WebTunnel

Traditional remote access requires asking your ISP for an expensive public IPv4 address, setting up fragile Dynamic DNS, and punching dangerous holes in your router's firewall. WebTunnel replaces all of that with a modern zero-trust architecture: outbound-only encrypted handshakes, automatic NAT traversal, and high-speed peer-to-peer (P2P) mesh direct connections.

Bypass CGNAT & Strict Firewalls

Works seamlessly across cellular networks, campus Wi-Fi, and Carrier-Grade NAT (CGNAT) without requiring any router configurations or UPnP permissions.

ChaCha20-Poly1305 End-to-End Encryption

All payloads are encrypted directly between your client and target node. Even relay fallback servers cannot inspect, log, or decrypt your private data stream.

P2P Direct Mesh Acceleration

Automatically negotiates direct peer-to-peer UDP/TCP routes whenever available, bypassing intermediary servers for lightning-fast sub-15ms transfer speeds.

Any Port & Universal Protocols

Expose web apps (HTTP/2 & HTTPS), SSH terminal access, Synology/QNAP NAS dashboards, Home Assistant IoT hubs, or raw TCP databases with ease.

Single Lightweight Binary Daemon

Zero bloat, written in modern high-performance Go/Rust. Runs as a lightweight service under Linux (systemd), macOS, Windows, Raspberry Pi, and Docker.

Custom Subdomains & Auto HTTPS

Assign persistent personal endpoints (e.g. nas.pgrm.link) with automated TLS/SSL certificate generation and zero maintenance.

Explore pgrm.top

STATUS Public Beta Soon

🚀 Sign up for beta access and deployment guides at www.pgrm.top

webtunnel-daemon v2.4 (arm64/linux) ● ENCRYPTED

$ webtunnel service start --id nas-home --port 8080

[08:24:12] Initializing ChaCha20-Poly1305 keystore... OK

[08:24:13] Probing NAT traversal matrix (STUN/TURN)...

> P2P Direct Route established with client (latency: 12ms)

> ✓ Live Tunnel: https://nas-home.pgrm.link

Protocol: HTTP/2 + TLS 1.3

Cipher: ChaCha20

Mode: P2P Direct Mesh

Zero-Trust Decentralized Mesh Topology

Network Architecture & Security Parameters

Built for rock-solid remote access without sacrificing privacy or speed.

Encryption Cipher

ChaCha20-Poly1305 (AEAD)

NAT Traversal

Interactive STUN/ICE + P2P Mesh

Supported Protocols

HTTP, HTTPS, WebSocket, TCP, SSH

Relay Servers

Global Low-Latency Edge Relays

Daemon Footprint

< 15MB RAM, Single Go/Rust Binary

Official Portal

https://www.pgrm.top

Networking & DevOps Guides

Guides to Modern Remote Access & Self-Hosting

Deep dives into NAT piercing, home lab security, and why traditional port forwarding is obsolete in modern networks.

Self-Hosting 5 min read

How to Access Your Home NAS and Local Docker Services Remotely Without a Public IP

Tired of calling your telecom provider begging for a public IPv4? Discover how outbound reverse tunneling and P2P mesh architectures connect you seamlessly from anywhere.

1. The Public IP Scarcity Problem

IPv4 addresses are officially exhausted worldwide. ISPs bundle residential customers behind Carrier-Grade NAT (CGNAT), making inbound port mapping mathematically impossible.

2. The Outbound Tunnel Solution

Instead of listening for inbound connections, WebTunnel initiates an outbound encrypted tunnel to an edge rendezvous node. Traffic flows smoothly through any firewall.

Security Audit 4 min read

The Hidden Dangers of Port Forwarding: Why Zero-Trust P2P Is the Modern Standard

Opening ports 80, 443, or 22 on your residential router exposes your home network to automated botnets and zero-day scanners. Learn why zero-trust tunnels prevent breaches.

1. Shodan and Port Scanners

Within seconds of opening a port on a public IP, automated bots attempt brute-force dictionary attacks against your NAS, router, and home cameras.

2. Zero Open Inbound Ports

With WebTunnel, 0 inbound router ports are exposed. Attackers scanning your IP find completely closed stealth ports, stopping reconnaissance in its tracks.

Network Architecture 6 min read

Carrier-Grade NAT (CGNAT) Explained: Bypassing Symmetric Firewalls with P2P

Explore the engineering behind STUN/TURN, UDP hole punching, and symmetric NAT traversal. How modern P2P mesh networks achieve direct high-bandwidth connections.

1. How UDP Hole Punching Works

Both endpoints send coordinated UDP packets to each other via a lightweight coordination signal. Once the local NAT tables open matching states, packets flow directly.

2. Seamless Fallback

If strict symmetric NAT blocks direct hole punching, WebTunnel automatically relays through encrypted edge nodes with sub-20ms penalty.

WebTunnel FAQ

Common Questions & Answers

No! WebTunnel requires zero router configuration, zero port forwarding, and zero dynamic DNS setup. It establishes outbound tunnels that bypass even strict firewalls.

No. WebTunnel implements ChaCha20-Poly1305 end-to-end cryptographic encryption. The keys are negotiated directly between your client and target node. Relay servers only route encrypted ciphertext blobs.

Visit our dedicated network portal at www.pgrm.top to register for beta releases, download client binaries, and view interactive setup guides.