One tool.
Every protocol.
HTTP, TCP, TLS, and mutual TLS tunnels with automatic HTTPS, reserved addresses, IP allow lists, and password protection. The agent is open source, we never read your traffic, and your tunnels stay in the region you choose.
- Open-source agent
- No payload inspection
- EU data residency
- Works behind CGNAT
Built to run in production.
Everything below is included on a flat team plan, no per-seat fees and nothing metered. The same capabilities cover a weekend project and a fleet in the field.
Security & compliance
Multi-Region
Run tunnels from servers close to you and your users. Pick the region per tunnel and traffic stays there.
EU Data Residency
Account, billing, and tunnel data are stored in the EU. Traffic stays in the region you choose.
Mutual TLS
Lock a tunnel so only callers holding a certificate you issued get in. Revoke any one of them instantly.
IP Allowlist
Restrict a tunnel to the IP ranges you trust. Everyone else is turned away before they reach your service.
Addresses & encryption
Custom Domains
Point your own domain at a tunnel. Add one CNAME record and traffic flows to your machine, wildcards included.
Automatic HTTPS
Every HTTP tunnel gets a real certificate every browser trusts. No Let's Encrypt config, no certificate warnings.
Static Subdomains
Reserve a subdomain so your URL stays the same across every session and restart.
Reserved Ports
TCP and TLS tunnels keep a dedicated port, so clients always reconnect to the same address.
Operations & team
Password Protection
Put a username and password in front of any HTTP tunnel. Visitors sign in before they reach your app.
Force HTTPS
Send every visitor to the secure https:// address with one toggle.
Auto Reconnect
Network drops, the agent reconnects and reclaims its address on its own.
Live Dashboard
Watch connections, bytes transferred, and request counts per tunnel in real time.
Team Management
Organise tunnels by team, invite members, and control who reaches what.
Cross-Platform
One binary for macOS, Linux, and Windows, across Intel, Apple Silicon, and ARM.
Protocol support
Tunnel anything you run.
Web apps, databases, game servers, encrypted sockets. Pick the protocol that fits and keep the same command.
HTTP & HTTPS
Most usedWeb apps and APIs, live in one command.
Every HTTP tunnel gets a real TLS certificate that browsers trust, issued automatically. You get the HTTP and the HTTPS address out of the box. Works with React, Next.js, Django, Rails, Flask, and anything that speaks HTTP.
TCP
Anything that speaks raw TCP.
Databases, game servers, SSH, Redis, MQTT, custom protocols. Reserve a dedicated port and clients reconnect to the same address after every restart, no raw IP exposed.
TLS
End-to-end encrypted passthrough.
Traffic reaches your service still encrypted. Localport never sees the plaintext. Use it when your service owns its certificates, runs its own mTLS, or has compliance rules to meet.
How it works
One outbound connection. That is the whole setup.
No inbound ports, no dynamic DNS, no certificate wrangling. Here is what happens between your machine and the public URL.
No port forwarding, ever
Your machine opens one outbound connection to our network on port 443, the same port your browser uses. Your router stays closed and your home IP stays hidden. It works behind NAT, CGNAT, double NAT, office firewalls, and cellular hotspots. If the machine can load a web page, it can run a tunnel.
Servers close to your users
Tunnels run from multiple regions. Pick the region per tunnel so requests take the short path, and the traffic stays in that region. Your account and billing data live in the EU.
Real HTTPS, issued for you
Every web tunnel gets a certificate that browsers trust, issued and renewed automatically. No Let’s Encrypt config, no self-signed warnings, no manual renewal. Just an https:// link that works everywhere.
Nothing to steal at rest
The public servers that carry your traffic hold no database, no keys, and no certificate authority. Secrets stay on our locked-down control plane. Even in the worst case, the machines facing the internet have nothing on them to take.
Routing modes
One device, or a thousand.
Same agent, same command. Choose how traffic reaches your clients, from one public URL to a whole fleet of named devices.
Default
Standard
One tunnel, one URL. The fastest way to share a dev server, demo an app you vibe-coded with Cursor or v0, test a webhook, host a game server, or preview a pull request.
- One command, one public link
- HTTP, TCP, and TLS with automatic HTTPS
- Static subdomain keeps the URL stable
- Reserved port for TCP and TLS tunnels
IoT & fleets
Mesh
One tunnel, a whole fleet. Connect your devices under one token and reach any of them by name from anywhere, even behind CGNAT or a cellular modem. Built for IoT and distributed hardware.
- Each device gets its own subdomain and port
- Reach any device by its name
- Mixed protocols per device: HTTP, TCP, or TLS
- Lock the mesh with mutual TLS
Teams & webhooks
Shared
One URL, the whole team. Point a single webhook at a shared tunnel and every teammate gets the same request at once, with no per-developer tunnels and no replaying events to chase.
- All clients get the same request live
- Stable subdomain keeps the webhook URL fixed
- Pick the active responder from the dashboard
- IP rules control who can join and who can send
Locked · mTLS
Only the devices you trust get in. Pro
Each tunnel gets its own certificate authority. Hand a certificate to every device you trust, and everyone else is turned away before they reach your service. Localport checks the certificate on every request, and you revoke a device in one click. No SDK, no code changes.
Shared
One URL for the whole team. It never moves.
Register the webhook once and never touch it again. A shared tunnel hands your whole team one permanent URL, so every teammate receives the same request the moment it lands. No per-developer tunnels, and no replaying events to chase.
Read every line that touches your network.
The Localport agent is the binary that runs on your machine and tunnels your traffic. Its source lives on GitHub, so you can read it, build it from scratch, and audit the protocol before it ever connects.
When a tool sits between your machine and the internet, transparency matters. We run the hosted side as a managed service so your tunnels just work.
View on GitHubCommon questions.
Still deciding? The docs go deeper, or talk to us.
Does Localport work behind CGNAT, NAT, or a firewall?
Yes. The agent makes one outbound connection on port 443, so it works anywhere your browser does: behind NAT, CGNAT, double NAT, corporate firewalls, and cellular hotspots. No port forwarding and no router changes.
Which protocols can I tunnel?
HTTP and HTTPS for web apps and APIs, raw TCP for databases, SSH, and game servers, and TLS passthrough for services that own their certificates. Add mutual TLS on Pro to lock a tunnel to callers you trust.
Is the Localport agent really open source?
Yes. The binary that runs on your machine lives on GitHub. Read it, build it from scratch, and audit the protocol before it ever connects. We run the hosted side as a managed service so your tunnels just work.
Do you inspect or log my traffic?
No. We never read your payloads, log them, or train on them. Traffic passes straight through and stays in the region you choose. With TLS passthrough we never see the plaintext at all.
Can I use my own domain?
Yes. Point your domain at a tunnel with one CNAME record and get automatic HTTPS, wildcards included. Reserved subdomains and ports keep your address stable across restarts.
How is Localport different from ngrok?
Flat team pricing instead of per-seat fees and metered bandwidth, an open-source agent, and mesh and shared tunnels that ngrok does not offer. Same protocols, more in the box, no usage surprises.
Can I try it before paying?
Start with a free trial and cancel any time. Plans are flat from $5/mo billed yearly, with mutual TLS and higher limits on Pro.
Put it all to work.
Open-source agent. Flat team pricing from $5/mo billed yearly. Upgrade to Pro when you need mutual TLS or higher limits. Start with a free trial, cancel any time.