Auto Secure LoginPublish a private app — without opening a single port.
ASL Tunnel exposes any local service to the internet over one outbound encrypted connection. A lightweight agent on Windows, Linux, or a Raspberry Pi opens a single WebSocket out; public HTTP, HTTPS, streaming, and WebSocket traffic ride back down it to your local app. No router port-forward. No inbound firewall rule. No static IP. Every tunnel is centrally managed — reserve by name, enable, pause, rotate, revoke, quota-limit, and audit from a dashboard, CLI, or your phone.
The problem
Every port you forward is a door you have to defend.
Sharing a dev preview, catching a webhook, or reaching a home-lab box usually means poking a hole in a firewall, standing up a static IP, or trusting a consumer tunnel tool with no real governance. Each one is attack surface you now own.
ASL Tunnel keeps the box closed — the agent only dials out — and wraps the whole thing in enterprise governance: capability RBAC, per-org quotas, a hash-chained audit, and a global kill-switch.
Private by default
- Viewer-key URLs → signed cookies, not public links
- Agent tokens are HMAC-SHA256, expiring, bound to one route
- Request inspector shows headers, never bodies
- Global kill-switch + per-device pause + archive
- An adversarially-found proxy-header forgery hole — found and closed
Capabilities
A tunnel, plus the governance a tunnel usually lacks.
Path routing
One hostname, path-based routing at /t/<name>/ — reserve a friendly name and route to it.
Outbound-only
Works behind NAT and CGNAT — the agent opens a single encrypted WebSocket and nothing listens on your box.
Full protocol forwarding
Streaming responses and full bidirectional WebSocket forwarding, not just simple request/response.
Scoped agent tokens
HMAC-SHA256 expiring tokens bound to exactly one route, with QR / one-time pairing codes for setup.
Per-route & per-org quotas
Quota tiers of 5 / 25 / 250 / 1000 routes by plan, enforced per route and per organization.
Kill-switch & pause
A global kill-switch, per-device pause, and archive — cut off any route or the whole org instantly.
Live admin dashboard
A live dashboard with sanitized CSV export and a request inspector that shows headers but never bodies.
Offline alerting
Email/Slack alerts when a tunnel goes offline or a token is about to expire, with backoff and history.
Self-serve billing
Stripe tiers with full dunning and suspension, and self-serve signup via email / SMS / Google OTP — one trial per contact.
Reach your box. Never expose it.
One outbound connection, full protocol support, and the governance to run it for a whole team — reservable, quota-limited, auditable, revocable.