Frequently asked questions

Localtonet is a tunneling and proxy platform that makes services on your computer or private network reachable from the internet. You can publish web apps, APIs, databases, game servers, files and proxies without port forwarding or a public IP address.

The Localtonet app on your device opens an outbound connection to a Localtonet server. Visitors connect to a public address on that server, and their traffic travels back through the existing connection to the local IP and port you chose. Because your device starts the connection, no inbound port has to be opened.

No. Localtonet creates an outbound connection from your device and gives your local service a public endpoint. You do not need a public IP address or any change to your router's port forwarding settings. Your network must still allow the outbound connection, because a firewall or endpoint security product can block it.

Yes. CGNAT stays in place, and the tunnel routes around it because your device starts the connection. This covers home and mobile connections where port forwarding is not possible.

Install the Localtonet app, copy an AuthToken from My Tokens in your dashboard, and run localtonet --authtoken YOUR_TOKEN. Then create a tunnel in the dashboard by choosing its type, token, server, local IP and local port, and click Start.

Creating a tunnel only saves its settings. The tunnel must be started, and the Localtonet app using its token must stay connected. Also check that your service is listening on the local IP and port set on the tunnel.

No. Your device, the Localtonet app and your local service all have to be running for visitors to reach the service. To keep the app running after a logout or reboot, install it as a service.

Yes, on Windows, macOS and Linux with systemd. With administrator rights, run localtonet --install-service --authtoken YOUR_TOKEN and then localtonet --start-service --authtoken YOUR_TOKEN. Service mode starts only the client, so confirm that the tunnel you need is running after a reboot.

The app is available for Windows (x64, x86 and ARM64), macOS (Intel and Apple Silicon), Linux (x64, ARM and ARM64, with musl builds and DEB and RPM packages), Android and Docker. The download page also has OpenWrt and NAS options.

Yes, for HTTP and TCP tunnels. Create the tunnel in your dashboard, open its settings, and run the SSH command shown there from any machine that has an SSH client.

Localtonet has HTTP/HTTPS, TCP, UDP, UDP/TCP and TLS tunnels. It also has File Server tunnels for sharing folders, Proxy Server tunnels (HTTP, SOCKS5, Shadowsocks and VLESS), Rotating Proxy tunnels and MCP Gateway tunnels for AI tools.

An HTTP/s tunnel ends TLS at the Localtonet edge and forwards HTTP to your service, with the certificate handled for you. A TLS tunnel can pass the encrypted connection directly to your service on port 443, so your application presents its own certificate.

Yes. Use a TCP tunnel for games such as Minecraft Java Edition, a UDP tunnel for UDP games such as Minecraft Bedrock, or a UDP/TCP tunnel for a game that needs both. On the free plan these tunnels stop after 30 minutes and can be started again.

Yes. Create a TCP tunnel to the service's local port, such as 22 for SSH, 3389 for RDP or 3306 for MySQL. A new tunnel is publicly reachable, so keep strong authentication on the service and add an IP restriction, which requires Balance.

An HTTP tunnel keeps its subdomain until you delete the tunnel. For TCP, UDP and proxy tunnels, accounts with Balance get a reserved port that stays the same across restarts. On the free plan the port is released when the tunnel stops, so the address can change.

Add the domain in DNS Manager, replace its nameservers at your registrar with ns1.localtonet.com and ns2.localtonet.com, and select it when you create an HTTP tunnel. Propagation usually takes 1 to 2 hours and can take up to 48. TLS certificates are issued automatically. Custom domains require Balance.

Yes. Create a separate AuthToken for each device in your dashboard, then use that token in the Localtonet app on that device. A new connection using the same token replaces the previous one.

Yes. Sign in to the Localtonet Android app with a token, then create a Proxy Server tunnel for that token in your dashboard. Traffic leaves through the phone's active network, whether that is mobile data or Wi-Fi.

Yes, with supported models. USB Devices in the dashboard lets a USB modem or Android phone act as the internet connection of a proxy tunnel, and change its IP on a schedule or through a link.

Yes. Server Manager adds your own Linux server using its SSH details, then Localtonet verifies and sets it up. Adding a server requires Balance, and tunnels on it are billed at the normal rate.

You choose a server when you create a tunnel. The network map on the homepage shows the available locations.

Yes, and no credit card is needed. The free plan allows one tunnel and 1 GB of bandwidth per 30 days. TCP, UDP, TLS and proxy tunnels stop after 30 minutes and can be started again. HTTP, File Server and MCP Gateway tunnels have no time limit.

Free accounts get automatic SSL/TLS certificates, Basic Authentication, the WAF, Request Inspection, header modification, the API, and VPN Manager with 1 network and 5 devices.

Localtonet shows it once to visitors of tunnels on accounts without Balance, to deter misuse of free hosting. To remove it, send a localtonet-skip-warning request header with any value, or add Balance to your account.

A standard tunnel costs $0.0028 per hour, which is about $2 for a 720-hour month. Bandwidth is not billed and there is no subscription. Rotating Proxy tunnels are charged for each token in their linked groups, and Client Relay tunnels cost $0.00035 per hour.

Add credit to your Balance, and started tunnels are charged from it by the hour. A tunnel is billed while it is started, even if its device is offline, so stop a tunnel to end its charges. A stopped tunnel costs nothing.

Balance removes the free limits on tunnel count, bandwidth and running time. It also unlocks custom subdomains, custom domains, reserved ports, IP restrictions, SSO, team creation, your own servers, and more VPN networks and devices.

Your Balance cannot go below zero. The account returns to the free limits, so running tunnels can stop. Tunnels are not deleted, and you can start them again after topping up.

You can pay in US dollars by card through Stripe, with PayPal, or with cryptocurrency through NOWPayments. Under the Terms of Service, refund requests must be submitted within the first 24 hours.

Not by default. Visitors reach HTTP tunnels over HTTPS with automatically managed certificates, but TLS ends at the Localtonet edge. For end-to-end encryption, use a TLS tunnel in pass-through mode or a protocol that is already encrypted, such as SSH.

A new tunnel is reachable by anyone who has its address, and an AuthToken does not authenticate visitors. Basic Authentication works on HTTP, TLS, File Server and MCP Gateway tunnels. SSO works on HTTP and MCP Gateway tunnels, with providers including Google, GitHub, Microsoft, GitLab and OpenID Connect. IP allow and deny lists work on every tunnel type. SSO and IP restrictions require Balance.

Yes, for HTTP, TLS and MCP Gateway tunnels. Detection mode logs suspicious requests without blocking them, and Prevention mode blocks or challenges them. Start in Detection mode so you can review false positives first.

Localtonet records connection metadata: the tunnel, visitor IP, token name, protocol, time and destination, which for a proxy tunnel is the host and port visited. Request headers and bodies are stored only if you turn on Request Inspection, and those logs are kept for up to 7 days. Relayed traffic is also sampled automatically for abuse detection.

Some antivirus products flag tunneling tools because forwarding traffic through an outbound connection resembles how some remote access malware behaves. Download Localtonet only from the official website. If it is flagged, add an exception and report the false positive to the antivirus vendor.

Both publish local services through outbound tunnels. Localtonet combines HTTP/HTTPS, TCP, UDP, TLS, file sharing, HTTP and SOCKS5 proxies and a private mesh VPN in one product, billed per tunnel by the hour. Limits on other services change often, so check their current plans when you compare.

Cloudflare Tunnel suits HTTP and HTTPS sites on a domain you keep on Cloudflare. Localtonet fits better when the public needs to reach a UDP port, which Cloudflare's published applications do not offer, when uploads exceed the 100 MB limit of Cloudflare's Free and Pro plans, or when you do not own a domain.

Yes. Create an HTTP tunnel to the port where the model's API or web interface listens. The tunnel is public by default, so add Basic Authentication, SSO or an IP restriction before sharing it.

Yes, in two ways. An MCP Gateway tunnel publishes the McpNet Gateway bundled with the client. Localtonet also runs a remote MCP server at /mcp, which takes your API key as a Bearer token and lets clients such as Claude and Cursor manage tunnels, auth tokens, token groups and SSO providers.

Yes. The v2 API authenticates with your API key and can list, create, start, stop and delete tunnels, individually or in bulk. API access is available on free accounts.

Yes, with Device Terminal. Run localtonet --terminal enable --authtoken YOUR_TOKEN on the machine and approve the short code in My Devices. A Terminal button then opens a shell in the browser, and the same shell is reachable with ssh -p 24 DEVICE@NODE, as shown in the dashboard. The device only makes outbound connections. Opening a browser shell needs two-factor approval, and every session is logged. Device Terminal is free and runs on Windows and Linux.

Yes. Webhooks send a JSON POST request to your URL when a tunnel connects or disconnects, and when a token disconnects. The payload contains the Id, ActionDate, Type and Status fields.

Yes. VPN Manager connects your devices in a private mesh with virtual IPs, optional LAN bridging and per-device firewall rules. Free accounts get 1 network and 5 devices, and more requires Balance. Each device needs administrator privileges.