From one docker command to a permanent https:// address.
Point it at Jellyfin, Immich, or whatever else you self-host. No port forwarding and no dynamic DNS, so it still works behind CGNAT and routers you were never given the password to.
7-day free trial. Cancel in one click from the billing portal.
New to this? Read the 5-minute setup guide, or the Jellyfin walkthrough if that's what you're running.
How it works
Home servers are hard to reach because routers refuse incoming connections. Tunnelo sidesteps that instead of fighting it: both ends dial out to a gateway in the middle, and the gateway introduces them.
Your devices
A TV app, a phone, a browser at work.
Gateway
Holds your public address and its TLS certificate, then passes traffic straight through.
Your server
The box already running Jellyfin, Immich, or whatever you self-host.
Notice that both arrows point inward. Nothing ever asks your router to accept a connection, which is the whole reason CGNAT, double NAT and a locked ISP router stop being your problem.
What you actually do
Run one container
Paste one command on the box that already runs your app. Nothing else on your network has to change.
docker run -d --cap-add NET_ADMIN \ -e TUNNELO_TOKEN=<your-token> \ ghcr.io/abiteman/tunnelo-agent
The tunnel comes up
The agent dials out to our gateway and measures your upload speed, so you know what your connection can actually carry before anyone tries to watch something.
Share the address
You get a permanent https address that stays yours. Phones, TVs and browsers treat it like any other website.
Pricing
One subscription per server, with every device in the house included. The only thing that changes between plans is how much bandwidth your tunnel gets. All three start with a 7-day free trial.
These are ceilings on our side rather than guarantees. Your home upload speed and the quality of the connection at both ends set what you actually get.
FAQ
What can I put behind Tunnelo?
Anything that serves HTTP on your home server. People mostly run Jellyfin, Navidrome, Audiobookshelf, Immich and Home Assistant behind it. The proxy is tuned for media, so seeking through a film and long websocket sessions behave the way they should.
Do I need to open ports on my router?
No, and you cannot break anything by trying. Your server dials out to us, exactly like a browser does, so there is nothing for your router to accept. That is what makes it work behind CGNAT and behind ISP routers with no usable admin page.
How fast will my streams be?
Your plan sets the ceiling on our side. For most people the real limit is their home upload speed, which is usually well below it. Setup measures that number and shows it to you, so you find out before the family does.
How many devices can connect?
As many as you like. The subscription covers the server, so every phone, TV and laptop in the house is already included.
Is my traffic private?
Traffic is encrypted the whole way: HTTPS from your devices to our gateway, then WireGuard from our gateway to your server. We do not inspect what passes through, and we keep no record of what you watched or when.
What about copyrighted content?
Tunnelo is for reaching media you already have the right to use. Our Acceptable Use Policy prohibits infringing distribution and we honor valid DMCA notices. The Acceptable Use and DMCA page lists our agent contact and the process.
Can I cancel any time?
Yes, in one click from the billing portal. If a payment fails we hold your subdomain and your setup for 30 days, so an expired card costs you nothing but an email.
By using Tunnelo you agree to our Terms of Service and Acceptable Use Policy. For DMCA notices, see the Acceptable Use and DMCA page.
Get your address in 5 minutes.
Free for 7 days. Cancel in one click.