Tunnel topology at a glance
The agent initiates an outbound connection — no inbound firewall rules, ever.
Key insight: The agent connects outbound to the server — your LAN firewall stays completely closed.
Why choose Proxera
Everything you need to securely expose private services — and nothing you don’t.
Zero Inbound Ports
Agents connect outbound only. Your LAN firewall stays closed — no pinhole rules, no DMZ headaches, no VPN overhead.
Multi-Domain Routing
Route multiple public domains and path prefixes to different internal services through a single persistent agent connection.
Live Topology & Logs
Real-time agent topology view and route-level request logs give full visibility into tunnel traffic and connected agents.
Kubernetes & Docker Ready
Deploy with Helm, Docker Compose, or bare metal. Official Helm charts for both server and agent components.
Token-Based Registration
Create agents and issue one-time registration tokens from the admin UI. Tokens consumed on first connect for controlled onboarding.
Horizontal Scaling
Scale with Redis Pub/Sub in multi-pod mode, or run in-memory messaging for simple single-pod deployments.
Ingress Resource Management
Create and manage Kubernetes Ingress resources directly from the admin UI — map public routes to cluster services without manually editing manifests.
Home Assistant Add-on
Run the Proxera agent as a native Home Assistant add-on — install from the add-on store, configure your server URL and API key, and securely expose your HA instance without any port forwarding.
Built secure by design
Security and operational control are first-class concerns, not afterthoughts.
Token-based agent registration
Admins create named agents and issue one-time registration tokens. Tokens are consumed at first connect for controlled, auditable onboarding.
Route-level request visibility
Inspect route logs and active requests in near real-time to understand traffic patterns and troubleshoot routing issues quickly.
Horizontal scale support
Use Redis Pub/Sub in multi-pod mode, or run in-memory messaging for small single-pod deployments without extra infrastructure.
Private-network first model
Proxera agents initiate outbound connections only — minimizing attack surface and eliminating inbound pinholes entirely.
Built for your infrastructure
From home labs to production clusters — Proxera adapts to your setup.
Home Lab Access
Expose Grafana, Home Assistant, Uptime Kuma, or dashboards from your LAN over a secure tunnel — no port forwarding needed.
Secure Internal APIs
Publish selected internal APIs without opening inbound ports or placing services directly on the public edge.
Preview Environments
Route temporary domains to staging apps running inside private clusters or local developer environments.
Edge & IoT Services
Connect industrial or remote-site services back to a central Proxera deployment using outbound-only agent links.
Dev Team Tools
Share internal portals, Git mirrors, and tools across distributed teams without VPN complexity or overhead.
Zero-Inbound Enterprise
Maintain strict firewall posture while enabling public ingress for selected internal web workloads with full audit trails.
Up and running in minutes
Deploy Proxera server with Helm, connect an agent, and start routing traffic.
Deploy Proxera Server
Add the Helm repo and install with your ingress domain and admin panel config.
Create Agent & Token
Open the admin UI, create a named agent, and generate a one-time registration token.
Start Agent in Your LAN
Deploy the Proxera agent inside your private network with the server URL and token.
Add Routes & Go Live
Create route mappings in the admin UI — public domain traffic tunnels to your private service instantly.
# Add wenisch-tech Helm repo
helm repo add wenisch-tech https://charts.wenisch.tech
helm repo update
# Install Proxera server
helm install proxera wenisch-tech/proxera \
--set ingress.proxy.enabled=true \
--set ingress.proxy.hosts[0].host=myapp.proxy.example.com \
--set ingress.admin.enabled=true \
--set ingress.admin.hosts[0].host=admin.proxera.example.com \
-n proxera --create-namespace# Deploy agent inside your private network
helm upgrade --install proxera-agent wenisch-tech/proxera-agent \
--namespace proxera \
--create-namespace \
--set config.serverUrl="wss://tunnel.proxy.example.com/tunnel" \
--set secret.apiKey="<registration-token>"Want the full setup guide, API reference, and configuration options?
📄 Read the documentation →Frequently asked questions
Proxera is a self-hosted alternative with a similar operational model: outbound tunnel agents and routed traffic from public domains to private services. Unlike Cloudflare Tunnel, you retain full infrastructure ownership and routing control.
No. The Proxera agent establishes outbound WebSocket connectivity to the server and receives proxied traffic through that tunnel. Your LAN firewall stays completely closed — no inbound pinholes required.
Yes. Proxera provides Helm charts for both server and agent, supporting environments from home lab single-node clusters to production-grade Kubernetes deployments.
Admins create named agents and issue one-time registration tokens via the admin UI or API. The token is consumed on first agent connect — enforcing a controlled, auditable onboarding flow.
Yes. Proxera includes built-in Ingress resource management — you can create, update, and delete Kubernetes Ingress resources directly from the admin UI. This lets you wire up public routes to in-cluster services without leaving the Proxera interface or editing YAML manually.
The agent runs inside your private network (LAN, home lab, edge site, or private Kubernetes cluster) and opens a persistent outbound WebSocket tunnel to the Proxera server. No cloud dependencies in your private network.
Start tunneling today — for free
Proxera is open-source and fully self-hosted. No cloud account, no per-tunnel fees, no vendor lock-in.