Tollan documentation#
Tollan makes a device or service on a private network reachable from the public internet — without opening a single inbound port, forwarding a port on your router, or running a VPN.
Each device runs a small agent that dials out to the Tollan relay over a mutual-TLS connection and holds it open. When someone connects to your device's public Tollan address, the relay routes the bytes back down that existing tunnel. Nothing listens for connections on your network — the door only ever opens from the inside.
Note
New to Tollan? Start with How it works for the mental model, then follow the Quickstart to expose your first device.
What you can do with it#
- Reach a NAS, camera, printer, PLC, or home server behind NAT or a carrier-grade firewall.
- Put a public HTTPS endpoint in front of a service that has no public IP.
- Connect an ESP32 / microcontroller directly to the tunnel with the TollanAgent library — no gateway box required.
- Manage a fleet of devices, routes, and certificates from one console, with team roles and per-plan limits.
Pick your path#
How it works →
The relay, the agent, and the tunnel — the architecture in one page.
Quickstart →
Register a device, install the agent, and expose a service end to end.
ESP32 library →
Put an outbound tunnel on a microcontroller in a handful of lines.
Routes & exposure →
Expose internal targets at a public hostname or port.
Security model →
mTLS identity, certificate lifecycle, and zero-knowledge passthrough.
Self-hosting →
Run the control plane and relay on your own infrastructure.
The pieces at a glance#
| Piece | What it is | Where it runs |
|---|---|---|
| Agent | Outbound tunnel client. Ships as a Go binary, or the C++ TollanAgent library for ESP32. | On or beside your device |
| Relay | Public-facing byte pump. Accepts inbound connections and demuxes them to the right device. | Tollan (or your own host) |
| Control plane | The API + console. Manages devices, routes, certificates, teams, and billing. | Tollan (or your own host) |
| Console | The web dashboard you use day to day. | app.tollan.ie |
Everything is driven by the console (or its API). You never edit relay config by hand — you create a device, attach a route, and the change propagates to the relay automatically.
Ready? Head to How it works.