STREAMTUNNEL

The agent.

One line to install on a machine or VPS. Scan the QR code with the Streamtunnel app. Then set it as your exit to the internet, or add it as a subnet node you need access to.

What’s an agent?

The agent is the node software. It is the same program our own exits run, and it turns a machine you own, a home server or a VPS, into a node on your key. As an exit, that machine becomes a place to step out from: your home connection, wherever you are. As a subnet node, it opens one machine, a Plex library or a NAS, and nothing past it.

You install it once. The app does the rest.

Install

To make your machine or VPS an exit, run this on it:

curl -fsSL https://streamtunnel.net/exit.sh | sudo sh

To connect to just one device or machine, such as Plex, Minecraft, Hermes or OpenClaw, run this on that machine:

curl -fsSL https://streamtunnel.net/subnet.sh | sudo sh

Debian and Ubuntu, Fedora and the RHEL family, Arch, Alpine and openSUSE, with systemd or OpenRC. On RHEL 8 and 9 and their clones, EPEL must be enabled first for the WireGuard tools.

To uninstall the streamtunneld service, run:

curl -fsSL https://streamtunnel.net/exit.sh | sudo sh -s uninstall

Claim it in the app

Either way, exit or subnet node, when it finishes it prints a claim code as a QR, and as text in case the terminal cannot draw one. In the app, open Nodes. For an exit, go to My exit nodes and Add exit node; for a subnet node, go to Subnet nodes and add one there. Scan the code. The node appears in your list and starts learning your devices within seconds.

The code works once and expires after 24 hours. Until it is claimed the node does nothing, and a node nobody claims is removed after those 24 hours. To remove a node in the app, long-press it.

Behind a home router

The installer checks whether the machine can be reached directly from outside. If it can, your devices dial it straight. If it cannot, behind a home router or a carrier that shares one address, the machine opens an outbound tunnel to the nearest of our nodes and your devices reach it through that. Our node only ever forwards ciphertext: the tunnel stays keyed to your machine, so the traffic is between you and it. Where the router allows, the agent also asks it to forward a port so the direct path can be used.

What the machine knows, and what we know

The node syncs with a token of its own and receives only your devices’ keys, nothing about anyone else. It holds no fleet secret. We collect no vitals from a machine you own: not its load, not its traffic, not what passes through it.

Devices that connect to your exit reach the internet and nothing else: not each other, not the machine, not the network behind it. A subnet node ends at the one machine you chose.

A node you own can be shared with someone you trust. What that person’s node can see is the same as any internet provider’s, so choose people you trust.