Tunnet: Fully Self-Hosted, Open-Source Private Mesh Networking with Unified Access Control
An in-depth review of Tunnet, an open-source private mesh networking stack that provides control planes, dashboards, relays, and clients in a single repository
As distributed engineering teams and multi-cloud setups become standard, secure machine-to-machine private networking has grown into critical infrastructure. While commercial mesh VPN solutions provide frictionless user experiences, their core coordination servers remain locked inside proprietary SaaS clouds or require fragmented third-party reverse-engineered implementations. The open-source project Tunnet(tunnetio/Tunnet) addresses this structural dependency by shipping its entire networking stack—client agents, control planes, management APIs, web dashboards, and relay servers—in a single open-source repository, delivering an uncompromised, self-hosted private mesh fabric.
Image source: Tunnet (tunnetio)
Breaking Free from Proprietary Coordination: A 100% Self-Hostable Mesh Stack
Popular commercial overlay networks like Tailscale offer great developer experiences, but their control planes—the brain that arbitrates routing, public keys, and node states—are hosted exclusively by the vendor. Self-hosting workarounds like Headscale exist, but keeping up with upstream changes and maintaining standalone dashboards and relay nodes often introduces administrative overhead.
Tunnet approaches this challenge by structuring its entire stack for end-to-end self-hosting:
- Monolithic Open-Source Stack: The official
tunnetio/Tunnetrepository contains the client agent, control plane, management API, web UI dashboard, and relay server codebases. Organizations can operate an independent encrypted overlay without leaking metadata to an external vendor. - Direct Mode for Zero-Infrastructure Setups: Designed for individual developers or small fleets who want encrypted connectivity without standing up a centralized control plane. Using a shared passphrase, Mainline DHT peer discovery, and an
iroh-docsCRDT for membership state, nodes establish direct peer-to-peer encrypted channels with no registration, accounts, or cloud bills. Whenever needed, runningtunnet upgrade-to-managedtransitions the fleet into an enterprise control plane without interrupting active sessions. - Managed Mode for Teams and Organizations: A full-featured enterprise management mode featuring an admin API, a browser dashboard (
http://localhost:5173), OIDC single sign-on, audit logs, and unified Policy as Code (supporting HCL, JSON, YAML, Terraform, and GitOps workflows).
Unifying Mesh VPN, Public Tunnels, SSH, and File Sharing Under One Identity
Traditional infrastructure often strings together disparate point solutions: a VPN for internal access, ngrok for local development tunnels, bastion hosts with static SSH keys for remote access, and sftp for file movement. Tunnet consolidates these primitives under a single identity model and a centralized access control (ACL) policy engine.
| Functional Area | Conventional Point Tools | Tunnet Implementation |
|---|---|---|
| Mesh Network | Tailscale, NetBird, WARP | QUIC (iroh) P2P encryption, PeerDNS, overlay IPs/hostnames, subnet routing |
| Internal App Sharing (Serve) | Cloudflare Access, Tailscale Serve | Exposes local ports across mesh with TLS certs from an internal CA and ACL enforcement |
| Public Tunnels (Tunnel) | ngrok, Cloudflare Tunnel | Public HTTPS endpoints via self-hosted relays without opening inbound firewall ports |
| P2P File Transfer (Send) | Taildrop, embedded sftp | BLAKE3 verification via iroh-blobs, consent-based receiving, tag-targeted multicasting |
| Identity-Based SSH | Bastion hosts, static SSH keys | Keyless authentication using Tunnet identity policies, session recording, and audit trails |
| Kubernetes Integration | Custom ingress/VPN glue | Official Kubernetes Operator CRDs (TunnetIngress, TunnetTunnel, TunnetEgress) |
Once enrolled, each machine receives an overlay IP and private hostname. Everyday command-line utilities (ssh, curl, browser dev tools) communicate over direct P2P connections whenever feasible. If symmetric NAT or restrictive corporate firewalls prevent direct hole punching, traffic transparently falls back through user-operated relay nodes.
Verified Installation and Core CLI Workflows
Tunnet provides native builds across macOS, Linux, and Windows, offering both headless background daemons and desktop GUI applications.
Agent Installation
Linux and macOS (Headless Agent):
curl -fsSL https://github.com/tunnetio/Tunnet/releases/latest/download/install.sh | sh
Windows (Administrator PowerShell):
irm https://github.com/tunnetio/Tunnet/releases/latest/download/install.ps1 | iex
On Windows desktop systems, the official release includes a dedicated NSIS installer (Tunnet_*_x64-setup.exe) bundling the wintun.dll driver and automatic UAC elevation handling.
Core CLI Commands
Joining a private network and leveraging its integrated tooling follows a concise command interface:
# 1. Enroll into a self-hosted control plane and launch background daemon
sudo tunnet enroll --control-url http://your-control-host:8080 --token <ENROLLMENT_TOKEN>
sudo tunnet service start
# 2. Expose a local port to internal mesh peers with internal TLS
tunnet serve 3000
tunnet serve status
tunnet serve off 3000
# 3. Create a public HTTPS tunnel routed through self-hosted relays
tunnet tunnel 3000
tunnet tunnel status
tunnet tunnel off 3000
# 4. Transfer files securely via P2P
tunnet send ./build.tar.gz db-server
tunnet send ./app-package.zip tag:staging
# 5. Connect via identity-based SSH without key distribution
tunnet ssh db-server
tunnet ssh db-server -u root
tunnet ssh sessions
tunnet ssh play <SESSION_ID>
In the v0.7.0 and v0.8.0 updates, the codebase updated its runtime to Rust 1.97, added a Go CLI and an official Rust SDK crate (tunnet), and shipped a refreshed desktop client, audit log inspector, tunnel debugging utilities, and QUIC throughput optimizations.
Self-Hosting Trade-offs and Operational Considerations
Operating an entirely self-hosted networking fabric provides complete infrastructure autonomy and auditability, but teams must weigh several operational trade-offs compared to commercial SaaS:
- Operational Maintenance Overhead: Teams run their own control plane, API services, persistent database (PostgreSQL), and relay servers. Operators are responsible for SSL/TLS lifecycle management, OS security patches, database backups, and high availability.
- Relay Server Placement and Bandwidth: When NAT traversal cannot establish a direct P2P link, traffic routes through user-operated relays. Throughput and connection latency in those environments depend directly on the geographic footprint, egress bandwidth, and computing capacity of the deployed relay servers.
- Ecosystem Maturity: Commercial providers such as Tailscale and Cloudflare benefit from years of enterprise-scale production hardening and extensive global edge backbones. Tunnet trades off turnkey global infrastructure for total data sovereignty and single-stack code transparency.
For organizations, homelabs, and infrastructure teams seeking an open-source networking fabric that eliminates vendor lock-in across laptops, CI runners, and Kubernetes nodes, Tunnet provides a compelling, unified solution.