remotehost

How remotehost works

Your machine opens the connection, not the internet. rh dials out to remotehost on port 443 and keeps that tunnel open. Requests to your URL come down it, so nothing at home is exposed and no router needs changing.

The internet
Visitor
browser, webhook, API client
remotehost
HTTPS edge
myapp.t.onio.in
Gate: online, within plan, allowed
Your machine
rh
$ rh http 3000
connecting…tunnel active ✓
Your machine
Your app
localhost:3000
  1. rh opens an encrypted tunnel to remotehost, outbound on port 443. Nothing at home is opened.
  2. A visitor opens https://myapp.t.onio.in.
  3. The gate checks: is the tunnel online, within its plan, and is this visitor allowed?
  4. The request goes down the tunnel to rh.
  5. rh hands it to your app on localhost:3000.
  6. Your app answers. The response goes back up the tunnel.
  7. The visitor gets the page over HTTPS, with a valid certificate.

What each part does

rh, on your machine

Starts the official, unmodified frp client and points it at your port. Connects out over encrypted WebSocket on port 443, which almost every network allows. Reconnects by itself and keeps the same URL for 10 minutes after a restart.

HTTPS edge

Answers https://<name>.t.onio.in with a valid certificate. Your app can speak plain HTTP: TLS ends here. WebSockets and streamed responses pass through.

Gate

Checks every request before it reaches you: is the tunnel online, paused after reports, inside its bandwidth and session limits? Then your rules (IP allowlist, basic auth, paid plans) and, on Free, the warning page on a browser's first visit.

Tunnel server

frp on our side. Finds your tunnel by its name and sends the request down it. It also signs clients in with your rh_ token and counts the bytes for your plan.

Your app

Gets an ordinary HTTP request on localhost. The visitor's address is in X-Forwarded-For, the original host in X-Forwarded-Host.

What you see

$ rh http 3000
remotehost: https://demo.t.onio.in → http://127.0.0.1:3000
Press Ctrl+C to stop.
# from anywhere (this one is live: try it)
$ curl -i https://demo.t.onio.in/
HTTP/2 200
content-type: text/html
<title>Hello from a remotehost tunnel</title> …

The full diagram

Every step of one request, in order. Scroll sideways on a small screen.

Sequence diagram: rh opens the tunnel; a visitor's GET reaches the HTTPS edge; the gate allows it; the tunnel server sends it down the tunnel to rh; rh calls your app on localhost:3000; the 200 OK goes back up the tunnel to the visitor.

The parts and how they connect

Architecture: the visitor on the internet, the HTTPS edge, gate and tunnel server at remotehost, and rh with your app on your machine, joined by an outbound encrypted tunnel.

Diagrams drawn with PR Lens.

Get started free Read the docs