.
A single IPv6 address2001:db8::10That address. It is saved with /128.
An IPv6 range2001:db8::/48Every address in the range. The number after the slash is from 0 to 128.
Several entries at once203.0.113.10, 198.51.100.0/24Separate entries with commas or spaces.

Remove addresses #

Select the remove button next to an entry to delete it. Remove all clears the list after you confirm Remove all addresses?; the tunnel then accepts connections from any IP address again. An empty list never blocks anyone: the dialog shows "No addresses yet, so every IP address can connect."

Check your own address before you choose Allow only these. If your IP address is not in the list, you are blocked too. Home and mobile connections often get a new address from time to time.

Example: SSH for the office only #

You expose SSH with a TCP tunnel and want only your office network 198.51.100.0/24 to reach it. Open IP Restriction › Manage, choose Allow only these, enter 198.51.100.0/24 and select Add. From that moment on, every other address is blocked.

Proxy tunnels #

Proxy Server tunnels use their own settings on top of IP Restriction:

  • Proxy Authentication: clients must send a username and password to use the proxy. An HTTP or SOCKS5 proxy cannot be left open: to turn the authentication off, first add your clients’ addresses to IP Restriction in the mode Allow only these. Otherwise you get "Add an allowed IP restriction to this tunnel before disabling authentication."
  • Access Control: a list of destinations the proxy can reach, with the same two modes. It accepts domains, *.example.com for every subdomain, IP addresses and ranges.

Both are explained in Proxy Server. The clients of a Rotating Proxy have their own usernames and passwords; see Rotating Proxy.

Troubleshooting #

"You need to purchase balance to use this feature."

Adding addresses to IP Restriction and switching its mode need Balance. See Plans and Balance.

"VALUE is not an IP address or range."

The entry is not an IPv4 or IPv6 address. Host names are not accepted in IP Restriction. Enter the address itself, or a range such as 10.0.0.0/16.

"VALUE needs a range from /0 to /32." or "from /0 to /128."

The number after the slash is outside the valid range for that address family: up to 32 for IPv4, up to 128 for IPv6.

"VALUE is already in the list." or "This IP restriction already exists."

The address is already listed. Nothing needs to be added.

"Your IP address could not be detected."

Use my IP could not find your public address. Type it by hand.

"Check the device connection." when saving Basic Authentication

The tunnel is running, but the Localtonet app of its device is not connected, so the tunnel cannot be restarted with the new setting. Start the app, or stop the tunnel and save again.

I locked myself out with Allow only these

The dashboard is not affected by the tunnel's IP Restriction. Open the dialog again and add your current address, switch to Block these, or select Remove all.

Single Sign-OnSign-in with Google, GitHub, Microsoft and others. Web Application FirewallFilter requests to HTTP tunnels. Proxy ServerProxy Authentication and Access Control. Settings referenceEvery tunnel setting in one place.
Support