1lan

1lan (“One LAN”) makes machines stuck behind NAT and firewalls reachable again — home servers, lab boxes, appliances in the field — by having each one dial home with a persistent reverse SSH tunnel to a relay server you own. Once connected, every client is one SSH command away, and selected service ports (web UIs, media servers, APIs) are reachable through the relay’s hardened HTTPS front end.

It’s the self-hosted answer to commercial tunnel and overlay services: no third-party relay in your traffic path, no proprietary agent, no subscription. The moving parts are deliberately boring — plain OpenSSH, a shell script, and a systemd unit — because boring is auditable.

How it works

• Each client runs a small service that establishes and maintains a reverse tunnel to the relay. It’s idempotent (safe to restart, safe on a timer) and ties the tunnel’s lifetime to the service — no orphaned connections.
• Every client gets a stable, distinct SSH port on the relay, derived from its address, so reaching any machine in the fleet is one predictable command.
• A per-host registry file declares which service ports each client publishes — adding a host or a service is one line, no code changes.

Locked down by default

The relay account that accepts the tunnels can do exactly one thing: accept reverse port-forwards. No shell, no PTY, no password, and an SSH key restricted to tunnel establishment — a compromise of a field device does not yield a foothold on the relay.

The public face is a native nginx + ACME TLS proxy driven by a single services registry: virtual hosts and certificate configuration are generated from the registry and installed only after passing configuration tests. Administrative services are never exposed over plaintext HTTP — HTTPS with authentication, always. Default-deny, explicit allow — the same philosophy as everything we build.

Status

1lan runs in production across our own fleet, tunneling everything from AI inference dashboards to media servers. A standalone open release is in preparation. Contact us for deployment, or to talk about managed relay setups.