Self-host rustunnel
v0.8.5Open-source tunnel server with MCP for AI agents
- Stars
- 658
- Ports
- 80 (HTTP edge (redirects to HTTPS)), 443 (HTTPS edge (TLS-terminated tunnel ingress)), 4040 (Control-plane WebSocket (clients connect here)), 8443 (Dashboard UI and REST API), 9090 (Prometheus metrics endpoint), 20000 (TCP tunnel range start (configurable)), 20100 (UDP tunnel range start (configurable))
- Requires
- PostgreSQL
ghcr.io/joaoh82/rustunnel-server
What is rustunnel?
rustunnel is a Rust-based tunnel server for exposing local services to the internet. It uses encrypted WebSocket links with TLS termination, provides automatic Let's Encrypt certificates for HTTPS, and supports raw TCP and UDP forwarding. Direct peer-to-peer tunnels use QUIC with NAT hole-punching. Multiple tunnels can be grouped for distributing traffic using health checks. The software includes a live terminal dashboard, a local request inspector with replay, Prometheus metrics, and audit logging. It also ships an MCP server compatible with any MCP harness, allowing AI assistants to create and manage tunnels using natural language. Users can either use the managed cloud service (free Hobby tier, pay-as-you-go starting at $3/month) or self-host the AGPL-licensed server on their own infrastructure via Docker, Docker Compose, systemd on Ubuntu, or pre-built binaries. Self-hosting requires a server with a public IP, wildcard DNS, and PostgreSQL for shared state.
Should you self-host rustunnel?
rustunnel scores 53/100 on selfhost.directory (how scoring works) and ranks #13 of 31 in Networking. It has 658 GitHub stars.
It shipped 14 stable releases in the past year. The latest, v0.8.5, came out on 4 September 2026. New versions land roughly every 1 days.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in Rust.
Its closest alternative on selfhost.directory is Webhook.site (66/100, 6 786 stars). It scores higher overall, so compare the two before you pick. See rustunnel vs Webhook.site side by side.
Features
- Audit Logging
- Custom Subdomains
- HTTP/HTTPS tunneling
- Live terminal dashboard
- Load balancing with health checks
- Local request inspector with replay
- MCP server for AI agents
- Multi-region support
- P2P tunnels
- Prometheus Metrics
- Rate Limiting
- REST API
- TCP Tunneling
- Token Management
- UDP tunneling
rustunnel README
FAQ
How does rustunnel compare to Cloudflare Tunnel?
Both expose local services without opening inbound ports, but Cloudflare Tunnel is free and ties tunnels to a Cloudflare account and DNS zone. rustunnel is open source under AGPL, can be self-hosted on any VPS with no vendor lock-in, supports raw TCP and UDP plus direct peer-to-peer connections, and ships an MCP server for AI agents.
Can I use a custom domain or custom subdomain?
Yes. Pay-as-you-go and self-hosted plans let you bind tunnels to a custom subdomain on the rustunnel edge. When self-hosting, the server is configured against your own wildcard DNS record so you can serve tunnels under any domain you own — there is no per-domain fee.
Does rustunnel work for webhook testing?
Yes. rustunnel is a drop-in tunnel for testing Stripe, GitHub, Slack, or any other webhook against a service running on localhost. Open an HTTP tunnel on the port your dev server is listening on, paste the public HTTPS URL into the provider's webhook configuration, and inbound deliveries are forwarded straight to your machine over an end-to-end encrypted connection.
Is rustunnel secure?
All client-server traffic is end-to-end encrypted with TLS, public HTTPS endpoints get automatic Let's Encrypt certificates, and tunnels are authenticated with API keys you control. The managed cloud routes traffic through regional edges only — payloads are not inspected or logged.
Does rustunnel work with AI agents like Claude Code, Codex, or Cursor?
Yes. rustunnel ships an MCP server that works with any MCP harness — Claude Code, Claude Desktop, Codex, Cursor, Windsurf, Cline, and custom agents. A one-command installer or copy-paste config wires it up; setup is one step — get an API key, set RUSTUNNEL_TOKEN, done.
How is rustunnel priced?
The Hobby plan is free forever. The Pay-as-you-go plan has a $3/month minimum that is credited toward usage at $0.10 per GB of bandwidth — if you transfer one gigabyte of traffic in a month you spend the minimum, and idle tunnels cost nothing. Self-hosting is free under AGPL.
What protocols does rustunnel support?
HTTP/HTTPS with automatic Let's Encrypt TLS, raw TCP on a configurable port range, UDP forwarding, and direct peer-to-peer tunnels with NAT hole-punching over QUIC. Tunnels can be grouped for client-side load balancing with TCP and HTTP health checks.
Can I self-host rustunnel?
Yes. The rustunnel server is published on GitHub under AGPL and ships with a Docker image, a Makefile target, and a systemd service template. Self-hosting gives you unlimited tunnels, custom subdomains, and full control over the relay.
Is rustunnel a free ngrok alternative?
Yes. rustunnel offers a free Hobby tier on the managed cloud (two concurrent tunnels with random subdomains) and the entire server is open source under AGPL, so you can self-host it for free with no usage limits.
What is rustunnel?
rustunnel is an open-source secure tunnel that exposes services running on your laptop or private network to the public internet over an encrypted WebSocket connection. It is similar to ngrok or Cloudflare Tunnel, but written in Rust, AGPL-licensed, and available either as a managed cloud with pay-as-you-go billing or as a self-hosted server.
More in Reverse Proxy
SafeLineSafeLine is an open-source, self-hosted WAF protecting web apps from SQL injection, XSS, and DDoS via intelligent semantic analysis. Runs as a Docker reverse proxy.
Self-Hosted GatewayOpen-source alternative to Cloudflare Tunnels using WireGuard, NGINX, and Caddy to expose local Docker containers without port forwarding.
sishSelf-hosted, open-source SSH server for ngrok-style HTTP, WebSocket and TCP tunnels to localhost, shipped as a Docker image or binaries.
SWAG (Secure Web Application Gateway)Self-hosted Nginx reverse proxy with automatic SSL certificates from Let's Encrypt or ZeroSSL. Includes Fail2ban intrusion prevention and reverse proxy configurations.
tetherTether is a self-hosted hub that aggregates routing from Tetherd agents into one Traefik config for multi-server deployments behind a single IP.
tlsproxySelf-hosted TLS termination proxy with auto Let's Encrypt, SSO (OIDC/SAML/Passkeys), and reverse proxy for multiple services on one port.
TraefikTraefik is a self-hosted, open-source reverse proxy that auto-discovers services from Docker, Kubernetes, and other orchestrators to route traffic without manual config.
traefik-certs-dumperOpen-source CLI that extracts Traefik's ACME certificates into .crt/.key files from acme.json or Consul, etcd, Zookeeper and BoltDB, with watch mode and Docker images.
Traefik ManagerSelf-hosted web UI for managing Traefik reverse proxy — create routes, services, middlewares, certificates, and monitor logs and CrowdSec without editing YAML by hand.
tsdproxyTSDProxy is an open-source, self-hosted reverse proxy that automatically exposes Docker containers on Tailscale with zero sidecars and automatic HTTPS.
TykSelf-hosted open-source API and AI gateway proxying REST, GraphQL, gRPC, TCP and MCP traffic with auth, quotas, plugins and analytics.
Vinyl CacheVinyl Cache is a web application accelerator also known as a caching HTTP reverse proxy. It is designed to be installed in front of any server that speaks HTTP and configured to cache the contents, significantly speeding up delivery.
0 comments