TunnelNet Docs.

Everything you need to install, connect, and manage your TunnelNet address.

Requirements

TunnelNet works on Linux and WSL (Windows Subsystem for Linux). You need root access to install and run the service.

Install

Download and install tnet

$ curl -fsSL https://tunnelnet.com/install | sudo bash -s -- TOKEN

Replace TOKEN with the enrolment token from your dashboard. This installs tnet, the TunnelNet CLI, sets up the WireGuard tunnel, and enrols your machine.

Connect

Bring the tunnel up

$ sudo tnet up

Your machine is assigned a public IPv4 address from our /24 block (23.187.152.0/24). The address is announced by AS396500 and routed to your machine through an anycast endpoint.

Check status

$ sudo tnet doctor

Bring the tunnel down

$ sudo tnet down

Firewall

SSH is open by default (port 22, or 2222 on WSL). Everything else is closed. Inbound traffic is dropped at our edge before it reaches your machine. You explicitly open ports through the CLI.

Open a port

$ sudo tnet ports allow tcp 443

Open a port range

$ sudo tnet ports allow udp 27015:27020

List open ports

$ sudo tnet ports list

Close a port

$ sudo tnet ports deny tcp 443

Infrastructure

TunnelNet IP operates three hubs in separate datacentres behind an anycast endpoint. If a hub goes down, traffic fails over to the remaining hubs automatically. Recovery time is dominated by the WireGuard rekey — expect minutes of interruption, not seconds.

The control-plane database replicates to a standby in a third region, with automatic failover decided by a quorum across three providers.

Reachability is monitored externally from a provider outside the TunnelNet network. Incidents are recorded on the public status page.

The address block (23.187.152.0/24) is announced by AS396500, which MinakiLabs owns and operates. Routes are RPKI-valid. Customer traffic is isolated from other customers at the hub.

Limitations

• Inbound traffic only. TunnelNet does not route your outbound/egress traffic.
• Hub failover is automatic but takes minutes, not seconds. The WireGuard rekey on your machine dominates recovery time.
• No published availability percentage — it will be published as a measured number once there is enough operational history.

Support

Email support@minakilabs.com. Abuse reports are responded to within 24 hours.