Push-button DIY tunnel service. Run on your Raspberry Pi or VPS to create your own secure tunnel to access your devices from anywhere or simply to expose your localhost development to the outside world.
Go to file
AJ ONeal 986102c79e Merge branch 'master' of ssh://git.coolaj86.com:22042/coolaj86/tunnel-server.js 2018-04-24 16:35:12 +00:00
bin begin install script 2018-04-24 16:34:51 +00:00
dist/etc/systemd/system add stunneld.service for systemd 2017-10-04 17:37:07 -06:00
snippets fs cleanup 2016-09-30 18:03:41 -04:00
.gitignore fs cleanup 2016-09-30 18:03:41 -04:00
.jshintrc add .jshintrc 2017-04-25 14:36:47 -06:00
LICENSE Initial commit 2016-09-15 17:10:22 -06:00
README.md update links 2018-04-24 01:53:27 +00:00
handlers.js make error messages hyper-focused and super specific 2017-10-04 17:28:38 -06:00
package.json v0.9.2 2018-04-21 01:19:57 +00:00
wstunneld.js updated for node v8.x and ws 5.x 2018-04-24 16:34:20 +00:00

README.md

| Sponsored by ppl | tunnel-server.js | tunnel-client.js |

stunneld.js

A server that works in combination with stunnel.js to allow you to serve http and https from any computer, anywhere through a secure tunnel.

CLI

Installs as stunnel.js with the alias jstunnel (for those that regularly use stunnel but still like commandline completion).

Install

npm install -g stunneld

Then dist/etc/systemd/system/stunneld.service should be copied to /etc/systemd/system/stunneld.service and the ARGUMENTS, such as SECRET, MUST BE CHANGED.

TODO: make --config /path/to/config the only argument (and have the secret auto-generated on first run?)

Note: Use node.js v8.x

There is a bug in node v9.x that causes stunneld to crash.

https://github.com/nodejs/node/issues/20241

Advanced Usage

How to use stunnel.js with your own instance of stunneld.js:

stunneld.js --servernames tunnel.example.com --protocols wss --secret abc123

Options

--secret          the same secret used by stunnel client (used for authentication)
--serve           comma separated list of <proto>:<servername>:<port> to which
                  incoming http and https should be forwarded

Privileged Ports without sudo

# Linux
sudo setcap 'cap_net_bind_service=+ep' $(which node)

Alterntive Methods

NOT YET IMPLEMENTED

We created this for anyone to use on their own server or VPS, but those generally cost $5 - $20 / month and so it's probably cheaper to purchase data transfer (which we supply, obviously), which is only $1/month for most people.

Just use the client (stunnel.js) with this tunneling service (the default) and save yourself the monthly fee by only paying for the data you need.

* Node WS Tunnel (zero setup)
* Heroku (zero cost)
* Chunk Host (best deal per TB/month)

Security

The bottom line: As with everything in life, there is no such thing as anonymity or absolute security. Only use stunneld services that you trust. :D

Even though the traffic is encrypted end-to-end, you can't just trust any stunneld service willy-nilly.

A man-in-the-middle attack is possible using Let's Encrypt since an evil stunneld service would be able to complete the http-01 and tls-sni-01 challenges without a problem (since that's where your DNS is pointed when you use the service).

Also, the traffic could still be copied and stored for decryption is some era when quantum computers exist (probably never).