Make any host reachable, even with no public IP

An outbound-only tunnel, nothing to configure on your router

ephemnet-agent dials out to the relay over TLS — it looks like a normal outbound HTTPS connection, so it passes through home firewalls and NAT without any port-forwarding or router configuration. Once registered, every inbound connection for your domain gets multiplexed over that one connection and forwarded to a local port you choose.

Download

One command downloads, verifies, and installs the right build for your platform — re-run it any time to update.

Linux / macOS

Windows (PowerShell)

See install.sh / install.ps1 for every override (pinning a version, install dir, a dev-site base URL). The Windows script asks its questions (where to install, whether to start at login) with native dialogs instead of a terminal prompt, and sets up a per-user Startup entry rather than a Windows service — no admin elevation needed either way.

Android

EphemNet Admin manages your agents and domains from your phone — same no-tracking, one-permission, open-source app described on its own page. Not on the Play Store yet; a direct APK download in the meantime.

ephemnet-agent binaries, every platform

Platform	Download	SHA-256
Linux (amd64)	release builds coming soon
Linux (arm64)	release builds coming soon
Linux (32-bit)	release builds coming soon
macOS (Apple Silicon)	release builds coming soon
macOS (Intel)	release builds coming soon
Windows (amd64)	release builds coming soon
Windows (32-bit)	release builds coming soon

Show checksums

Show all versions

Version	Platform	Download

Point it at your domain

Once you have a domain in relay mode and its token:

ephemnet-agent \
  -relay-addr mera.network:443 \
  -domain yourhost.example.com \
  -token <your domain's relay token> \
  -local-addr 127.0.0.1:443

Add -status-addr 127.0.0.1:8093 to also run the local admin page described below — see ephemnet-agent -h for every flag, or just run the installer above, which asks for this and sets it up for you.

Accessing the admin page

Every running ephemnet-agent can serve a small, read-only-by-default status page over plain HTTP, on whatever address you pass to -status-addr — nothing is exposed unless you set this flag. The installer above asks for one and defaults to 127.0.0.1:8093, and (on Linux and macOS) offers to create a real desktop shortcut straight to it.

Once it's running, reach it one of these ways:

• On the same machine: open http://127.0.0.1:8093/ in a browser — or just double-click the desktop shortcut the installer offered to create.
• From another machine (e.g. you SSH into this host): -status-addr is deliberately loopback-only by default, so tunnel it over SSH instead of binding it to a public address:

  ssh -L 8093:127.0.0.1:8093 you@your-host

  then open http://127.0.0.1:8093/ on your machine, same as above. This keeps the admin page off the public internet even though you're reaching it remotely.
• No shortcut yet (manual install, or on a headless box you only reach by SSH): the two methods above are the whole mechanism — the shortcut the installer creates is nothing more than one of these opened automatically.
• From a phone, with no SSH access at all: add a free subdomain route (Subdomains tab, needs allow_subdomains on a domain you already own) pointed at 127.0.0.1:8093 itself, with "Terminate TLS here" checked and a password set. That subdomain becomes a real, independently-encrypted HTTPS URL to this exact admin page, reachable from anywhere — on purpose, this is the one way to deliberately give up the loopback/SSH-tunnel-only guarantee the other two methods rely on, so only do this with a real password set; see the Subdomains tab's own tip for the exact steps.

What's on the page:

• Connection state to the relay, uptime, and bytes transferred per route.
• Relay-overage status — whether a domain is currently throttled to modem speed or cut off for being over its relay allowance, plus the real usage/allowance figures behind that.
• Add, edit, or remove routes and wildcard-subdomain rules at runtime, without restarting the agent (persisted across restarts to a local state file).
• A banner when a newer ephemnet-agent version is available (never auto-installed — re-run install.sh by hand to actually update).

Set -status-auth-token <secret> (HTTP Basic Auth, any username, this as the password) once this page might be reachable by more than one trusted operator — it can mutate routes, not just read status. Defense in depth on top of keeping -status-addr loopback-only, not a replacement for it.

Common issues

The admin page shortcut doesn't open anything / "connection refused." The agent process itself isn't running, or wasn't started with -status-addr set. If you set it up as a boot-start service, check it's actually active (systemctl --user status ephemnet-agent on Linux, launchctl list | grep ephemnet-agent on macOS) — the shortcut only opens a browser tab, it never starts the agent itself.

My domain isn't reachable even though the agent shows "connected." Check -local-addr actually points at something listening on this machine, and that the domain's own token matches what the relay has on file for it — the status page's per-route view shows exactly which route is failing and why.

Traffic is slow / the status page shows "throttled." The domain is over its relay allowance and within its 7-day grace window — every connection still gets through, just rate-limited, until a top-up or renewal lifts it (or the window ends and it's refused outright). Top up or renew via the owner portal.

The boot-start service won't survive a reboot (Linux, no root). A per-user systemctl --user service needs loginctl enable-linger <you> — the installer attempts this automatically and tells you if it couldn't (needs a password it can't supply non-interactively).

Anything else: re-run the installer (safe any time, it only ever reinstalls the binary and re-asks setup questions — it never touches an existing config file), or inspect ephemnet-agent -h for the full flag reference.