Reach any service on any network. No open ports.
Run one agent per machine and manage every endpoint from your browser. Or expose something in a single command. Both ends dial out — nothing listens on the public internet.
Three ways in, one relay.
Start with a one-off command. Graduate to an agent when you want it to stick.
Agents
One long-running process per machine that serves every endpoint you declare in the dashboard. Add or edit one and it converges in seconds — no restart, no SSH.
Explore agents →Firepuncher
A port on your laptop becomes a port inside your network. SSH, Postgres, Redis, RDP, VNC — anything that speaks TCP, with no port open on either side.
How it works →hle expose
One command, one public HTTPS URL, real certificate, SSO if you want it. Best for a quick share, a demo, or a webhook you need to receive right now.
Read the quick start →Both ends dial out.
There is no inbound port on your side and nothing to forward on your router. Your agent holds an outbound WebSocket to the relay; visitors arrive at the relay, get authenticated, and ride that same connection home.
Pick the one that matches the job.
Quick share
one-offOne tunnel, configured on the command line. Stops when you press Ctrl+C.
$ hle expose --service http://localhost:8123 --label ha ✓ Live at https://ha-x7k.hle.world
Agent
persistentInstall once. Every endpoint after that is a form in the dashboard.
$ curl -fsSL https://get.hle.world | sh -s -- --agent ✓ Enrolled · service installed · starts at boot
hle expose | hle agent | |
|---|---|---|
| Tunnels per process | One | Many |
| Configured in | The command line | The dashboard |
| Changing a tunnel | Restart the command | Takes effect in seconds |
| Credential | API key hle_… | Agent token hlea_… |
| Unlocks firepuncher | — | Yes |
| Service discovery | — | Yes — Kubernetes & Docker |
Homelabs, real infra, and works in progress.
Homelab
Home Assistant, Jellyfin, Plex, Grafana — reachable from your phone with SSO in front, WebSockets intact, no VPN client to install.
Self-hosted infra
Proxmox, Unraid, TrueNAS, a k8s cluster in the basement. One agent per box, endpoints declared centrally, plus SSH and Postgres over firepuncher.
Local development
Share the thing you're building, receive real webhooks against your laptop, hand a client a URL that works — without deploying anything.
Two gigabytes free, every month.
No card, no trial clock. Install the agent, declare an endpoint, and see whether it fits.