CHAN.RUN

Restunnel
Quick Start

Server (Hub)

The hub runs on a server with a static public IP — Hetzner, AWS, DigitalOcean, any VPS. It provides a local proxy for your software and manages encrypted tunnels to your exit nodes.

Install

curl -fsSL https://raw.githubusercontent.com/zerocity/tunnel.chan.run/main/install-hub.sh | sh

This installs restunnel-hub to ~/.local/bin. Override with INSTALL_DIR:

INSTALL_DIR=/usr/local/bin curl -fsSL https://raw.githubusercontent.com/zerocity/tunnel.chan.run/main/install-hub.sh | sh

:::tip Private repo? Set a token first: export GITHUB_TOKEN=ghp_..., then run the install command. :::

Start the Hub

restunnel-hub --listen 0.0.0.0:9000 --host <your-public-ip>:9000
  • --listen — Bind address for the tunnel endpoint (default 0.0.0.0:9000)
  • --host — Public address exit nodes use to reach the hub. Required — this goes into enrollment URLs and QR codes.
  • --socks5-listen — SOCKS5 proxy bind address (default 127.0.0.1:1080)
  • --http-listen — HTTP CONNECT proxy bind address (default 127.0.0.1:1081)
  • --dashboard-listen — Dashboard bind address (default 127.0.0.1:8080)
  • --data-dir — Persistent state directory (default data/, systemd uses /var/lib/restunnel)

On first startup with no enrolled nodes, the hub auto-generates an enrollment token and prints a scannable QR code.

Generate Pairing Tokens

restunnel-hub --data-dir /var/lib/restunnel token --host <your-public-ip>:9000 --label exit-bangkok

This prints a noise:// enrollment URL. The --label is assigned to whatever node enrolls with it.

Use it to pair an exit node. Tokens expire after 15 minutes and burn after first use.

Connect an Exit Node

Before traffic can flow, at least one exit node must be connected. Pair a device now:

See Exit Nodes for platform-specific setup (Android, macOS, CLI).

Verify It Works

Once an exit node is connected, test that traffic routes through it:

# Direct from server — shows the datacenter IP
curl https://httpbin.org/ip

# Through Restunnel — shows the exit node's residential IP
curl --proxy socks5://localhost:1080 https://httpbin.org/ip

If both return the same IP, the proxy isn't routing through the exit node. Check that:

  1. The exit node is connected (check hub logs or the dashboard)
  2. You're using the correct proxy port (:1080 for SOCKS5, :1081 for HTTP CONNECT)

Configure Your Software

Point your tools at the local proxy:

export ALL_PROXY=socks5://localhost:1080

Or per-command:

curl --proxy socks5://localhost:1080 https://httpbin.org/ip

Works with any tool that supports SOCKS5 or HTTP CONNECT. See Proxy Configuration for Playwright, Puppeteer, Python, and more.

Run as a Service

For production use, run the hub as a systemd service:

# /etc/systemd/system/restunnel-hub.service
[Unit]
Description=Restunnel Hub
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/restunnel-hub --listen 0.0.0.0:9000 --host <your-public-ip>:9000 --data-dir /var/lib/restunnel
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
sudo systemctl enable --now restunnel-hub

The install script can also set this up interactively — run sh install-hub.sh without piping.

Dashboard

The hub includes a web dashboard for managing nodes and generating QR codes. It binds to localhost only — access it via SSH tunnel:

ssh -L 8080:127.0.0.1:8080 user@your-server

Then open http://localhost:8080 in your browser. See Dashboard for details.