Free while we’re in preview

Get OpsTunnel

One agreed TCP hop for the team, with a record of who used it and for how long.

The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.

One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.

Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.

One file — no installer
Reaches only what you point it at
Source code published below

Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, OpsTunnel is included in every plan along with the rest of the range.

Read the warning before the features

opstunnel forwards plain TCP. It encrypts nothing and authenticates nobody. No password, no key, no certificate, no handshake. --allow filters by CIDR, and an IP address is not an identity.

So run it on a network you already trust, or inside something that provides the confidentiality for you: an SSH tunnel, a WireGuard link, a private subnet. It is not a substitute for TLS and won’t become one.

Why it exists anyway

Moving bytes is the easy half. The ledger is the product. Every connection writes one fsynced JSON line: client address, target, start and end, duration, bytes in each direction, and the reason it ended. Refusals are logged too, so a client denied by --allow or turned away at --max-conns leaves a record instead of vanishing.

opstunnel status --log conns.jsonl sums that file into a per-client table, totals, the longest connection and a breakdown of how connections closed. It’s a straight sum over the file, so anyone holding the log can re-derive every number.

Both directions copy concurrently and half-close is preserved, so the usual request-then-response pattern works. SIGTERM stops accepting, drains in-flight connections for --grace, then releases the port. The log holds no payloads, but connection metadata is still worth protecting.

Reading on the job itself

How to watch a handful of servers without setting up a monitoring stack A list of host and port, checked on an interval, that stays silent until something changes state. Almost al...

The rest of Remote Ops Workspace

Machines you cannot walk over to. Watch whether they answer, record and replay a session, read your SSH config, and share one agreed hop.

RemoteDeck

Simple Ready

A watchlist of hosts that stays quiet until something actually changes state.

SessionForge

Vertical Ready

Records a command's output with exact timings and replays it at real speed.

SSHDesk

Pro Ready

Shows what ssh will actually do with your config, and why.

Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams

A working command-line build of the forwarder: concurrent TCP forwarding with per-connection byte accounting, an IP allow-list, connection limits, idle timeouts, half-close support and a graceful drain on shutdown. It carries no encryption or authentication of its own, so it belongs on a trusted network or inside a secure channel you already have; TLS and authentication are on the roadmap.

Naming status

Working name only — brand verdict **AVOID** (Very High). Collision: OpsTunnel. Rename completely.

What it draws on

Existing paid software whose best ideas shaped this program: MobaXterm Professional, SecureCRT, WinSCP Microsoft Store Edition, Remote Desktop Manager.

Command line

There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.

opstunnel 1.0.0 - plain TCP port forwarder with per-connection accounting

USAGE
    opstunnel <command> [flags]

COMMANDS
    forward   Listen locally, proxy bytes to a target, log every connection
    status    Summarise a connection log (bytes, durations, how they ended)
    check     One-shot pre-flight: can the target be reached at all?
    help      Show this help

SECURITY
    opstunnel forwards PLAIN TCP. There is NO encryption and NO authentication.
    Use it only on a trusted network or inside an existing secure channel.

EXAMPLES
    opstunnel check   --target 10.0.0.5:5432
    opstunnel forward --listen 127.0.0.1:15432 --target 10.0.0.5:5432 --log conns.jsonl
    opstunnel forward --listen 0.0.0.0:8080 --target api:80 --allow 10.0.0.0/8 --max-conns 50
    opstunnel status  --log conns.jsonl --json

Run "opstunnel <command> --help" for per-command flags.

Recorded from the shipped binary, not written by hand.

Windows (amd64) macOS (Apple Silicon) macOS (Intel) Linux (amd64)

Source

Every file the program is built from:

console.go · console_test.go · guided.go · main.go

SHA-256 checksums · build instructions & scope notes · full build plan

OpsTunnel

Preview