Serve Local Apps On Secure URLs
Fast, open source, and entirely under your control.
Tunnels
3 tunnels · 2 serving
Serve your apps
without exposing your network.
A public edge server serves your domain and runs
every firewall rule and auth check.
Your app stays on
localhost, reached only through a tunnel it dials
out to.
Use our managed edge network or host your own edge
Granular Access Control
Open your app to the world, set a password, require an API key, invite people by email, share with your team, or restrict to specific IP addresses. Unauthorized requests are blocked by the edge server and never reach your local host.
You and the people you invite.
Anyone with the link.
Access with a password or an HTTP bearer token.
Reusable policies, restrict to specific accounts and IP addresses.
Traffic Inspector
See requests as they happen. Optionally save full headers and bodies when you need to dig in. Captured traffic is stored locally on your own machine, never on remote servers.
Observability & Analytics
Aggregate statistics on your service health, latency, and bandwidth consumption. Monitor your security posture and audit requests that were blocked by firewall rules and authentication policies.
Web Application Firewall
Apply rate limits and add custom rules to block scrappers, bots, and intrusion attemtps. Traffic is blocked at the edge and never reaches your local host. Write rules once and reuse across any app.
Limitless compatibility
for all of your projects and services.
Frontend dev servers, self-hosted apps, databases, game servers, AI models.
If it listens on a local port, you can publish it.
Web frameworks
- N Next.js
- V Vite
- A Astro
- R Remix
- S SvelteKit
- N Nuxt
- D Django
- R Rails
Self-hosted apps
- W WordPress
- P Plex
- J Jellyfin
- H Home Assistant
- N Nextcloud
- I Immich
- n n8n
- G Gitea
Databases & services
- P Postgres
- R Redis
- M MySQL
- s sshd / sftp
- M MongoDB
- G Grafana
- V Vaultwarden
- M Minecraft
Local AI
- O Ollama
- v vLLM
- l llama.cpp
- O OpenCode
- A Automatic1111
- L LM Studio
- C ComfyUI
- O Open WebUI
…and everything else that speaks HTTP, gRPC, WebSockets, or SSE.
Recommended Apps
Open source apps from OpenLaboratory · the team behind UplinkDesktop environment for AI servers. The simplest way to self-host models and agents.
Learn moreSelf-host all of Wikipedia, with zim file management and an API+MCP server.
Learn moreSQL-native music library with built in stem-splitting and audio embeddings.
Learn moreThe OpenTunnels Protocol.
A modern open source transport protocol for secure, high-performance tunnels.
Traditional tunnels often rely on a single long-lived TCP connection with TLS layered on top. When multiple streams share the same ordered TCP connection, a slow transfer can introduce head-of-line blocking, a connection drop interrupts every multiplexed stream, and long-lived connections (particularly UDP) can require special handling.
OpenTunnels removes those constraints at the transport layer through leveraging the QUIC network protocol. Streams operate independently, sessions survive network interruptions, TLS 1.3 is mandatory to initiate a connection, and every credential is welded to the exact session it travels over.
QUIC + TLS 1.3
High performance, always encrypted, with a 1-RTT handshake (0-RTT on resume) and no plaintext mode to misconfigure.
Channel binding (RFC 9266)
Every credential is welded to the exact TLS session it rides on. A captured token is cryptographically inert on any other connection.
Scoped, short-lived grants
Each credential is a signed grant scoped to one namespace with a short expiry, so there is no long-lived bearer secret to leak or revoke.
Enforced tenant isolation
A credential authorizes one namespace, and the edge routes by that signed claim rather than the requested hostname.
Replay & exhaustion defenses
A fail-closed replay cache, strict wire parsing, and every length-prefixed read capped before allocation.
No head-of-line blocking
Each request rides its own QUIC stream with its own flow control, so one slow transfer never stalls the others.
Broad compatibility
HTTP, gRPC, WebSockets, and SSE on one encrypted QUIC connection, with each request riding its own stream.
Ed25519 identity
Each device holds an Ed25519 keypair, and tunnel credentials are bound to its public key.
Written in Rust
Minimal reliance on external packages, well-tested memory-safe code, dependencies audited on every build.
Use Our Infrastructure
or Run Your Own.
Open source. MIT license. Host on your hardware or utilize our managed network.
Self-Hosted Edge Server
Free · Open source
Run your own edge on your own hardware.
Bring your own domain name, DNS configuration, and TLS certificates.
No SSO authentication, team features, advanced analytics, or security-event tracking.
Managed Edges
Choose from our fleet of managed edges; preconfigured with seamless SSO authentication and Clickhouse-powered observability.
nyc.uplink.computer sf.uplink.computer ln.uplink.computer eu.uplink.computer sg.uplink.computer Included with all tiers
- Reserved app URLs, no expiry or auto-rotation
- Full support for streaming, web sockets, and UDP
- Unlimited firewall rules and access policies
- Unlimited requests per month, metered only by bandwidth
- Run tunnels 24/7 at no additional charge
- TLS 1.3 and HTTPS encryption for all apps
- Advanced performance & security analyics
- Rust-native CLI and Desktop app
Free
- 1 GB bandwidth / month
- Up to 5 active apps
- Dedicated URLs in any edge region
Dev
- Everything in Free
- 20 GB bandwidth / month
- Up to 30 active apps
Pro
- Everything in Dev
- 500 GB bandwidth / month
- Up to 500 active apps
Add a Team
Bring people in on top of any paid plan. Invite teammates, share firewall rules and access policies. No extra cost.
- Invite teammates & manage access
- Roles & permissions
- Audit logs & security events
- Shared apps and settings
Seats are free. You only pay for the plan underneath.
For teams and businesses.
Dedicated Edge
- Import your domain names
- Private, dedicated compute
- Unlimited bandwidth (2 TB included, then $0.05/GB)
- Unlimited active apps
- SOC 2 Type II infrastructure
- Advanced analytics and security features.
- Priority support & SLAs
Enterprise
- Deploy an edge fleet on your own infrastructure
- SSO & role-based access
- ISO 27001 & SOC 2 Type II
- GDPR & HIPAA support, signed BAA
- Custom DPA & data-residency controls
- Compliance reporting & audit support
- Deployment and infrastructure consulting
Your first app online in minutes.
Install Uplink, chose a local port, and publish. That's it.