sish

A number of years ago, I created a fully open source (MIT) project called sish [0] that does just this. sish is a SSH server written specifically for tunneling. You get all of the benefits of SSH, but also automatic TLS, a web console of requests a tunnel has received, and various other features. You can also tunnel more than just HTTP(S). You can tunnel websockets, TCP connections, and even have internal alias connections for using ProxyJump within the tunnel. All stateless and all protected with SSH auth. If you’re not interested in self hosting, there’s a hosted version at tuns.sh [1] that has multi region support and a few other cool features (including UDP tunneling) as part of the pico.sh [2] membership ($2/mo). Happy to answer any questions in this space! [0] https://github.com/antoniomika/sish [1] https://tuns.sh [2] https://pico.

We’re actually using Unix sockets as the underlying transport layer for this. We’re also not using sshd, we custom wrote our own daemon that’s entire job is tunneling. If you’re curious about this, you can find the project here: https://github.com/antoniomika/sish sish was actually my first foray into SSH apps. It was a lot of fun to write and pretty much implements tunnels with a routing system on top. It manages connectivity, routing, and reverse proxying all within user space. No namespaces required! tuns can actually even tunnel UDP traffic over SSH, also entirely in user space. Docs for that can be found here: https://pico.sh/tuns#udp-tunneling

We’ve used https://github.com/antoniomika/sish quite successfully. It‘s very easy to setup with docker compose and even supports letsencrypt wildcard certificates.

My favourite one is https://github.com/antoniomika/sish It uses SSH as the method of opening the remote tunnel to the public server.

Personally I’ve been using sish[1] recently, lots of ngrok alternatives out there now, especially as the pricing went a bit weird [1] https://github.com/antoniomika/sish

I used to use a similar tool called inlets but they removed the open licensing. I now self host a sish server (https://github.com/antoniomika/sish) which also uses ssh (and public key auth) for the reverse tunnel client. So much simpler!

In the house; - PiHole - Plex - Unifi Controller - Sonarr / Prowlarr - Homeassistant (+mqtt) - Heimdall On a server running Proxmox, with a couple of Portainer VMs; - Mailinabox : For some extra domains and things - Cyberchef : For quickly decoding things - HTTP Bin : To test out APIs - MinIO : For testing S3 compatible stuff - Request Bin : Mostly for testing, but also 4 public facing ones to check stuff - Sish : Because I don't want to pay for ngrok anymore (https://github.com/antoniomika/sish) - VSCode : Havent really used it yet, still trying to see if it works for me - Ghost : For blog, but I havent done anything yet and may move to hugo/cloudflare

There are many (always) free alternatives out there which you can find in a fairly comprehensive list at awesome-tunneling [0]. I'd caution anyone as there's always risk with downloading a no sources available binary as well, but this looks like it could be another good option! My favorite two projects currently in the tunneling space are sish [1] and bore [2]. sish is more full featured and utilizes ssh for handling proxies (disclaimer: I wrote sish) while bore maintains a client/server but all sources are available for both. They're written in Go and Rust respectively. There's even a publicly accessible instance of bore running. You should submit a PR to include CRProxy in the awesome-tunneling list, I know Anders might do that as well as he's normally around these parts :) [0] https://github.com/anderspitman/awesome-tunneling [1] https

It's important to note that if you're not self hosting this, you're giving unlimited internal network access to this service (unless you properly firewall of course). It's not specific to the single port/address that is used when downloading the config. Disclaimer: I wrote a similar tool that is self-hosted and uses SSH as the tunneling service. Does HTTP(S) with TLS termination, TCP, TLS (via SNI), and internal tunneling (unexposed tunnels that are authenticated using SSH) [0]. [0] https://github.com/antoniomika/sish

I used to provide a public instance of sish (a similar app) [0] and can say abuse is most definitely a problem. People were using sish for command-and-control servers, especially because it used only SSH for establishing tunnels. It was specifically chosen because nothing else needed to be installed. Really only worth it if a service provider (DO, AWS, etc) provides free compute and acknowledges the risk involved. [0] https://github.com/antoniomika/sish

I made sish [0] so this could be done for myself and friends automatically. It’s a binary written in Go that implements the SSH protocol and allows TCP forwards, HTTP(S) w/ built in requesting of certs from LE (including for custom domains) forwards, aliases (tunnels kept local to the daemon that does not bind a port) forwards, and TLS forwards using SNI for routing. sish implements a web front end for inspecting web traffic on tunnels as well, albeit not as nice as Ngrok :) [0] https://github.com/antoniomika/sish

Setup https://github.com/antoniomika/sish and get away from manually setting anything up. Uses SSH, supports HTTP(S)/TCP/Websockets/TLS via SNI and let’s users choose their own tunnel names. Can run it on a free instance from google or oracle.