Open source · Self-hosted · P2P

Your local ports,
publicly reachable.

Publish a local HTTP / TCP service on a fixed public domain — or mirror a remote port to your machine through a direct P2P connection. No public IP, no network changes.

Get started View on GitHub

cargo install --git https://github.com/zeaphoo/telesh telesh

Single binary · no runtime
Apache-2.0 open source
Self-hostable control server

TLS · end-to-end

P2P direct · 8ms

telesh · 127.0.0.1:16345connected

Published ports3 live

8000HTTPhttps://app.telesh.devlive

22TCPtelesh.dev:18000live

5432P2P000012345/dblive

Request logstreaming

GET/api/users20012ms

POST/webhook/stripe2004ms

GET/assets/app.js3041ms

P2P000012345/db · queryOK8ms

GET/healthz2002ms

Protocols/HTTPHTTPSTCPQUICirohyamuxUPnPPCPNAT-PMP

// 01 — Features

One process, both directions

telesh is both a publisher and a visitor: push your local services out to the internet, or pull remote services in. The control plane carries only small messages; the data plane runs on its own QUIC / yamux connections.

http_register

HTTP / HTTPS tunnels

Publish a local web service on a fixed subdomain. The server issues Let's Encrypt certificates automatically and gives you request logs and replay.

tcp_register

TCP port mapping

Map any TCP service — SSH, databases, game servers — to a public port on the server. No gateway code to write.

iroh · QUIC

Direct P2P

Hole-punched QUIC via iroh. Traffic flows peer to peer and never touches the server; if hole punching fails it falls back to an encrypted relay.

lookup + mirror

Port mirroring

Map a remote host's port onto a local listening port and debug a remote environment as if it were local. Reconnects after drops.

127.0.0.1:16345

Local publish UI

A long-running agent discovers local listening ports; toggle publishing and watch a live request log at 127.0.0.1:16345.

server.toml

Self-hosted server

One server.toml starts the control plane, the data plane and an embedded iroh relay, with ACME, TLS and QUIC address discovery.

Also includedEd25519 challenge–response loginShort-lived opaque access tokensUPnP / PCP / NAT-PMPRequest logs & replayMany tunnels, one processPort discovery inside containers

// 02 — How it works

Control plane and data plane, separated

One long-lived connection carries only small messages (login, subdomains, directory, keepalive); the actual bytes travel on an independent data plane. The control protocol can evolve while the forwarding path keeps its raw throughput.

Outbound · publish

Publish a local service

The agent dials out to the server. Public traffic arrives at the edge and is forwarded to your local port over the data plane.

Local service127.0.0.1:8000

telesh agentlong-running

public HTTP

telesh-serveredge :8080

forward

Public visitorapp.telesh.dev

Inbound · P2P

Mirror a remote port

The server only handles directory lookup and token checks; the payload travels over a hole-punched QUIC connection, not through the server.

Local app127.0.0.1:18000

P2P QUIC

telesh mirrorlistens locally

Remote agent127.0.0.1:5432

Control plane

WebSocket · JSON

Data plane

QUIC · yamux

public forwarding and P2P payload

Authorization

Short-lived tokens

verified online, scoped to account/name

// 03 — Use cases

From development to operations

Whenever there is a missing path between local and remote, telesh closes the gap.

Webhook debugging

Point Stripe / GitHub / payment callbacks straight at your laptop, inspect headers and responses live, and replay with one click.

Remote operations

Expose internal SSH / RDP on a public port via a TCP tunnel and reach your machines from anywhere.

Share a preview

Hand a colleague or client a fixed domain and let them view your local build in a browser — no test deployment needed.

Database access

Mirror a staging database port to your machine and connect with your usual client, without a bastion or port forwarding.

Home / LAN services

Map the NAS, media library or smart-home hub at home to your machine over P2P — no router port forwarding.

IoT / edge devices

Let a device dial out and register with the server, then reach its debug endpoints and monitoring pages in reverse.

// 04 — Quick start

Up and running in three minutes

The CLI has a single flag (the data directory); everything else happens in the local UI.

01
Install
Install from source with cargo, or grab the single-file binary for your platform from Releases.
02
Configure the control server
One line is enough. If the config file is missing, a default one is generated for you.
03
Start and publish in the UI
The agent discovers local listening ports; pick HTTP / TCP / P2P for the ones you want to publish.
Open the local UI
Fixed at http://127.0.0.1:16345. It only listens on loopback and is never exposed.

1 · Install

terminal

# Install from source (requires Rust 1.91+)
cargo install --git https://github.com/zeaphoo/telesh telesh

2 · Configure

~/.telesh/config.toml

# The control server to connect to; default port is 9009
control_server = "tunnel.example.com:9009"

3 · Start

terminal

# Uses the default data directory ~/.telesh
$ telesh
info agent starting server=tunnel.example.com:9009 ui=127.0.0.1:16345

Want to host the server yourself? See Server deployment

// 05 — Compare

Why telesh

Beyond publishing to the internet, telesh adds the reverse path: pulling a remote port safely down to your machine.

	frp	Cloudflare Tunnel
Open source · fully self-hostable		open-source client
No public IP required
Direct P2P (payload bypasses the server)
Mirror a remote port locally
Control plane / data plane separation
Fixed domain + automatic HTTPS	configure yourself

Compiled from each project's public documentation, for reference only. Corrections welcome on GitHub.

// 06 — FAQ

Questions you might have

How is telesh different from ngrok or frp?

telesh publishes local ports to the internet like ngrok / frp, and also mirrors remote ports back to your machine. Connections prefer a direct P2P hole punch and only fall back to an encrypted relay when that fails; the server keeps its control plane and data plane on separate channels.

Do I need a public IP or my own server?

The machine running the agent does not need a public IP — it dials out from behind NAT. You only need one machine with a public address to run telesh-server, or you can use a server someone else has deployed.

Does traffic pass through the server?

In P2P mode the payload travels over the hole-punched QUIC connection and does not pass through the server; it only falls back to the encrypted relay when a direct path cannot be established. Public HTTP / TCP tunnel traffic is forwarded through the server's edge.

How is access controlled?

Devices and accounts log in with an Ed25519 key pair using a challenge–response flow, creating the account on first login (TOFU). To reach a service, the server issues a short-lived opaque access token scoped to account/name; the agent verifies it online with the server. The server only stores token hashes, so there is no key to protect on the data plane.

Which platforms are supported?

telesh is written in Rust and ships as a single binary with no runtime dependencies. It runs on Linux, macOS and Windows, and works inside containers, where it discovers only the ports inside the container.

How many ports can one process publish?

A single long-running agent manages many tunnels at once: the same local port can be published as HTTP, TCP and P2P, and you can declare multiple mirror entries — no need for a separate process per port.

Apache-2.0 · Open source

Give your local service a public address today

Three commands to get going; the rest happens in the GUI.

Read the docs View on GitHub

Your local ports,publicly reachable.