No inbound ports. No firewall changes.

Outbound-only by design

Most ways of exposing a local service ask you to open a port, forward it through your router, or poke a hole in a firewall — each one a new way in for everyone else, too. tropa doesn't. The agent makes a single outbound connection to the relay and everything rides back down that one tunnel. There is nothing to port-forward, no inbound firewall rule, and no NAT configuration.

Your machine stays invisible. Because it never listens for inbound connections, there's no open port for anyone to find or scan. The only path to your service is the encrypted tunnel it opened — and you control who reaches it, with passwords, IP allowlists, and rate limits enforced at the relay.

Why this matters

Works behind anything. Corporate firewalls, university networks, home routers, and carrier-grade NAT all allow outbound HTTPS — so tropa works from all of them without asking IT for a thing.
Smaller attack surface. No listening port means no port to exploit, brute-force, or accidentally expose. The service is unreachable except through the tunnel and the access rules you set.
Nothing to maintain. No dynamic-DNS, no router config that breaks when your IP changes, no VPN client for the people you share with — just a URL.

How it works

The agent runs next to your service and dials the relay over an encrypted, multiplexed connection. Public requests arrive at the relay, which routes them by hostname down that connection to the agent, which hands them to your local service and streams the reply back. All of it over a connection your machine initiated outbound — the same kind your browser makes to load any website.

Prefer to run the whole thing yourself? The agent and relay are open source and ship in the same binary, so you can host the relay on your own VPS and keep every byte on infrastructure you control. Get the binary →