Pricing
One public IPv4 address, routed to hardware you already own, for $10 a month. Below is what each plan includes, what it does not, and the things we cannot promise yet — because you will meet all three either way, and it is cheaper for both of us if you meet them now.
The plans
One dedicated, globally routable IPv4 address from our own 23.187.152.0/24, announced by BGP from AS396500 and routed to a machine you already own. An IPv6 /56 comes with it — that is 256 subnets, not a single address, so every container or VM behind your machine can hold its own.
Inbound traffic reaches you at that address. It works from behind NAT or CGNAT with no port forwarding, because your machine dials outbound to us and we route the address down that tunnel.
- Linux, WSL, macOS on Apple Silicon, Windows, or a phone — one installer each, same address whichever you use
- SSH open by default; everything else closed until you open it
- Port rules enforced at our edge, so unwanted traffic is dropped before it reaches your machine
- Machines on the same account can reach each other over the mesh without opening anything publicly
Everything above, and your outbound traffic leaves as that same address instead of your ISP's. This is the plan for the case where a vendor has to allowlist the address you call them from, not just the one they call you on.
You choose the city you exit from — US Central (Chicago) or US East (Newark) — or leave it on anycast and exit through whichever is nearest.
You can start on the $10 plan and upgrade later from the dashboard; the difference is prorated, so nothing is wasted by starting small.
Outbound only, for a phone. Your phone's traffic leaves as your own dedicated address rather than your carrier's, from anywhere — home wifi, a cafe, or cellular. Setup is scanning a QR code into the official WireGuard app.
It is half the desktop egress price because a phone has nothing to host: you are not paying for an inbound half you will never use.
For people who already hold an ASN and their own address space. We carry your prefix and originate it, so you do not need a BGP-capable VPS or a BIRD configuration of your own. Linux and WSL2 only, because BIRD does not run natively on Windows or macOS.
Email support@minakilabs.com with your ASN and we will talk.
How billing works
Each machine is a seat at $10 per month. You press Add a machine on the dashboard, it adds a seat and issues a single-use enrolment token, and you run the installer on that machine. Repeat as often as you like.
Payment is through Stripe and we never see or store your card details. Subscriptions renew monthly until you cancel, and you can cancel at any time from your account — service then continues to the end of the period you have already paid for.
Two things worth knowing before they surprise you. We do not offer prorated refunds for partial months: if you remove a machine mid-cycle you have already paid for that cycle, and the dashboard says so before you click rather than after. And if a payment fails we will retry for a period before suspending, rather than cutting you off on the first decline.
Upgrades between plans are prorated — that is a different thing from a refund, and it means moving from $10 to $20 mid-month costs you the difference rather than a fresh month.
What we do not do
This section exists because we would rather lose the sale than have the argument later.
The base plan is inbound only. Traffic arriving at your address is routed to you; your own outbound traffic still leaves through your ISP. If you need outbound to carry your address too, that is the $20 plan, and there is no way to get it on the $10 one.
Outbound port 25 is blocked. You cannot run a mail server on a TunnelNet address today. This is our own rule rather than a limitation of our providers, and it is there because a single spam run from our range would poison the address block for every other customer on it. We would like to sell this properly one day; we are not going to sell it before we can do it safely.
Failover takes minutes, not seconds. We run hubs in two cities and traffic moves between them automatically if one fails, but recovery is dominated by your machine's WireGuard rekey, and that is measured in minutes. If your service cannot absorb a few minutes of interruption, this is the wrong product and you want something with a load balancer in front of it.
We publish no availability figure. Not 99.9%, not anything. We have not been operating long enough to have measured one honestly, and a number we had not earned would tell you less than this paragraph does. When we have enough history to state a real one, we will state it and show the working.
This is not a VPN and we do not sell anonymity. The address is permanently, deliberately attributable to you — that is what makes it useful to a vendor allowlist and what makes it the opposite of a proxy service. If what you want is to hide where you are coming from, buy something else.
We are not an ISP and we do not sell internet access. You bring the connection and the hardware; we bring the address.
Before you buy, check you need this
There is a real chance a free tool fits your case better, and we would rather you found that out here than after a month of paying us.
If your service is HTTP and a hostname on your own domain is what people will type, Cloudflare Tunnel is free and better than us at that job — your certificate, DDoS absorption, and an identity layer we do not offer.
If the machines that need to reach your server are your own, a private mesh exposes nothing to the internet at all and is free at personal scale. That is a stronger security position than any public address, ours included.
If your address changes but the internet can already reach you, dynamic DNS solves that for nothing, and so might a phone call to your ISP.
If you are prototyping and need a URL for an afternoon, ngrok is faster than anything else including us.
Buy an address when something on the other side needs an address rather than a name: a vendor allowlist, a corporate firewall, reverse DNS, a protocol that is not HTTP, or a game server whose players connect directly. That is the case we are built for, and if you are stuck behind CGNAT, this explains why nothing else you have tried worked.
Getting started
Create an account, add a machine, and copy the enrolment token. On the machine, run one command — on Linux that is curl -fsSL https://tunnelnet.io/install.sh | sudo bash -s -- <your-token>, with an equivalent for macOS and Windows. Enrolment takes about a minute: the installer generates a WireGuard key, asks us for addresses, writes the tunnel configuration and brings it up, then waits for both hubs to add your device.
After that, sudo tnet status tells you whether the tunnel is up and how much has crossed it, and sudo tnet ports allow tcp 443 opens a port. If you uninstall, use the uninstaller rather than deleting the config by hand — it releases the address back to the pool.
Create an account, or read the documentation first. Questions go to support@minakilabs.com and we reply within one business day.