GitHub
Meet WireRiftA small binary. A direct connection. Your infrastructure.InstallationNative binaries for your machine. No runtime to manage.Run your own serverThe public edge belongs to you.HTTP & WebSocket tunnelsShare web apps, receive webhooks, and keep WebSockets connected.TCP tunnelsA path for the protocols beyond HTTP.Security & accessLayer access controls around what you share.Traffic inspectorSee the request. Understand the response. Try it again.Under the wireOne connection. Many independent streams.Dashboard APIYour tunnels and traffic, programmatically.ConfigurationKeep your connections together in a readable config file.Docker deploymentGive your public edge a reproducible home.Local HTTPS developmentA trusted development edge, without a public domain.TroubleshootingGet back to a working connection.
Documentation, without the detour.ESC to close
Browse documentation
DOCUMENTATION / TUNNELS

TCP tunnels

A path for the protocols beyond HTTP.

Forward a raw TCP service

Expose a local database, game server or SSH service with a TCP tunnel. The server allocates a public port and prints the address to use.

terminal
wirerift tcp 5432 --server tunnel.example.com:4443 --token YOUR_TOKEN

Reserve the public port range

Open only the TCP ports you intend to allocate. Configure the server range with --tcp-ports, and mirror that choice in your firewall or container port mapping.

terminal
wirerift-server --token YOUR_TOKEN \
  --domain tunnel.example.com --tcp-ports 20000-20099

Restrict who can connect

Use an IP whitelist for raw TCP services. Basic Auth is an HTTP mechanism and does not authenticate a database or SSH protocol. Keep the native authentication of your service enabled.

terminal
wirerift tcp 5432 --whitelist "203.0.113.50,10.0.0.0/8" \
  --server tunnel.example.com:4443 --token YOUR_TOKEN

Based on the upstream WireRift reference . Check the source for the latest options.

PreviousHTTP & WebSocket tunnelsUp nextSecurity & access