CHAN.RUN

Products
Restunnel
Guide
Quick start

Server (Hub)

Server (Hub)

The hub runs on a server with a static public IP — Hetzner, AWS, DigitalOcean, any VPS. It provides a local proxy for your software and manages encrypted tunnels to your exit nodes.

Install

curl -fsSL https://raw.githubusercontent.com/zerocity/tunnel.chan.run/main/install-hub.sh | sh

This installs restunnel-hub to ~/.local/bin. Override with INSTALL_DIR:

INSTALL_DIR=/usr/local/bin curl -fsSL https://raw.githubusercontent.com/zerocity/tunnel.chan.run/main/install-hub.sh | sh

:::tip Private repo? Set a token first: export GITHUB_TOKEN=ghp_..., then run the install command. :::

The install script also offers to set up a systemd service — run it interactively for the prompt:

sh install-hub.sh

Start the Hub

restunnel-hub --listen 0.0.0.0:9000 --host <your-public-ip>:9000
  • --listen — Bind address for the tunnel endpoint (default 0.0.0.0:9000)
  • --host — Public address exit nodes use to reach the hub. Required — this goes into enrollment URLs and QR codes.
  • --socks5-listen — SOCKS5 proxy bind address (default 127.0.0.1:1080)
  • --http-listen — HTTP CONNECT proxy bind address (default 127.0.0.1:1081)
  • --dashboard-listen — Dashboard bind address (default 127.0.0.1:8080)
  • --data-dir — Persistent state directory (default data/, systemd uses /var/lib/restunnel)

On first startup with no enrolled nodes, the hub auto-generates an enrollment token and prints a scannable QR code.

Generate Pairing Tokens

# Generate a token with a label (the label is assigned to whatever node enrolls with it)
restunnel-hub --data-dir /var/lib/restunnel token --host <your-public-ip>:9000 --label exit-bangkok

This prints a noise:// enrollment URL. Use it to pair an exit node via QR code, CLI, or desktop app.

Tokens expire after 15 minutes and burn after first use.

Configure Your Software

Point your tools at the local proxy:

export ALL_PROXY=socks5://localhost:1080

Or per-command:

curl --proxy socks5://localhost:1080 https://httpbin.org/ip

This works with any tool that supports SOCKS5 or HTTP CONNECT: curl, Playwright, Puppeteer, Python requests, and more. See Proxy Config for tool-specific examples.

Access the Dashboard

The dashboard binds to localhost only. Access it via SSH tunnel:

ssh -L 8080:127.0.0.1:8080 user@your-server

Then open http://localhost:8080 in your browser. From here you can manage nodes, generate QR codes, and revoke access. See Dashboard for details.