Open-source private mesh networking. Connect machines into one encrypted network - then SSH, serve internal apps, publish public tunnels, transfer files, and wire Kubernetes into the same fabric. One identity. One policy engine. One stack you can fully self-host.
Commercial mesh products are excellent but most of them keep the coordination server closed. Tunnet ships the agent, control plane, management API, dashboard, and relays in this repository. You can read every line, self-host everything, and never depend on a proprietary coordination service or a lagging third-party reimplementation.
You also get more than a VPN. Instead of stitching Tailscale + ngrok + scp + a bastion, Tunnet puts mesh, public tunnels, internal services, file transfer, identity SSH, device posture, and Kubernetes under one identity and one ACL system.
| Capability | What it replaces | Docs |
|---|---|---|
| Mesh network | Tailscale, NetBird, Cloudflare WARP | Mesh |
| Serve | Cloudflare Access / Tailscale Serve | Serve |
| Tunnel | ngrok, Cloudflare Tunnel | Tunnel |
| Send | Taildrop / ad-hoc file hops | Send |
| SSH | Key distribution + bastions | SSH |
| Device posture | MDM / EDR policy gates | Posture |
| Self-hosted relay | Vendor edge networks | Relay |
| Kubernetes operator | Custom VPN + Ingress glue | Kubernetes |
| Policy as Code | HuJSON ACLs + ad-hoc GitOps | Policy as Code |
| Audit logs | SIEM-only or closed admin trails | Audit Logs |
| Node / Rust / Go SDKs | Embedding tunnels + management API | SDK |
Each enrolled machine gets an overlay IP and a hostname. Ordinary tools (ping, curl, ssh, browsers) just work. PeerDNS, subnet routes, exit nodes, and HA gateways are built in.
The Tunnet Operator connects a cluster to your network with CRDs: advertise cluster CIDRs, publish Services to peers (TunnetIngress), expose public HTTPS (TunnetTunnel), reach mesh hosts from inside the cluster (TunnetEgress), and optionally inject sidecars. Same Serve/Tunnel products you already use - native to Kubernetes.