Do I need to open ports or change my router to use an HTTP tunnel?

No. The agent makes an outbound connection to the Nodetonet edge server, so tunnels work behind any NAT, corporate firewall or CGNAT with zero inbound network configuration required.

Can I use my own domain with an HTTP tunnel?

Yes. Point a CNAME record at the Nodetonet edge and assign it in the dashboard. Nodetonet automatically issues a wildcard Let's Encrypt certificate so your tunnel serves from your own domain over HTTPS. See the bring-your-own-domain guide for exact steps.

How is Nodetonet HTTP tunnels different from ngrok?

The core tunnelling mechanic is the same. The key differences are: Nodetonet lives in one panel with your mobile proxies and VPN, runs on prepaid credit with no per-seat subscription, idle tunnels cost nothing, and your Android proxy agent can double as a tunnel agent. See Nodetonet vs ngrok for a full comparison.

Is SSL automatic, and do certificates auto-renew?

Yes on both counts. Nodetonet issues a Let's Encrypt certificate the moment a tunnel is created and renews it before expiry with no action required from you. For custom domains, a wildcard cert covers all subdomains at once. See Let's Encrypt auto-renewal for details.

Can the same Android agent run a proxy and a tunnel at the same time?

Yes. An Android device paired as a mobile proxy can simultaneously host an HTTP tunnel over the same outbound connection. This lets you use one device — and one SIM — for both purposes at once, which is especially useful for webhook testing against a real mobile carrier IP.

How do I keep my tunnel secure — can I restrict who can access it?

Yes. You can apply IP allowlists to restrict access to specific CIDR ranges (for example, your office network), configure domain restrictions, and review access logs that record every request with its source IP and timestamp. Deleting a tunnel from the dashboard stops it immediately with no DNS wait.

What is the difference between an HTTP tunnel and a VPN?

An HTTP tunnel exposes a local service outward — traffic flows from the internet into your machine. A VPN routes your own outbound traffic through a different network for privacy or remote access. They solve opposite problems and can both be active at the same time. See the VPN vs proxy guide for a full breakdown.

HTTP tunnels — expose localhost to a public HTTPS URL in seconds

An HTTP tunnel takes a server running on your laptop, a Raspberry Pi, a private office network, or a Windows PC and gives it a public, HTTPS URL that anyone on the internet can reach — without touching your router, opening firewall ports or fighting CGNAT. Spin up a dev server, a webhook receiver, an IoT dashboard or a client demo, and share a live link in seconds.

TL;DR: one agent install, one command, and your localhost:PORT is online at a stable https://sub.nodetonet.com address — with automatic Let's Encrypt SSL, your own custom domain whenever you want it, and billing only for what you actually use.

How HTTP tunnels work

A tunnel agent runs alongside your local service and makes a single outbound connection to a Nodetonet edge server. The edge server receives incoming HTTPS requests from the internet and forwards them back through that persistent connection to your local port. From the outside it looks like a normal HTTPS web server; from the inside nothing changes — your app still listens on localhost:3000 (or whatever port you choose) exactly as before.

Because the connection is initiated from inside your network, no inbound firewall rules are needed. This is how tools like ngrok, Cloudflare Tunnel and LocalToNet all work — the difference is that Nodetonet puts tunnels in the same panel as your mobile proxies, rotating proxies, VPN and everything else, on prepaid credit with no per-seat subscription.

What you get

Public HTTPS URL — a stable address like sub42.nodetonet.com pointing straight at your local port, available immediately after agent startup.
Automatic SSL — Let's Encrypt certificates are issued and renewed for you automatically. See how auto-renewal works and why it matters for always-on tunnels.
Bring your own domain — point a CNAME record at Nodetonet and serve the tunnel from demo.yourbrand.com with a wildcard cert. The bring-your-own-domain guide walks through the setup step by step.
Wildcard SSL certificates — one cert covers every subdomain, so you can run multiple tunnels under a single domain without re-issuing. Read more in wildcard SSL certificates explained.
No port forwarding — the agent makes an outbound connection, so it works behind any NAT, corporate firewall or CGNAT.
Mobile-token tunnels — your existing Android proxy agent can also host HTTP tunnels, so a phone already running a mobile proxy becomes a tunnel endpoint with no extra hardware.
Access logs and monitoring — see every request hitting your tunnel, when it came in and from where. The audit log guide explains what is captured.
Prepaid billing — you are charged only for active tunnel time and traffic; an idle tunnel costs nothing.

Common use cases

Webhook development — give Stripe, GitHub, PayPal or any payment or CI provider a stable HTTPS endpoint that reaches your local handler in real time, without deploying to a staging server.
Client demos and previews — share work-in-progress with a client or teammate on a live URL the moment they ask to see it.
Mobile and cross-device testing — hit your dev server from a real phone, tablet or another browser over the internet without Wi-Fi tricks.
IoT and remote device access — reach a sensor, home automation hub or Raspberry Pi on a home or office network from anywhere in the world.
Local API exposure — let a third-party SaaS product call back to your machine during development, OAuth callback flows included.
Monitoring and health dashboards — expose a Grafana, Prometheus or custom dashboard behind a private network to a small authorised audience, without a full VPN rollout. The tunnel health monitoring post covers keeping it reliable.

HTTP tunnels vs alternatives — quick comparison

Feature	Nodetonet HTTP tunnels	ngrok (free tier)	Cloudflare Tunnel	LocalToNet
Public HTTPS URL	Yes — stable subdomain	Yes — random or paid static	Yes — with Cloudflare domain	Yes
Automatic SSL	Yes — Let's Encrypt auto-renewed	Yes	Yes	Yes
Custom domain / BYOD	Yes — wildcard cert included	Paid plan only	Yes — requires Cloudflare DNS	Paid plan
No port forwarding needed	Yes	Yes	Yes	Yes
Mobile-token agent	Yes — Android agent doubles as tunnel	No	No	No
Proxies + VPN in same panel	Yes	No	Partial (Access, not proxies)	No
Billing model	Prepaid credit, no subscription	Free tier limited; paid plans	Free for basic; Zero Trust paid	Freemium; paid tiers
Reseller / white-label	Yes — via WISECP	No	No	No

For a deeper feature-by-feature comparison, see Nodetonet vs ngrok, Nodetonet vs Cloudflare Tunnel, Nodetonet vs Pinggy, and Nodetonet vs LocalXpose.

Setting up a tunnel: step by step

Create an account — register here and top up a small amount of prepaid credit.
Download the agent — go to /download and grab the Windows .exe agent or the agent for your platform. The PC agent on Windows guide covers first-time setup.
Pair the agent — in the dashboard, create an HTTP tunnel entry and copy the token. Paste it into the agent config or start command.
Point at your local port — tell the agent your local target, for example localhost:3000 or localhost:8080.
Open the public URL — the dashboard shows the live https:// address the moment the agent connects. Share it or hit it from anywhere.
Add your own domain (optional) — create a CNAME pointing to the Nodetonet edge, assign it in the dashboard, and a wildcard cert is issued automatically within seconds.

Security and access control

Exposing a local port to the internet is convenient, but it should be deliberate. Nodetonet gives you tools to keep tunnels locked down:

IP allowlists — restrict which source IPs can reach your tunnel. Combined with an office CIDR this effectively makes the tunnel private. See the IP allow/deny lists guide.
Domain restrictions — control which domains can reference or call your tunnel endpoint.
Audit logs — every request is logged with timestamp, source IP and path so you can see exactly who reached your tunnel and when.
Tunnel health monitoring — set up alerts so you know if the agent disconnects unexpectedly.
Instant teardown — delete a tunnel from the dashboard and the public URL stops responding immediately; no DNS propagation wait.

Using an Android proxy token as a tunnel agent

If you already have an Android device paired as a mobile proxy, it can also host an HTTP tunnel without any additional hardware. The same token that powers your proxy connection can be assigned a tunnel, and the mobile agent forwards HTTPS traffic alongside proxy traffic through the same outbound connection. This is useful for testing on actual mobile carrier IPs — incoming webhook calls to your dev server arrive from a real cellular IP rather than a datacenter address.

For customers running a fleet of devices, this means a single device can serve both a mobile proxy and an HTTP tunnel simultaneously, maximising the value of each SIM. See the reseller feature if you manage tunnels and proxies on behalf of clients.

Tunnels, VPN or proxy — which to pick?

These three features overlap in purpose but solve different problems:

HTTP tunnel — you want to expose a local server to the internet. The traffic comes in from outside to your machine.
VPN — you want to route your own outbound traffic through a different network, typically for privacy or accessing a remote LAN.
Mobile proxy / rotating proxy — you want your application's requests to exit from a trusted, geo-targeted IP — for scraping, automation or geo-testing.

Not sure which applies to your situation? The VPN vs proxy guide and how Nodetonet routes traffic explain the routing model in plain language. You can use tunnels and proxies at the same time — they run in parallel in the same panel.

Get started

Ready to expose your localhost? Create a free account, download the agent from /download, and your first public HTTPS URL will be live in under two minutes. Questions? Reach us at support@nodetonet.com or join the community on Discord.