The Localtonet client on your device opens an outbound, encrypted tunnel to a Localtonet server. The server gives your service a public address and forwards traffic down that tunnel to the local IP address and port you chose.
The path of a request #
- A visitor connects to the public address of your tunnel. That address belongs to a Localtonet server in the region you chose.
- The Localtonet server sends the traffic into the tunnel that the client on your device has already opened.
- The Localtonet client receives the traffic and connects to the local IP address and port set on the tunnel, for example
127.0.0.1:3000. - Your service answers, and the response travels back the same way.
No port forwarding, no public IP #
Your device starts the connection, so no inbound port has to be opened. You do not need a public IP address or any change to your router. This also works behind NAT and CGNAT, on home and mobile connections where port forwarding is not possible.
Your network must still allow the outbound connection. A firewall or an endpoint security product can block it.
For HTTP and TCP tunnels you can also skip the client: the tunnel's settings show an SSH command that opens the tunnel from any machine with an SSH client. See Zero-install SSH.
Devices and AuthTokens #
An AuthToken connects one device to your account. You start the client with it, and from then on you can choose that device when you create a tunnel.
- One token per device. Create a token for each device under My Tokens and give it a name you recognize, such as
Office-PC. The name is only a label. Localtonet generates the token itself. - One connection per token. A new connection that uses the same token replaces the previous one, so do not start two devices with the same token.
- Online and Offline. My Tokens shows each device as Online while the Localtonet app is connected, and Offline when it is disconnected, even if its tunnels are still configured.
- Keep it private. Anyone who has the token can use it to sign in to the app as that device.
An AuthToken does not protect a tunnel. It identifies your device, not your visitors. A new tunnel is reachable by anyone who has its address. To restrict visitors, see Access control.
More about tokens: AuthTokens.
Tunnels #
A tunnel is a saved set of settings that links a public address to a service on one device. Every tunnel stores:
| Setting | What it decides |
|---|---|
| Tunnel type | The protocol: HTTP, TCP, UDP, TLS, File Server, Proxy Server and others. See Tunnel types. |
| Device token | The device that receives the traffic. It is the token the client on that device was started with. |
| Server region | The Localtonet server location that hosts the public address. |
| URL type | How the public address is chosen. |
| Local IP address and Local port | Where the client sends the traffic. Use 127.0.0.1 for a service on the same device as the client. |
One device can serve several tunnels. My Tokens shows the active and the total number of tunnels linked to each token. To move a tunnel to another device, select its token name in the tunnel list and choose another token under Change AuthToken. A running tunnel stops and restarts with the selected token. Rotating Proxy tunnels are the exception: they use token groups instead of a single token.
From created to live #
- Create. Create tunnel only saves the settings. Nothing is online yet.
- Start. Select Start. If the client of the tunnel's token is connected, the tunnel goes live.
- Start while the device is offline. The dashboard tells you that the token is offline and waits for the app to connect. Start anyway turns the tunnel on now. It counts as active and goes live when the app connects.
- Stop. The public address stops answering. The tunnel and its settings are kept for later.
- Delete. The endpoint and the settings of the tunnel are removed.
Deleting a token deletes its tunnels. Tunnels with that token are stopped and deleted.
Server regions #
The Server region field decides where the public address of a tunnel is hosted. The dashboard hint is: choose a region close to your device for lower latency.
The list is built for your account. It contains:
- Localtonet regions, one entry per country. The network map on the homepage shows the locations.
- Your own servers, if you added any with Server Manager. Only your account sees them, and the list selects your server by default.
- Local as a Server, on the tunnel types that support it. See below.
You can move an existing tunnel: select the server of the tunnel in the tunnel list to open Change Server. This needs Balance, and when a server change occurs, DNS updates may take up to 3 hours.
Public addresses and URL types #
When you create a tunnel, URL type decides how its public address is chosen.
| URL type | What you get | Plan |
|---|---|---|
| Random subdomain | Localtonet generates a subdomain for you. You get an address right away. | Free plan |
| Custom subdomain | You enter the Subdomain yourself and pick the Domain it belongs to. | Needs Balance |
| Custom domain | You use a domain of your own that you added in DNS Manager. See Custom domains. | Needs Balance |
Not every tunnel type offers every URL type:
| Tunnel type | Random subdomain | Custom subdomain | Custom domain |
|---|---|---|---|
| HTTP | Yes | Yes | Yes |
| File Server | Yes | Yes | Yes |
| MCP Gateway | Yes | Yes | Yes |
| TLS | Yes | Yes | No |
| TCP, UDP, UDP / TCP Mixed | Yes | Yes | No |
| Proxy Server | Yes | Yes | No |
| Rotating Proxy | Yes | Yes | No |
TCP, UDP and proxy tunnels are reached on a hostname plus a Server Port.
Does the address stay the same? #
- An HTTP tunnel keeps its subdomain until you delete the tunnel.
- For TCP, UDP and proxy tunnels, a tunnel created on an account with Balance starts with Is Reserved? turned on, which keeps the same port across restarts. You can switch it per tunnel; see Ports.
- On the Free plan the port is released when the tunnel stops, so the address can change.
End-to-end encryption #
The tunnel between your device and the Localtonet servers is encrypted. That is not the same as end-to-end encryption between a visitor and your service:
- Visitors reach an HTTP tunnel over HTTPS, with certificates that Localtonet manages for you. That HTTPS ends at the Localtonet server, not at your service. From there the traffic travels to your device through the encrypted tunnel.
- For end-to-end encryption, use a TLS tunnel in pass-through mode, where your service presents its own certificate, or a protocol that is already encrypted, such as SSH.
When the client disconnects #
A tunnel only works while three things are running: your device, the Localtonet client and your local service. If the client loses its connection or you close it:
- Visitors can no longer reach the service through the public address.
- The device shows Offline in My Tokens. The tunnel itself stays started.
- The client keeps trying to reconnect on its own. A started tunnel goes live again as soon as the app connects.
- A started tunnel is billed while it is started, even if its device is offline. Stop the tunnel to end its charges. See Plans and Balance.
To keep the client running after a logout or a reboot, install it as a service: Run as a service. To be told when a tunnel or a token disconnects, set up Webhooks.
Local as a Server #
Local as a Server is an entry in the Server region list. With it, no Localtonet server hosts the public address. The Localtonet client on your device opens the listener itself, and visitors connect to your device directly. The dashboard also calls these tunnels Client Relay.
- It is offered when you create HTTP, TCP, UDP, TLS, Proxy Server and MCP Gateway tunnels. File Server and Rotating Proxy do not offer it.
- When you select it, the form asks for a Relay server IP: the IP address of your device that visitors connect to.
- The device that hosts the listener must stay connected.
- Client Relay tunnels have their own, lower price. See Plans and Balance.
| Message | What to do |
|---|---|
| Enter the local server IP. | Fill in Relay server IP. |
| The local server IP must be reachable from outside. | You entered a loopback or other local-only address such as 127.0.0.1. Enter an address that your visitors can reach. |
