Expose your local server in one command
MekongTunnel is a self-hosted SSH tunnel server. No signup, no config, no agents. Just run mekong 3000 and get a public HTTPS URL instantly.
Get started in seconds
Install the CLI
One binary. No dependencies. Works on macOS, Linux, and Windows.
Or use raw SSH (no install needed)
Skip the CLI entirely — just use the ssh command you already have.
Basic
With keep-alive (recommended)
With expiry
Replace 3000 with your local port. The -t flag is required — without it the server cannot display your URL. For raw SSH expiry, use SetEnv like MEKONG_EXPIRE=48h.
Simple by design
How it works
MekongTunnel uses standard SSH reverse port forwarding. No agents, no proprietary protocol, no account required.
Run the CLI
Run `mekong 3000` in your terminal. The CLI connects to MekongTunnel via SSH reverse port forwarding.
Get a Public URL
The server assigns a unique HTTPS subdomain and displays it in your terminal. The URL is copied to clipboard automatically.
Share & Demo
Paste the URL anywhere — your phone, a client's browser, a webhook endpoint. All traffic proxies through to your local app.
Under the hood
SSH reverse forwarding
Your SSH client sends a tcpip-forward request to the server. The server opens an internal TCP listener, assigns you a subdomain, and terminates TLS on port 443. When a browser hits your URL, the server opens a forwarded-tcpip SSH channel back through your connection to your local app.
Traffic path from the public browser request back to your local app
Browser
443A user opens your public HTTPS URL from anywhere.
Tunnel registry
TLSTerminates TLS, assigns the subdomain, and opens the internal listener.
Your SSH client
SSHSends tcpip-forward and receives forwarded-tcpip channels back.
localhost:3000
3000Your local dev server, webhook receiver, or private app.
Everything you need
Built-in features
No plugins, no extensions. Everything ships in a single ~6 MB binary.
Auto-reconnect
The mekong CLI automatically reconnects with exponential backoff if the tunnel drops.
QR Code
Your public URL is printed as a QR code in the terminal. Scan with your phone instantly.
WebSocket Support
WebSocket connections are detected and proxied transparently. No special config needed.
HTTPS by Default
TLS is terminated at the server. Every tunnel gets a valid HTTPS URL out of the box.
Zero Config
One command. No YAML, no accounts, no dashboard. Just your port and you're live.
Abuse Protection
Per-IP rate limiting, sliding-window connection limits, and automatic IP blocking for abusers.
Live Request Log
Every HTTP request is streamed live to your SSH terminal — method, path, status, and latency.
Self-Hostable
Run your own MekongTunnel server on any VPS. Full control, your own domain, MIT licensed.
Multiple Ports
Expose several local ports at once — mekong 3000 8080 — each gets its own public URL.
Daemon Mode
Run tunnels in the background with mekong -d 3000. Check status or stop anytime.
Transparent
Server limits
All limits apply to the public hosted instance. Self-hosters can adjust everything via env vars.
Open Source
Run your own tunnel server
MekongTunnel is MIT licensed. Deploy on any VPS with Docker in under 5 minutes. Your domain, your rules, your data.