Every tunnel has a settings panel in the dashboard. This page shows where to open it, lists each setting, says which tunnel types have it, and links to the page that explains it in detail.
Open the settings of a tunnel #
-
Open the page of the tunnel type #
In the dashboard menu, open My Tunnels and choose the type: My Tunnels › HTTP, TCP - UDP, TLS, File Server, Proxy Server, Rotating Proxy or MCP Gateway.
-
Select Settings in the tunnel row #
Find the tunnel under Your tunnels and select Settings in the Actions column. The Tunnel settings panel opens at the side of the page.
-
Change a setting #
The panel has these parts:
- Tunnel Details: details such as the address of the tunnel, the creation date and the AuthToken name, and the values you can edit by selecting them: the title on every tunnel type, and also the local address and the local port on HTTP, TCP - UDP and TLS tunnels.
- The load balancing targets of the tunnel, on the tunnel types that support them. See Load balancing.
- Show SSH Command, on the tunnel types that can be started with plain SSH. See Zero-install SSH.
- Settings: one row per setting. A row has either a Yes / No switch or a button (Manage, Change, Show or Clear) that opens a dialog. The information icon next to a label explains the setting in one sentence.
Most switches ask you to confirm before they change anything, for example Turn on HTTPS only? with the buttons Turn on and Cancel. Turning on Basic Authentication? or Rewrite Path? opens a dialog instead, and turning on Is Reserved? on a running tunnel reserves the port without a question.
How changes are applied #
Some settings are applied to a running tunnel without interrupting it. Others stop the tunnel and start it again with the new value, which takes a moment and drops the connections that are open.
| Applied without a restart | Restarts a running tunnel |
|---|---|
| Is Only Https?, Rewrite Path?, Is HTTP/3 Active?, Is Reserved?, Headers, HTTP Timeout, Tunnel Note, IP Restriction, Expiration Date, Outbound Port, Bandwidth Limit, Bandwidth Usage, the WAF switch | The title, local address and local port in Tunnel Details, Basic Authentication?, Is SslStream?, Proxy Protocol?, Legacy Connect?, Server Port, Arguments, Local Server IP, Speed Limits, changing the server, changing the AuthToken |
A setting that restarts the tunnel can only be saved on a running tunnel while the Localtonet app of its device is connected. Otherwise the dashboard answers "Check the device connection." and keeps the old value. On a stopped tunnel the value is saved and used at the next start.
Which tunnel type has which setting #
The labels are the ones the Settings section shows. "Yes" means the tunnel type has the row.
| Setting | HTTP | TCP - UDP | TLS | File Server | Proxy Server | Rotating Proxy | MCP Gateway |
|---|---|---|---|---|---|---|---|
| Is Only Https? | Yes | – | – | – | – | – | Yes |
| Rewrite Path? | Yes | – | – | – | – | – | – |
| Basic Authentication? | Yes | – | – | Yes, type Default | – | – | Yes |
| Is SslStream? | Yes | Yes, not for UDP | Yes | – | – | – | – |
| Is HTTP/3 Active? | Yes | – | – | – | – | – | Yes |
| Is Reserved? | – | Yes | – | – | Yes | Yes | – |
| Proxy Protocol? | – | Yes, not for UDP | – | – | – | – | – |
| Legacy Connect? | Yes | Yes | Yes | Yes | Yes | – | Yes |
| SSL Mode | – | – | Yes | – | – | – | – |
| SSO Providers | Yes, not on team tunnels | – | – | – | – | – | – |
| Gateway Token | – | – | – | – | – | – | Yes |
| Headers | Yes | – | – | – | – | – | – |
| HTTP Timeout | Yes | – | – | – | – | – | Yes |
| Server Port | – | Yes | – | – | Yes, not for VLESS | Yes | – |
| Tunnel Note | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Local Server IP | Local server only | Local server only | Local server only | – | Local server only | – | Local server only |
| Arguments | Yes | Yes | Yes | – | Yes | – | – |
| IP Restriction | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Expiration Date | Yes | Yes | Yes | Yes | Yes | – | Yes |
| Speed Limits | Yes | Yes | Yes | Yes | Yes | – | Yes |
| Outbound Port | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Bandwidth Limit | Yes | Yes | Yes | Yes | Yes | – | Yes |
| Bandwidth Traffic | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Bandwidth Usage | Yes | Yes | Yes | Yes | Yes | – | Yes |
| Tunnel IP | – | Yes | Yes | – | Yes | Yes | – |
| Request Log | Yes | Yes | Yes | Yes | Yes | – | Yes |
| Activity Log | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Tunnel Health | Yes | Yes | Yes | – | Yes | Yes | Yes |
The Proxy Server and Rotating Proxy pages have more rows of their own, such as Proxy Authentication, Access Control, Upstream Setting, VPN Access, Speed Test, Tunnel Token and Just Connect with Ipv4?. They are described in Proxy Server and Rotating Proxy. A tunnel that uses the Local server has no Outbound Port row. "Local server only" also covers a tunnel whose Server column shows VPN.
What each setting does #
| Setting | What it does | Details |
|---|---|---|
| Is Only Https? | Serves the public URL over HTTPS only. | Headers and rewrites |
| Rewrite Path? | Adds a path in front of every request before it reaches your local service. | Headers and rewrites |
| Basic Authentication? | Asks visitors for a username and password. | Access control |
| Is SslStream? | Tells the tunnel that your local service itself uses HTTPS or TLS. | This page |
| Is HTTP/3 Active? | Lets clients reach the public URL over HTTP/3. | Headers and rewrites |
| Is Reserved? | Keeps the same server port when the tunnel restarts. | Ports |
| Proxy Protocol? | Passes the original client address to your service in a PROXY protocol header. | This page |
| Legacy Connect? | An alternative connection method to try when the tunnel cannot connect with the normal one. | This page |
| SSL Mode | Chooses whether Localtonet handles HTTPS for a TLS tunnel or passes the encrypted traffic through to your service. | TLS |
| SSO Providers | Makes visitors sign in with one of your identity providers before they can open the tunnel. | Single Sign-On |
| Gateway Token | Shows the token your MCP clients send to connect to the gateway. | MCP Gateway |
| Headers | Adds fixed request and response headers. | Headers and rewrites |
| HTTP Timeout | Sets how long the tunnel waits for your service to answer a request. | Headers and rewrites |
| Server Port | Changes the port people connect to on the Localtonet server. | Ports |
| Tunnel Note | A private reminder of what the tunnel is for. | This page |
| Local Server IP | The addresses your local server can be reached on. | This page |
| Arguments | Sends the tunnel through a specific network of the device. | Network selection |
| IP Restriction | Chooses which IP addresses can connect to the tunnel. | Access control |
| Expiration Date | Stops the tunnel on a set date. | Limits and expiration |
| Speed Limits | Caps the upload and download speed. | Limits and expiration |
| Outbound Port | Keeps the ports the Localtonet app connects out to fixed, for strict firewalls. | Ports |
| Bandwidth Limit | Stops the tunnel after it has moved a set amount of data. | Limits and expiration |
| Bandwidth Traffic | Charts the data that went through the tunnel. | Limits and expiration |
| Bandwidth Usage | Resets the data counter of the tunnel to zero. | Limits and expiration |
| Tunnel IP | Shows the IP addresses of the server the tunnel runs on. | This page |
| Request Log | Shows the requests or connections recorded for the tunnel. | Logs and inspection |
| Activity Log | Lists starts, stops and setting changes. | Logs and inspection |
| Tunnel Health | Shows the results of the regular health checks. | Logs and inspection |
Tunnel details #
Select a value in Tunnel Details to edit it. Saving any of the three restarts a running tunnel. The local address and the local port can be edited here on HTTP, TCP - UDP and TLS tunnels; the other tunnel types show only the title.
| Dialog | What to enter | Rules |
|---|---|---|
| Rename tunnel | A name you will recognise in your tunnel list, for example "Office NAS". | Required. Up to 30 characters: the dialog counts up to 100, but a title longer than 30 is refused with "The title cannot exceed 30 characters." |
| Local address | Where the Localtonet app finds your service. Use 127.0.0.1 when the service runs on the same device as the app. To reach another device on your network, enter its address, for example 192.168.1.20. | An IPv4 address, an IPv6 address or a host name. No http://, no path, no port. |
| Local port | The port your service listens on, on the device that runs it. | A number from 1 to 65535. |
Tunnel Note #
Tunnel Note › Manage opens the Note dialog. A note is a reminder of what the tunnel is for, and only your account sees it.
- A note can be up to 499 characters. The dialog counts them as you type.
- The choices under Label put a label in front of the note: Production, Staging, Testing, Demo or Temporary. The note then starts with, for example,
Staging -. Choosing another label replaces the one that is there.
Is SslStream? #
Turn Is SslStream? on when your local service itself uses HTTPS or TLS, for example a development server that only listens on https://localhost. Leave it off for a service that speaks plain HTTP or plain TCP. HTTP, TCP and TLS tunnels have the switch; a UDP tunnel does not.
Proxy Protocol? #
With Proxy Protocol? on, the tunnel passes the original client address to your service in a PROXY protocol header. Turn it on only when your service is set up to read that header, because a service that does not expect it sees unknown bytes at the start of every connection. TCP tunnels have the switch; a UDP tunnel does not.
Legacy Connect? #
Legacy Connect? switches the tunnel to an alternative connection method. Try it if the tunnel cannot connect with the normal method, and turn it off again if it does not help.
Local Server IP #
This row appears only on tunnels whose Server column shows Local or VPN. The Local server IP dialog holds the addresses your local server can be reached on: an IPv4 address and, optionally, an IPv6 address. Leave IPv6 empty if you do not use it. At least one address is required. An address that only works on the device itself, such as 127.0.0.1, 0.0.0.0 or ::1, is refused with "The local server IP must be reachable from outside."
Tunnel IP #
Tunnel IP › Show opens the Server IP dialog with the IPv4 and, where the server has one, the IPv6 address of the server the tunnel runs on. Clients can connect to the tunnel with this address instead of the domain name.
Server IP addresses can change. Use the domain name in apps and scripts whenever you can.
Settings in the tunnel list #
Two settings are changed from the tunnel list, not from the panel.
Change the server #
Select the server code in the Server column, choose another server in the Change Server dialog and select Submit. A running tunnel is restarted on the new server.
- Changing the server needs Balance. Without it the dashboard answers "You need to purchase balance to use this feature."
- If the server port of the tunnel is already taken on the new server, you get "Your tunnel's port (PORT) is not available on the selected server. Change the port first." Change the port as described in Ports, then try again.
- Tunnels whose Server column shows Local or VPN cannot be moved.
When a server change occurs, DNS updates may take up to 3 hours.
Change the AuthToken #
Select the token name in the AuthToken column to open Change AuthToken, choose another AuthToken and select Submit. This moves the tunnel to the device that runs the Localtonet app with that token.
- A running tunnel stops, waits 2 seconds, then restarts using the selected AuthToken. A stopped tunnel remains stopped.
- If the app with the new token is not connected, the token is still changed and you get "The AuthToken was updated, but the tunnel could not be restarted. Connect the Localtonet app with the selected token and start the tunnel."
- Rotating Proxy tunnels use AuthToken groups. Change the groups instead.
AuthTokens are explained in AuthTokens.
Web Application Firewall #
HTTP and MCP Gateway tunnels also have a shield button in the Actions column. It opens the firewall of the tunnel. See Web Application Firewall.
The same settings through the API #
Most settings can also be read and changed with the API, under the path of the tunnel. Authentication and the full reference are in API.
| Setting | Path after /api/v2/tunnels/<TUNNEL_ID>/ |
|---|---|
| IP Restriction | ip-restrictions |
| Headers | headers, host-header |
| Basic authentication | authentication |
| Expiration Date | expiration |
| Server Port | server-port |
| HTTP Timeout | http-timeout |
| Speed Limits | rate-limit |
| Bandwidth Limit and usage | bandwidth-limit, bandwidth-usage, bandwidth-usage/reset |
| Arguments | arguments |
| Is Only Https?, Is HTTP/3 Active?, Rewrite Path? | https-only, http3, path-rewrite |
| Is SslStream?, Proxy Protocol?, SSL Mode | ssl-stream, proxy-protocol, pass-through |
| Tunnel Note | note |
| Server | server |
Troubleshooting #
"Check the device connection."
The setting restarts the tunnel, and the Localtonet app of the tunnel's device is not connected. Start the app on the device, wait until the Connection column shows ON, then save again. You can also stop the tunnel first: on a stopped tunnel the value is saved without a restart.
"You need to purchase balance to use this feature."
The setting needs Balance on the account. This applies to reserved ports, a custom server port, fixed outbound ports, IP restrictions and changing the server. See Plans and Balance.
"You do not have permission to update this tunnel."
You are working in a team and your role does not include changing tunnels. Ask the team owner to give you that permission. See Team Management.
A row from the table is missing in my panel
The panel only shows the rows of the tunnel's type, and a few rows depend on the tunnel itself: Local Server IP needs the Local or VPN server, SSO Providers is not shown on team tunnels, and a UDP tunnel has no Is SslStream? and Proxy Protocol?.
