Your localhost, one link away.
A tunnel to localhost that runs on your own Cloudflare account.
Deploy one Worker. After that, any machine you give its address to (yours, a teammate's, an AI agent's sandbox) runs one command and gets a public URL for its local server. No sign-up, no token, no cloudflared. WebSockets work, and it gets through the HTTPS proxies that stop other tunnels.
How it works
01The CLI on your machine opens one connection out to your relay and keeps it open. Requests to the tunnel's URL reach the relay, go down that connection to the CLI, and the CLI passes them to your local server. Nothing listens on your machine and no port is opened in your router.
Each tunnel is its own Durable Object on your relay, named by a random token. When the CLI exits, the tunnel and its URL are gone.
Why another tunnel
02- Quick tunnels drop WebSockets. Cloudflare's free trycloudflare.com tunnels are flaky for WebSocket traffic and have tight limits, so hot reload, chats and games break.
- Named tunnels need a login on every machine. cloudflared login and a Cloudflare account wherever you want to expose something. With anontun you set it up once, on your account, and nobody else needs anything.
- Sandboxes only allow HTTPS. CI runners, cloud coding agents and corporate laptops send everything through an HTTPS proxy on port 443. cloudflared and ngrok need raw TCP to their edge and fail there; anontun only ever speaks HTTPS and WSS on 443.
- It's yours. The relay runs on your Cloudflare account, so the traffic, the limits and the logs are yours too.
Deploy your relay
03Once per person or team. You need a Cloudflare account; the free plan is enough to start.
- Clone blitzdotdev/anontun and go to its relay folder.
- Run npm install, then npx wrangler login once.
- Run npx wrangler deploy. It prints your relay's address, like https://anontun.you.workers.dev.
On a domain of your own, tunnels can have their own hostnames (https://<token>.tunnel.example.com/), which single-page apps prefer. The README has the DNS and certificate steps.
Open a tunnel
04- Point the CLI at your relay: export ANONTUN_RELAY=https://anontun.you.workers.dev, or pass --relay.
- Run npx anontun 3000 for localhost:3000, or give it any local URL.
- Share the URL it prints. It works until you press Ctrl-C.
Behind a proxy
05An AI agent in a cloud sandbox can start a dev server and show it to you through anontun, even where every connection goes through the sandbox's proxy. Two things make that work:
- It uses the proxy. The CLI honours HTTPS_PROXY and NO_PROXY and tunnels its connection through the proxy. A proxy that re-signs TLS works once its certificate is in NODE_EXTRA_CA_CERTS.
- It doesn't need WebSockets on its own side. When a proxy refuses the upgrade, the CLI switches by itself to a stream of server-sent events plus plain POSTs. Visitors to the tunnel can still use WebSockets; only the CLI's leg changes.
What it does and doesn't
06| Works | |
|---|---|
| Every HTTP method | Request and response headers passed through |
| Bodies | Up to 10 MB each way, buffered |
| WebSockets | End to end, including the requested subprotocol (Vite's vite-hmr) |
| Tunnels | One per CLI process; a new run gets a new random URL |
| Not yet | |
|---|---|
| Streaming bodies | Large uploads and downloads are buffered |
| Names you choose | Tokens are random |
| Passwords on a tunnel | Anyone with the URL reaches the port |
| TCP and UDP | HTTP and WebSockets only |
Questions
07Is there a public relay I can use?
No. Each person or team runs their own; that's the point. A free tunnel service open to anyone gets used to host phishing pages, and its domain ends up on block lists. On your own account, you decide who gets the address.
Who can reach my server?
Anyone who has the tunnel's URL, while the CLI runs. The token in it is random and hard to guess, but it isn't a password: share it like you would share a private link, and stop the CLI when you're done.
Who can open tunnels on my relay?
Anyone who knows your relay's address. Keep it among the people and agents you mean to use it, and use Cloudflare's tools (rate limits, Access) if you need more.
What does it cost?
The code is free, under the Apache 2.0 license. The relay runs on your Cloudflare account under its usual Workers and Durable Objects pricing; light use fits the free plan.