Article 001The internet should feel closer to home.

Bring your apps online

Fast, open source, and entirely under your control.

Uplink

3 tunnels · 2 serving

＋ Add tunnel

◎admin-dashboard.ny.uplink.computerLive

localhost:3000Private

◎your-company.comLive

localhost:8080Public

Uplink

3 tunnels · 2 serving

Add tunnel

https://admin-dashboard.ny.uplink.computerLive

localhost:3000·Privateyou + 3 invited1.2k req · 84 MB

https://your-company.comCustom domainLive

localhost:8080·Publicanyone with the link54.2k req · 741 MB

https://your-api.ny.uplink.computerPaused

localhost:5173·API Keyprotected with bearer token

Download for macOSApple Silicon · Linux: install the CLI

uplink.yamlYAML

services:

web:

port: 3000

public: true

api:

port: 8080

- alice@company.com

uplink.yaml

YAML · UTF-8

edge: ny.uplink.computer
services:
  web:
    port: 3000
    custom_domain: dashboard.example.com
    share:
      - bob@company.com
      - alice@company.com
  api:
    port: 8080
    account: acme
    allow_ips: [203.0.113.0/24]
    rate_limit:
      requests: 100
      window_secs: 60
      per: ip
  blog:
    port: 9000
    public: true
    custom_domain: blog.example.com

zsh — uplink

$ uplink up

✓web

→ https://dashboard.example.com

localhost:3000 · you + 2 invited

✓api

→ https://api-8080.ny.uplink.computer

localhost:8080 · acme account · IP allowlist

✓blog

→ https://blog.example.com

localhost:9000 · public

2 services online · serving

$curl -fsSL https://uplink.computer/install.sh | sh

Linux x86_64 & arm64 · Apple Silicon macOS — desktop users: install from Settings

Serve local apps
without exposing your network.

A public edge server serves your domain and runs every firewall rule and auth check.
Your app stays on localhost, reached only through a tunnel it dials out to.

◎

Internet

→

◇

Edge

→

▣

localhost

TLSAuthFirewallEncrypted tunnel

Public internet

Page viewsPassword

API requestsToken

Bots & scrapersblocked

Exploit attemptsblocked

https

Uplink Edge serverapp.uplink.computer

HTTPS · TLS 1.3Domain and certificates

AccessControls who and where gets in

FirewallBlocks request-level threats

QUIC TunnelsEncrypted path to your machine

tunnels

Your machinelocalhost

private network

your app

localhost:3000

live

your api

localhost:8080

live

Use our managed edge network or host your own edge
Powered by theOpenTunnels Protocol.

An alternative to datacenter deployment
with the privacy and low cost of self hosting.

Leave behind monthly cloud server costs and use your own hardware.
Securely serve local apps behind a URL, no local NAT or router configuration required.

WebsitesAstro · Next · Vite

Ship a marketing site, docs, or a full app framework straight from your machine.

APIsFastAPI · Express · Rails

Expose a JSON backend to webhooks, mobile clients, or an API-keyed integration.

GETapi.acme.com/v1/orders/1024200 OK

{
  "id": 1024,
  "status": "shipped",
  "total": 49.00,
  "currency": "usd"
}

application/json31 ms · TLS 1.3

DashboardsGrafana · Metabase

Share an internal tool or metrics view — gated behind sign-in, never left wide open.

Open source AIOllama · vLLM · ComfyUI

Open-weight models run on computers you already own. Uplink gives that machine a public URL, a guard at the door, and a stream that holds — no third-party inference, no per-token bill.

Mac Mini48 GB RAM

Ollama:11434
LM Studio:1234
llama.cpp:8080
vLLM:8000
ComfyUI:8188
Gradio:7860

uplink serve 11434QUIC · TLS 1.3

Uplink edgesign-inbot checkrate limit

https://chat.acme.comstreaming

Draft the launch post?

Sure — here's the outline.Sure — here's the outline.The weights never leave theThe weights never leave theGPU in the other room, andGPU in the other room, andthe stream holds to the last token.the stream holds to the last token.

text/event-streamopen 47m · 0 dropped

Zero-Trust Access Control

Choose who can reach each app: people, teams, passwords, API keys, or trusted networks.Everything else stops at the edge.

Invited accountsSign in with a code sent to their email.

alex@example.com

Team accessShare with your whole team in one click.

acme · 12 members

Password / API keyUse a browser password or Authorization header.

••••••••Replace

IP whitelistOnly listed IPs and networks can connect.

203.0.113.0/24

Public accessOpen to anyone with the link

Web Application Firewall

Block exploit probes, abusive requests, and sensitive paths with reusable HTTP rulesbefore requests reach your machine.

block-probesapplies to: blogBlockEnforce

where path contains /wp- · method is POST1,204 blocked today

block-secretsapplies to: apiBlockEnforce

where path contains /.env86 blocked today

block-curlapplies to: all tunnelsBlockMonitor

where header user-agent contains curl312 would match

Bot Protection

Challenge suspicious traffic at the edge to prevent programmatic access.Set a challenge level per app, from invisible browser proof to a strict human check.

Managed ChallengePer-app challenge difficulty

JS proofCoherenceReaction

Signed clearanceAll regions · 30 minutes

Custom Domains & Load Balancing

Attach your own domains to any tunnel and balance traffic across several connectors.DNS, certificates, and failover are handled at the edge.

vllm-15fg2.uplink.computerDistributing requests across 3 independent devices

Attached

RTX 5090 PC · New York:808034%
Mac Studio · Toronto:808033%
DGX Spark · London:808033%

Failover automaticUnhealthy connectors drop out

Traffic Inspector

Inspect live request and response bodies without sending payloads to a third party.Captures stay on your machine.

POST/callbacks/billing200182 ms · local

Request body

{

"event": "invoice.paid",

"invoice": {…}

}

Response body

{

"received": true,

"status": 200

}

Observability & Analytics

See bandwidth, service health, and blocked requests in one place.Know what is happening without assembling another stack.

last 24h1.87m Requests

blocked203.0.113.7 · POST /wp-login.phpblock-probes

Next Gen Transport Layer

The OpenTunnels Protocol.

A modern open source transport protocol for secure, high-performance tunnels.

QUIC + TLS 1.3

High performance multiplexing-optimized transport with a TLS 1.3 handshake. Authority-establishing registration begins only after handshake completion.

Channel binding (RFC 9266)

Every credential is welded to the exact TLS session it rides on. A captured token is cryptographically inert on any other connection.

Broad web compatibility

HTTP requests, WebSocket upgrades, and SSE streams share one encrypted QUIC connection, with each request bound to the device Ed25519 identity.

Enforced tenant isolation

Tunnel credentials are bound to device public keys, edges route by that signed claim rather than the requested hostname.

No head-of-line blocking

Each request rides its own QUIC stream with its own flow control, so one slow transfer never stalls the others.

Written in Rust

Minimal reliance on external packages, well-tested memory-safe code, dependencies audited on every build.

QUIC + TLS 1.3

Channel binding (RFC 9266)

Broad web compatibility

Enforced tenant isolation

No head-of-line blocking

Written in Rust

Read the protocol whitepaper View OpenTunnels on GitHub

Pairs perfectly
with Tailscale and Docker.

Uplink is the missing piece for the stack you've already built.
Your tailnet, compose files, and services stay exactly as they are.

Docker runs the appsUse containers to sandbox your services

Tailscale meshes your devicesPrivate Wireguard network for internal access

Uplink publishes & protectsThe safest way to serve local ports

Seamless support
for modern web protocols

Leave behind the hidden headaches of traditional reverse tunnel tools.

Automatic TLS 1.3

HTTPS certificates issued and renewed automatically. Assigned URLs are yours forever.

HTTP/2 and HTTP/3

Faster page loads for every visitor, and steady speed on patchy mobile connections.

WebSockets

WSS support by default, upgrade requests pass through without special proxy rules.

Server-Sent Events

Durable SSE, live updates and AI responses stay connected from first event to last.

Verified compatibility with popular apps

If it listens on a local HTTP port, it is ready for Uplink.

ComfyUI
Ollama
LM Studio
OpenCode
Pi
Jupyter
Gradio
Express
FastAPI
Next.js
Vite
Astro
vLLM

Nextcloud
Home Assistant
Jellyfin
Immich
Grafana
Gitea
n8n
WordPress
Plex
Portainer

Pricing

Use our infrastructure
or deploy your own edge.

Open source. MIT license. Host on your hardware or utilize our managed network.

Self-Hosted Edge Server

Free · Open source

Run your own edge on your own hardware.
Bring your own domain name, DNS configuration, and TLS certificates.

No built-in SSO authentication, bot protection, or advanced analytics.

Get started

Managed Edges

Preconfigured with seamless SSO authentication and ClickHouse-powered observability.

Free

$0/mo

Kick the tires on a managed edge

Unlimited HTTPS encrypted apps
1 GB bandwidth / month
Up to 10 Mbps transfer speeds
Reserved internal subdomains

Start free

Dev

$10/mo

Gateway to your personal cloud

Everything in Free
50 GB bandwidth / month
Up to 100 Mbps transfer speeds
Link 3 custom domain names

Start Developing

Pro

$50/mo

Ship to production

Everything in Dev
1 TB bandwidth / month
Up to 1 Gbps transfer speeds
Link 20 custom domain names

Go Pro

Add a Team

Bring people in on top of any paid plan. Invite teammates and share your tunnels with the whole team in one click. No extra cost.

Invite teammates & manage access
Roles & permissions
Audit logs & security events
Shared apps and settings

$0/ member

Seats are free. You only pay for the plan underneath.

Add your team

For teams and businesses.

Dedicated Edge Cluster

$250/mo per node

Private high-performance networking stack

Dedicated compute and bandwidth for your team
Up to 10 Gbps transfer speeds
Uncapped bandwidth (5TB included, then $0.05/gb)
Link up to 10,000 custom domain names
Advanced analytics and security features.
Priority support & SLAs

Talk to us

Enterprise

Custom

Your infrastructure, infinite scale

Deploy a multi-site edge fleet
Use your own on-prem and/or cloud infrastructure
LDAP, SAML, and custom SSO providers
Priority support & dedicated onboarding
Custom DPA & data-residency controls
Compliance reporting & audit support

Contact sales

Why Uplink

Full featured and polished,
open source and self-hostable.

Uplink combines the generous free tier, production controls, team pricing, and ownership the other options split across limits, add-ons, and closed edges.

Swipe to compare →

Comparison of Uplink, ngrok, Cloudflare Tunnel, and Tailscale Funnel
Compare	Uplink	ngrok	Cloudflare Tunnels	Tailscale Funnel
Limits & pricing
Published apps / endpoints	Unlimited Free plan	3 Free plan	1,000 Routes per account	Not published Funnel
Monthly HTTP requests	Uncapped Free plan	20,000 Free plan	Uncapped No request quota	Uncapped No request quota
Team / access users	$0 / member All included on paid plans	1 free PAYG: 3, then +$5/user	50 free Access: then $7/user	6 free Standard: $8/user
Firewall rules	Included No action metering	5 rules Free Some actions metered	5 · 1 · 10 Free WAF · rate limit · redirects	None No HTTP rule engine
Analytics & inspection
HTTP traffic analytics	✓Requests, bandwidth, blocks	✓Rates + response times	✓Requests + bandwidth	×No Funnel HTTP analytics
Live request inspector	✓Local-only inspector	✓Local or cloud inspector	×Connector logs only	×No request inspector
Request + response bodies	✓Never leaves your device	✓Cloud mode retains 24h	×No payload viewer	×Traffic stays opaque
Publishing
Custom domains	✓From any DNS service	✓PAYG only	✓Requires Cloudflare DNS	×Only *.ts.net
Load-balanced domains	✓Built in	✓Metered pooling	✓Paid add-on	×Not available
Access control
Shared-password gate	✓Built in	✓Basic Auth policy	×No simple password gate	×Funnel is public
Invite any email	✓Native email invite	×Requires OAuth / OIDC	✓Access email PIN	×Funnel has no login
Account-based login	✓Accounts + teams	✓OAuth / OIDC	✓Access identity providers	×Funnel has no login
API key / service token	✓Built in	✓JWT / Traffic Policy	✓Access service token	×No Funnel auth
Firewall
Request matching rules	✓Path, method, header, IP	✓Traffic Policy	✓5 custom rules Free	×No HTTP rule engine
Block rules	✓Block or monitor	✓Deny action	✓Custom Rules	×No HTTP rule engine
Rate-limit rules	✓Per IP or route	✓Metered action	✓1 rule on Free	×No HTTP rule engine
Redirect rules	✓Uncapped	✓Metered action	✓10 rules on Free	×No HTTP rule engine
Bot protection
Basic bot / crawler filtering	✓Built in	✓User-agent policy	✓Bot Fight Mode	×Not built in
Managed browser challenge	✓Invisible + human checks	×No managed challenge	✓Managed Challenge	×Not available
Tools & ownership
Desktop publishing UI	✓Native macOS app	×No native publisher	×No native publisher	×Funnel uses CLI
Command-line interface	✓uplink CLI	✓ngrok agent	✓cloudflared	✓tailscale funnel
Self-host the public edge	✓MIT licensed	×Managed edge only	×Cloudflare edge only	×No self-hosted Funnel

Your first app online in minutes.

Install Uplink, point it at a local HTTP port, and publish. That's it.

Get started See how it works

$curl -fsSL https://uplink.computer/install.sh | sh

Linux x86_64 & arm64 · Apple Silicon macOS — desktop users: install from Settings

Bring your apps online

Serve local apps without exposing your network.

An alternative to datacenter deploymentwith the privacy and low cost of self hosting.

Zero-Trust Access Control

Web Application Firewall

Bot Protection

Custom Domains & Load Balancing

Traffic Inspector

Observability & Analytics

The OpenTunnels Protocol.

QUIC + TLS 1.3

Channel binding (RFC 9266)

Broad web compatibility

Enforced tenant isolation

No head-of-line blocking

Written in Rust

Pairs perfectly with Tailscale and Docker.

Seamless support for modern web protocols

Automatic TLS 1.3

HTTP/2 and HTTP/3

WebSockets

Server-Sent Events

Verified compatibility with popular apps

Use our infrastructure or deploy your own edge.

Self-Hosted Edge Server

Managed Edges

Free

Dev

Pro

Add a Team

Dedicated Edge Cluster

Enterprise

Full featured and polished, open source and self-hostable.

Your first app online in minutes.

Serve local apps
without exposing your network.

An alternative to datacenter deployment
with the privacy and low cost of self hosting.

Pairs perfectly
with Tailscale and Docker.

Seamless support
for modern web protocols

Use our infrastructure
or deploy your own edge.

Full featured and polished,
open source and self-hostable.