Private Networks and Tunnels

Backhaul

Installs the pinned Backhaul release, writes /etc/backhaul/config.toml (mode 640) for the chosen role and transport and runs it as a sandboxed systemd service. The server role opens the tunnel port and the service port in ufw when ufw is active. Safe to run again.

What it does

Private Network and Tunnel Installers

What you will be asked

You fill these in during setup.

Role of this server Required
server: this server has the public address and listens for the client. client: this server delivers a local service to the server.
Transport Required
tcp is the simplest. tcpmux carries many connections over one. ws and wsmux look like WebSocket traffic and can pass through a CDN. Must be the same on both sides.
Shared token Required
A secret both sides must know (16 to 64 letters and digits). Choose it on the server and enter the same value on the client.
Tunnel port Required
The port the server listens on for the client connection. Must be the same on both sides.
Service port Required
The public port on the server that is forwarded to the same port on the client. Give it on the server role; the client role ignores it.
Server address (client role only) Optional
The public IP address or domain of the server side. Leave empty for the server role.