Month: August 2026

If you run a homelab, you’ve inevitably run into the absolute nightmare that is CGNAT (Carrier-Grade NAT) or strict corporate firewalls. You have a server at home that you want to SSH into, but your ISP doesn’t give you a public IP address. Or maybe you’re at a coffee shop or behind a strict corporate firewall that blocks all outbound SSH connections.

Traditionally, the solutions are:

1. Dynamic DNS and Port Forwarding: Useless if you’re behind CGNAT.
2. Reverse SSH Tunnels / VPS: Requires renting a $5/month VPS and managing keys and infrastructure.
3. Tailscale / ZeroTier: Excellent solutions, but they require installing kernel modules, managing accounts, and trusting a third-party control plane.

What if there was a completely decentralised, free, open-source network of relays already spanning the globe that we could hijack to establish direct, multiplexed, end-to-end encrypted tunnels between any two machines without any accounts or infrastructure?

Enter syncthing-socket and the Syncthing global relay network.

The Syncthing Relay Network

Syncthing is an incredible peer-to-peer file synchronisation tool. To ensure files sync even when both devices are behind strict NATs, the Syncthing community operates a global network of public relays and discovery servers.

These servers are completely open and decentralised. They don’t care what data is being transmitted—they just facilitate STUN/TURN WebRTC connections to punch through NATs.

I vibe-coded syncthing-socket as a standalone, lightweight Go daemon that securely hijacks this exact network to pipe raw TCP sockets, PTY shells, and HTTP proxies!

How syncthing-socket Works

Under the hood, syncthing-socket imports the official Syncthing protocol libraries but throws away the file-syncing logic. Instead, it uses the peer-to-peer WebRTC connection to multiplex raw byte streams using Yamux.

When you start the server, it deterministically generates a Syncthing Device ID from a passphrase and connects to the global relay pool:

$ ./syncthing-socket server --passphrase "my-super-secret" --forward 127.0.0.1:22

This server is now securely listening on the decentralised Syncthing network. The discovery servers know how to route to it, but nobody can connect unless they have the mathematically paired client passphrase.

From anywhere in the world, on any network, you run:

$ ssh -o ProxyCommand="./syncthing-socket client --passphrase 'my-super-secret'" user@ignored_host

syncthing-socket will instantly negotiate a WebRTC STUN/TURN connection via the nearest public relay, establish a direct end-to-end encrypted P2P tunnel, and pipe your SSH connection perfectly through it. If a direct P2P connection isn’t possible, it gracefully falls back to using the relay server as a TURN proxy.

Beyond SSH: SOCKS5 and PTY Shells

Because we established a fully multiplexed Yamux tunnel over WebRTC, we can do much more than just pipe a single TCP socket.

Native PTY Shells:
You can completely drop sshd and use syncthing-socket natively!

# Server
./syncthing-socket server --passphrase "my-secret" --shell

# Client
./syncthing-socket client --passphrase "my-secret" --shell

This spawns a remote bash session and pipes your raw local terminal directly into it. It natively supports tab-completion, vim, htop, and even transmits window resizing events (SIGWINCH) over a dedicated control stream so the remote UI always perfectly fits your screen.

Remote SOCKS5 Proxy:
Want to browse the web through your homelab’s internet connection securely?

# Server
./syncthing-socket server --passphrase "my-secret" --socks

# Client
./syncthing-socket client --passphrase "my-secret" --socks 127.0.0.1:1080

Just point your browser to socks5://127.0.0.1:1080 and you’re fully proxying your web traffic over an encrypted, decentralised P2P tunnel.

Conclusion

By standing on the shoulders of the incredible Syncthing project, syncthing-socket provides a zero-config, zero-infrastructure, completely decentralised way to punch through CGNATs and firewalls.

Similar Projects

While syncthing-socket fills a specific niche, it’s worth mentioning similar tools in this space. For raw socket routing, there’s gsocket and its clone minisocket. If you just want to share a terminal, tmate (though largely defunct) was a pioneer. For full remote desktop access, solutions like RustDesk, AnyDesk, and TeamViewer exist. In terms of underlying architecture, Magic-Wormhole uses a very similar P2P approach (with a modern Rust replacement being Iroh).

Check out the code on GitHub and take back control of your homelab connectivity!