FAQ#

What exactly is Tollan?#

A reverse-tunnel platform. A small agent on your device dials out to a relay and holds the connection open; the relay makes your device reachable at a public address and routes inbound traffic back down that tunnel. You get public access to a private service without opening inbound ports, forwarding router ports, or running a VPN. See How it works.

How is this different from a VPN?#

A VPN puts you on the network. Tollan exposes one service at a public address, with per-route access control and no client software for the people connecting to it. It's closer to a reverse proxy for services that have no public IP than to a network-wide tunnel.

Do I need to open any ports?#

No. That's the point. The device only makes an outbound connection to the relay, so it works behind NAT, CGNAT, and strict firewalls with no inbound rules.

Does the relay see my traffic?#

For hostname (SNI) routes, no — the relay routes on the TLS SNI and forwards the encrypted stream untouched (zero-knowledge passthrough). It only sees plaintext if you deliberately choose terminate mode for a route. See Security.

What can run the agent?#

• Linux, macOS, Windows — the Go agent, installed from a device bundle.
• ESP32 / Arduino — the TollanAgent library, for boards too small for the Go binary.

Both speak the identical wire protocol.

Can one device expose several services?#

Yes. Add multiple routes to a device. In forwarding mode a single agent can also proxy several other hosts on its LAN (a printer, a NAS, a camera) — each as its own route with its own internal target.

How are devices authenticated?#

Mutual TLS. Each device has a client certificate issued by Tollan's CA; the relay verifies it and the device pins the relay's certificate. Certificates are short-lived, auto-renewing, rotatable, and revocable. See Security.

My ESP32 won't connect. Where do I start?#

Almost always the TLS version or the clock on first bring-up:

• Relay defaults to TLS 1.3; many ESP32 cores only do TLS 1.2 → set RELAY_ALLOW_TLS12=true on the relay.
• A fresh board boots near 1970, which breaks certificate date checks → the agent SNTP-syncs the clock automatically, but it needs a reachable NTP server.

Full table in ESP32 troubleshooting.

Can I use my own domain?#

Yes, on paid plans. Attach a custom domain, point DNS at the relay, and Tollan obtains and renews the TLS certificate automatically.

What happens if my subscription lapses?#

If billing goes past_due, the relay stops pumping your org's traffic until payment is resolved — tunnels stay connected but carry no data. Nothing is deleted, and service resumes automatically once you're current. See dunning.

Can I self-host it?#

Yes. Run the control plane and relay on your own infrastructure, either all-in-one (staging) or split across hosts (production). See Self-hosting.

Is there an API?#

Yes — the console is a client of a REST API at api.tollan.ie. Everything you do in the UI (devices, routes, certificates, bundles, access rules, billing) is available as an endpoint. The internal relay↔control-plane API is separate and service-token authenticated.

Where do I get help?#

Email the address in the footer of this page. If you self-host, the deployment runbooks that ship with your deployment cover the operational detail.