9ae62e2c · samitouri/QOSAMI-X402Tunnel

@@ -4,18 +4,17 @@

4

5 <img width="800" alt="Portal Demo" src="./portal.gif" />

6

7 -Expose your local application to the public internet - no port forwarding, no NAT, no DNS setup. Portal is a trustless relay network where relays cannot access your traffic. Connect to any relay or run your own.

7 +Expose your local application to the public internet - no port forwarding, no NAT, no DNS setup. Portal is a trustless relay network where relays cannot access your traffic. Connect to any relay or chain several for better anonymity.

8

9 ## Features

10

11 -- **Public HTTPS for localhost**: NAT-friendly publishing via TCP passthrough (no port forwarding)

12 -- **End-to-end TLS**: TLS terminates on your side with built-in MITM detection, so relays cannot access plaintext

13 -- **One-command setup**: Start relays and tunnels with minimal setup

14 -- **Self-hosted relays**: Connect to public relays or run your own

15 -- **Relay discovery and pools**: Use discovered relays as a pool, with multi-relay access and failover

11 +- **Public HTTPS for localhost**: NAT-friendly publishing via TCP passthrough

12 +- **End-to-end TLS**: TLS terminates on the client, relays can`t access plaintext or session keys

13 +- **Relay discovery pools**: Choose multiple discovered relays as a flexible connection pool

14 +- **Multi-hop relay routing**: Improve anonymity by splitting the traffic path across multiple relays

15 +- **Self-hosted relays**: Run your own relay or connect to public relays

16 - **No login, no API keys**: Authenticate ownership using SIWE, with ENS-based identity support

17 -- **Raw TCP/UDP + TCP port routing**: Native TCP reverse sessions, optional UDP, and dedicated TCP ports for non-TLS services

18 -- **Auto-generated thumbnails**: Optional headless screenshot sidecar generates dashboard card previews for tunnel apps

17 +- **Raw TCP/UDP routing**: Native TCP reverse sessions, optional UDP, and dedicated TCP ports for non-TLS services

18

19 ## Comparison

20

@@ -25,7 +24,8 @@

25 | MITM detection | **Built-in** | No | No | No |

26 | Self-hostable | **Yes** | Enterprise only | No | Yes |

28 -| Multi-relay failover | **Yes** | Managed | Built-in multi-DC | No |

27 +| multi-relay failover | **Yes** | Managed | Built-in multi-DC | No |

28 +| multi-hop routing | **Yes** | No | No | No |

29 | Custom domain | **Yes** | Paid plans | Yes | Yes |

31 | Non-TLS TCP port routing | **Yes** | Paid plans | No | Yes |

@@ -98,6 +98,20 @@ Portal is designed so that tenant TLS terminates on your side rather than at the

98

99 Portal also checks that the relay is preserving TLS passthrough. The Portal client connects to its own public endpoint and compares TLS exporter values observed on both client-controlled ends. If they differ, `portal expose` rejects the relay by default.

100

101 +## How Portal Provides Multi-Hop Relay Routing

102 +

103 +Portal can route a tunnel through an ordered chain of relays. This splits responsibility and visibility across multiple nodes instead of relying on a single relay.

104 +

105 +1. The client selects multiple relays and forms a relay chain.

106 +2. Public traffic enters through the ingress relay, which only knows the hostname it serves.

107 +3. Each relay forwards to the next hop without learning the whole route.

108 +4. The last relay reaches your Portal client through the reverse session.

109 +5. Tenant TLS still terminates only on your side. No relay receives tenant TLS plaintext.

110 +

111 +This improves anonymity by splitting routing knowledge across independent relays while preserving Portal's end-to-end encrypted traffic model.

112 +

113 +For CLI usage, see [cmd/portal-tunnel/README.md](cmd/portal-tunnel/README.md).

114 +

115 ## Contributing

116

117 We welcome contributions from the community!

docs: update README to add multi-hop relay routing and feature descriptions