selfhost.directory

The index of self-hostable projects — ranked, categorized and served with live updates.
Own your data and stop giving it to big tech.

GitHubWebsite
Lantunnel logo

Self-host Lantunnel

v2.0.12

Peer-to-peer mesh VPN for private LAN access

ReleaseOpen SourceApache-2.0
GitHubWebsite
Support
Updatedlast month
LanguageRust
Setup difficultyModerate
MobileNative app
Stars
163
Ports
1080 (Local SOCKS5 proxy (loopback only)), 8443 (Gateway data listener (QUIC default)), 8444 (Gateway UDP mapping port)
Connection screen showing Peer state, Overlay IP, direct vs relayed bytes, and signed-in accountPeers screen listing every Peer in the Tunnel with Overlay IP and connection pathSettings screen with auto-start, native routing, and LAN export optionsAccess screen showing the loopback SOCKS5 listener and what this device will serve

What is Lantunnel?

Lantunnel builds a private mesh called a Tunnel from trusted devices known as Peers. Each Peer runs the Client, which creates direct QUIC links between devices when possible and uses an encrypted relay via a Gateway when direct links fail. The Gateway only forwards sealed data it cannot read. One Client can publish its local LAN subnets, so every device on that network — NAS, printers, Home Assistant, cameras — becomes reachable to other Peers. Access rules live on each target machine, not on the Gateway. The project provides three binaries: the Client (desktop UI or headless), the Gateway (relay and coordination), and the Admin tool (offline provisioning). It runs on Windows, macOS, Linux, Android, and iOS, plus OpenWrt routers. A hosted Gateway at lantunnel.app offers a free tier, but the software is fully self-hostable under Apache-2.0.

Should you self-host Lantunnel?

Lantunnel scores 49/100 on selfhost.directory (how scoring works) and ranks #36 of 56 in VPN. It has 163 GitHub stars.

It shipped 4 stable releases in the past year. The latest, v2.0.12, came out on 11 September 2026. New versions land roughly every 2 days.

Setup is moderate: expect some configuration beyond a single command. It is Apache-2.0-licensed and written mostly in Rust.

Its closest alternative on selfhost.directory is Tailscale (84/100, 38 215 stars). It scores higher overall, so compare the two before you pick. See Lantunnel vs Tailscale side by side.

Features

  • Device authorization flowFor hosted Gateway mode
  • End-to-end encryption
  • Headless Mode
  • Local access control
  • Native routing (TUN)Desktop only; mobile uses VPN service
  • No port forwarding required
  • Offline provisioning
  • OpenWrt router supportRequires 16MB+ flash; MIPS not supported
  • Peer-to-peer mesh networking
  • QR code profile import
  • Shared Gateway
  • SOCKS5 Proxy
  • Whole LAN reachability

Lantunnel README

How to configure Lantunnel

  • auto_connectfalseConnect on launch

    Connect on launch

    values: true/false

  • auto_export_current_lantrueAlso publish the networks this machine is currently attached to

    Also publish the networks this machine is currently attached to

    values: true/false

  • auto_startfalseLaunch at login

    Launch at login

    values: true/false

  • client_accessopenThe ACL — allow/deny rules for incoming connections

    The ACL — allow/deny rules for incoming connections

    values: JSON object with allow/deny arrays

  • desktop_network_modesocks5_onlyNetwork mode: socks5_only or lan_routes_tun for native routes

    Network mode: socks5_only or lan_routes_tun for native routes

    values: socks5_only, lan_routes_tun

  • local_proxy_enabledtrueRun the local SOCKS5 listener

    Run the local SOCKS5 listener

    values: true/false

  • local_socks5_listen127.0.0.1:1080SOCKS5 listener address (loopback only)

    SOCKS5 listener address (loopback only)

    values: host:port

  • log_levelinfoClient log level

    Client log level

    values: error, warn, info, debug, trace

  • p2p_allow_lan_candidatesfalseOffer LAN addresses as direct-path candidates

    Offer LAN addresses as direct-path candidates

    values: true/false

  • tunnel_firstfalseLet Tunnel routes beat overlapping local LAN routes

    Let Tunnel routes beat overlapping local LAN routes

    values: true/false

Lantunnel releases & version history

Even more releases RSS

FAQ

Can I host my own Gateway?

Yes. Run an independent Gateway without lantunnel.app, or use a Platform-connected Gateway hosted by you or a friend. The Client, Gateway, and Admin tool are open source under Apache-2.0; the hosted account and billing platform is separate.

Do I install the Client on every LAN service?

No. Install Lantunnel Client on your remote device and on an online machine that can reach the services inside your LAN. Each Client installation needs its own private .peer profile.

Does Lantunnel always use a Direct connection?

Lantunnel prefers Direct when P2P connectivity is available and falls back to an encrypted Gateway Relay when needed. Direct connectivity is not guaranteed and depends on network conditions.

Do I need port forwarding or a public service URL?

Normal Client access does not require router port forwarding on your LAN or a public URL for each service. If you host a Gateway yourself, that Gateway needs a reachable public IP and its configured data and mapping ports open.

What is Lantunnel used for?

Lantunnel connects trusted devices to private LAN services over encrypted paths. Use it to reach Sunshine or Jellyfin, private Ollama APIs, a NAS, or Home Assistant from your laptop or desktop while the services stay on your own network.

More in Network

Rate this project

Click to rate — no account needed.

0 comments

Posting as guest
Loading comments…