What tunnelling is actually for

You build a small storage server at home, go to the office, try to reach it, and nothing answers. You run a payment callback endpoint on your laptop and the provider's test call never arrives. You want to host a multiplayer session for friends and discover that every one of you is behind a private address. The underlying problem is identical in all three cases: your machine has no public address, so a request from outside has nowhere to be delivered.

The traditional fix is three steps that stop most people at the first one. Get a public address, configure port forwarding on the router, set up dynamic DNS. Plenty of carriers will not hand out a public address at all any more. A tunnelling service exists to go around that pile: a relay server holds the public side, and requests are carried inward to your machine over a connection your machine opened itself.

Four steps and no router login

The setup is deliberately short. Install the client, create an account, add one mapping that connects a port on the internal machine to a hostname on the outside, and you are done. Nothing in that sequence requires the router's administrative page or a call to the carrier, which is the whole point: the people who need this are usually the ones who cannot get the router page or the carrier's cooperation.

Both TCP and UDP are carried, and that breadth is what makes it useful rather than a web-only trick. A web service, a remote desktop session, an FTP server, a game server and an MQTT broker for a sensor network all work, because the protocol underneath does not care what the bytes represent.

Every mapped hostname also comes with an HTTPS certificate issued automatically. For a developer this removes a specific and familiar irritation: payment providers and identity providers require a callback over HTTPS, and testing one locally used to mean generating a self-signed certificate and then persuading a third party to trust it, which is impossible. Here the callback has a real certificate from the first minute.

Platforms and the situations it fits

The client covers the three desktop systems, and it can also be installed directly on a router, which means the tunnel terminates at the edge of the network rather than on one machine inside it. That single option covers a lot of ground: everything behind the router becomes reachable without a client running anywhere.

The uses people actually bring are consistent. Reaching internal business systems such as an ERP or an office suite from outside. Testing payment and identity callbacks that insist on HTTPS. Getting to a home or office storage appliance while travelling. Hosting a multiplayer session without a rented server. Pulling sensor data back from devices in the field. The operator reports roughly a couple of million users and tens of thousands of businesses, and the relay side runs on a multi-line backbone arrangement rather than a single route.

Free tier, paid tier

The free tier gives one tunnel and one port, with enough bandwidth for daily testing and temporary access, which is a fair description of what a person needs to try an idea. The paid tiers are aimed at things that have to stay up: internal company systems, released projects, latency-sensitive multiplayer sessions. More bandwidth, steadier service, and a vendor claim of availability in the financial-services range with a relay that has been running for several years without a stop. A lifetime option exists for people who would rather not renew annually.

There is one situation where this is not the right answer, and it is worth saying plainly. If you already have a public address, or you are comfortable running a self-hosted tunnelling daemon on a cheap server, then a managed service is a monthly cost for something you can operate yourself. What the managed version sells is not the tunnel; it is the absence of the server, the reverse proxy configuration and the certificate renewals.

The whole idea is that tunnelling becomes something you buy instead of something you maintain. No relay to patch, no proxy configuration to write, no certificate to chase. For an individual developer or a small team, the hours that saves are worth more than the fee, and the first of those hours starts the moment the client finishes installing.