What is tunwg?

Tunwg creates secure WireGuard tunnels to expose local HTTP servers to the internet with automatic HTTPS certificates. It runs as a single binary or Docker container, supports custom domains via CNAME, persistent URLs derived from WireGuard keys, HTTP Basic Auth, PROXY protocol for real client IPs, and can relay traffic over HTTPS when UDP is blocked. The server is stateless and requires no database. Users can self-host both the client and server components, or use the public instance at l.tunwg.com. It also provides a Go library for embedding tunnel functionality directly into Go applications.

Should you self-host tunwg?

tunwg scores 47/100 on selfhost.directory (how scoring works) and ranks #4 of 10 in Network. It has 287 GitHub stars.

It shipped 1 stable release in the past year. The latest, v25.11.15+bbd247b, came out on 15 November 2025.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is Webhook.site (66/100, 6 786 stars). It scores higher overall, so compare the two before you pick. See tunwg vs Webhook.site side by side.

Features

Automatic HTTPS certificates
Custom domains
Go library
HTTP Basic Auth
HTTPS relay modePerformance may suffer due to TCP-over-UDP-over-TCP encapsulation
Multi-host port forwarding
Persistent URLs
PROXY Protocol support
Stateless Server
WireGuard Tunneling