Open-source private mesh networking. Connect machines into one encrypted network - then SSH, serve internal apps, publish public tunnels, transfer files, and wire Kubernetes into the same fabric. One identity. One policy engine. One stack you can fully self-host.
Commercial mesh products are excellent but most of them keep the coordination server closed. Tunnet ships the agent, control plane, management API, dashboard, and relays in this repository. You can read every line, self-host everything, and never depend on a proprietary coordination service or a lagging third-party reimplementation.
You also get more than a VPN. Instead of stitching Tailscale + ngrok + scp + a bastion, Tunnet puts mesh, public tunnels, internal services, file transfer, identity SSH, device posture, and Kubernetes under one identity and one ACL system.
| Capability | What it replaces | Docs |
|---|---|---|
| Mesh network | Tailscale, NetBird, Cloudflare WARP | Mesh |
| Serve | Cloudflare Access / Tailscale Serve | Serve |
| Tunnel | ngrok, Cloudflare Tunnel | Tunnel |
| Send | Taildrop / ad-hoc file hops | Send |
| SSH | Key distribution + bastions | SSH |
| Device posture | MDM / EDR policy gates | Posture |
| Self-hosted relay | Vendor edge networks | Relay |
| Kubernetes operator | Custom VPN + Ingress glue | Kubernetes |
| Policy as Code | HuJSON ACLs + ad-hoc GitOps | Policy as Code |
| Audit logs | SIEM-only or closed admin trails | Audit Logs |
| Node / Rust / Go SDKs | Embedding tunnels + management API | SDK |
Each enrolled machine gets an overlay IP and a hostname. Ordinary tools (ping, curl, ssh, browsers) just work. PeerDNS, subnet routes, exit nodes, and HA gateways are built in.
The Tunnet Operator connects a cluster to your network with CRDs: advertise cluster CIDRs, publish Services to peers (TunnetIngress), expose public HTTPS (TunnetTunnel), reach mesh hosts from inside the cluster (TunnetEgress), and optionally inject sidecars. Same Serve/Tunnel products you already use - native to Kubernetes.
Ship a mesh node inside the process. No separate agent required for app-to-app traffic:
Open streams to peers, accept inbound connections, transfer files, and compose with your existing HTTP stack.
For management automation (policy, groups, ACLs) see the Go management SDK.
- Managed - control plane, dashboard, SSO/OIDC, centralized policies, Policy as Code (HCL/JSON/YAML, Terraform, GitOps), audit logs, tunnels, SSH recording. Built for teams.
- Direct - zero-server P2P mesh for individuals and small groups.
Author ACLs, groups, tags, SSH, and posture in Git. Validate and simulate offline, post semantic diffs on PRs, apply with drift detection, export to Terraform, and roll back revisions - without giving up the dashboard.
| Tunnet | Tailscale | ngrok | Cloudflare | |
|---|---|---|---|---|
| Mesh VPN | Yes | Yes | No | Yes (Mesh) |
| Open control plane | Yes | No | No | No |
| Public tunnels | Yes | Funnel | Yes | Yes (Tunnel) |
| Internal services (Serve) | Yes | Serve | No | Access |
| P2P file transfer | Yes | Taildrop | No | No |
| Identity SSH + recording | Yes | Yes | No | Yes (browser) |
| Device posture | Yes | Yes | No | Yes (Zero Trust) |
| Self-hosted relay | Yes | DERP (self-hostable) | No | No |
| Serverless P2P mode | Direct | No | No | No |
| Kubernetes operator | Yes | Yes | Yes | Community¹ |
| Embeddable SDKs | JS, Rust | Go, C | Go, Rust, Python, JS, Java | No² |
| Policy as Code | Yes | Limited | No | Limited |
| Audit logs | Yes (self-hostable) | Yes | Partial | Yes |
¹ Cloudflare has official K8s deployment guides for Tunnel but the operators are community-maintained. ² Cloudflare offers API SDKs (Go, TS, Python) but no embeddable tunnel SDK.
Honest caveat: Tailscale and Cloudflare are more mature in enterprise polish and battle-tested scale. Tunnet’s bet is full openness + one integrated stack. Details: Comparison guide.
| Path | Link |
|---|---|
| Install the agent | Installation |
| Managed quick start | Quick start (Managed) |
| Direct quick start | Quick start (Direct) |
| Self-host the stack | Self-hosting |
| CLI reference | CLI |
| Full docs | docs.tunnet.io |
# Linux / macOS
curl -fsSL https://github.com/tunnetio/Tunnet/releases/latest/download/install.sh | sh# Windows (PowerShell as Administrator)
irm https://github.com/tunnetio/Tunnet/releases/latest/download/install.ps1 | iexTunnet uses component-level licensing:
- MPL-2.0 for the embeddable runtime, agent, SDKs, and client-side runtime components.
- AGPL-3.0-only for the control plane, management, dashboard, managed relay, audit, persistence, internal API, and deployment-orchestration components.
- Apache-2.0 for protocol/common code, clients, contracts, policy formats, SDK tooling, examples, install scripts, and CI tooling.
See the full license map, the standard license texts, and the Commercial License. The Commercial License is an alternative to AGPL-3.0-only for the AGPL components; it is not required for MPL-2.0 or Apache-2.0 components.