Tunnel.pyjam.as – HTTP tunnels without custom software thanks to WireGuard (opens in new tab)

It's important to note that if you're not self hosting this, you're giving unlimited internal network access to this service (unless you properly firewall of course). It's not specific to the single port/address that is used when downloading the config.

Disclaimer: I wrote a similar tool that is self-hosted and uses SSH as the tunneling service. Does HTTP(S) with TLS termination, TCP, TLS (via SNI), and internal tunneling (unexposed tunnels that are authenticated using SSH) [0].

[0] https://github.com/antoniomika/sish

I maintain a list of solutions to this problem:

https://github.com/anderspitman/awesome-tunneling

Great to see more WireGuard implementations popping up. Most of the "no install" options are based on SSH tunnels, which are great, but WireGuard should have much better performance under certain conditions.

It's impressive how simple the code is: https://gitlab.com/pyjam.as/tunnel/-/blob/main/tunnel.py

All the heavy lifting and reverse proxying is done by Wireguard and Caddy! Very slick.

Though of course all traffic will be ran through pyjam.as. As this isn't a company with an income stream, I fear if its gets too popular it'll be infeasible for the author to keep it up and available for free long term.

I wont lie I was confused as to the purpose at first, but the more I think about this the more impressed I get. What wasn't clear at first glance was the port isn't fixed and it generates a "one-time" link. i.e. curling `https://tunnel.example.tld/<whateverport>` generates a neat proxy link `https://<code>.tunnel.example.tld/`.

It would be very handy for say a website designer to quickly bring up and share a demo website running on their development laptop no matter where they happen to be (home, work, the client's office or Starbucks) and everyone involved can "just access" everything through a web browser.

Similar to https://ngrok.com/ except this uses wireguard, and doesn't require any custom software.

With ngrok you need to trust their binary, with this I suppose you need to trust the generated config file.

repo readme makes more sense than site: "tunnel.pyjam.as can be used as an ephemeral reverse proxy for your local services. This may be useful, for instance when you need to show your friend something cool you've built. tunnel.pyjam.as works without installing any software on your machine, thanks to the magic of Wireguard."

Neat! You could do this without even having WireGuard installed with wireguard-go and Netstack.

This is absolutely spectacular. I have written up details for an internal service that we were to start a sprint on next week, that has the exact same bits of software. We're looking to build a Teleport alternative as the enterprise pricing is far greater than the value we'd gain. Will definitely be exploring this. Cheers!

I wish some clever person would make a sort of modern-day kali.net where you could easily route game traffic over Wireguard so your self-hosted Minecraft of Valheim servers don't have to be accessible on the public internet.

Why should I bind to 0.0.0.0? It should be able to tunnel any port on any interface.

I tunnel traffice using Wireguard, why would I want something on top of it?