Tunnel — WireCanal

An HTTPS address for your localhost

WireCanal assigns a public address like https://<your-name>.ja001.wirecanal.com to a web server on your machine or inside your company — in tens of seconds. Without opening a single inbound port, certificates are issued automatically and TLS is terminated for you, so browsers and API clients reach it over plain HTTPS. Raw HTTP is simply piped through as-is, which means no changes to your existing apps.

A web server on your machine or inside your company (localhost:8080) gets the address https://<your-name>.ja001.wirecanal.com through the WireCanal tunnel. Certificates are issued automatically, the entire path is TLS, and raw HTTP is piped through as-is

Going live takes three steps from the dashboard.

check_circleCreate a canal — create one connection (a canal) in the dashboard, and a public hostname and connection key are issued.
check_circleGet the agent and its config — download the static single-binary agent and a wirecanal.json that contains just the connection key and forwarding destination.
check_circleRun it — start the agent on the machine you want to publish, and the tunnel opens using outbound connections only.

Publish in 3 steps: 1 Create a canal (public hostname and connection key issued) → 2 Deploy the agent (binary + one config file) → 3 Run and publish (tunnel opens with outbound connections only)

For the public hostname, you can choose between a random subdomain (<random>.ja001.wirecanal.com, expires after a time limit) and a persistent reservation of the subdomain of your choice (depending on your plan).

For detailed installation instructions with copy-and-paste commands, see the per-OS Setup Guide (Windows / Linux).

settingsRun it as a resident service with one command (Windows service registration)

If you close the terminal you started it in, the agent stops. To keep it running as a server, run wirecanal service install -config wirecanal.json once in a PowerShell opened as Administrator, and it is registered as a Windows service (agent v0.16.0 and later). It starts automatically when the PC boots — no logon required — and if it stops, it restarts automatically after about 5 seconds. To remove it, run wirecanal service uninstall. On Linux you can keep it resident with systemd (a template is provided in the Setup Guide).

verifiedBring your own custom domain (Premium)

On the Premium plan, you can use your own domain (e.g. app.example.co.jp) as the public host (HTTP / MCP canals). Just add DNS records as guided on screen, and WireCanal automatically handles everything from ownership verification to automatic certificate issuance and go-live confirmation. You are also notified by email when the domain goes live and when certificates are renewed. Progress is preserved even if you close the screen midway, you can unlink at any time, and your domain can be reused as many times as you like.

RDP, SSH, databases and more — carried as raw TCP

It is not just for the web. Arbitrary TCP services such as RDP, SSH, and PostgreSQL / MySQL can also be published across NAT without opening inbound ports (Pro plan and above). Endpoints take the form tcp://jan000.wirecanal.net:<port>.

check_circlePorts are assigned automatically at creation from the range 20000–29999, and stay fixed for as long as the canal exists.
check_circleTCP runs on dedicated servers (jan-series nodes), separated from the HTTP stack by hardware, IP, and domain — so that any trouble cannot drag down the main service.
check_circleThe upstream protocol's own encryption (TLS in RDP / SSH / databases, etc.) protects the path.

lockWe recommend combining it with IP restriction

TCP canals can also be layered with the IP address restriction available on all plans. Restrict callers to your office or site IPs, and you get what is effectively a leased line — even though it is a public endpoint.

smartphone Try this, too!

Connect only when you want to, from your phone — publish RDP "only while in use"

Set up a tunnel for RDP to your PC at home or at work, and keep it paused most of the time. When you want Remote Desktop while out and about, open the dashboard on your phone and just tap "▷ Resume" — one button brings the endpoint back (usually reflected in seconds; up to 1 minute for TCP).

Dashboard on a phone: a TCP canal for RDP is paused. Just tap the Resume button — Paused most of the time. When you need it, tap "▷ Resume" on your phone

Dashboard on a phone: resumed and connected. Pause again when you are done — The endpoint is back in seconds and RDP connects. Pause again when you are done

check_circleWhile paused, the Agent's connection and settings are kept as they are — that is why resuming is instant.
check_circleYou minimize exposure to "only while in use." Even from far away, your phone is all you need.
check_circleLayer IP restriction or country restriction on top to narrow the entrance even further.

Relayed through servers in Japan. With a tightly narrowed entrance

The receiving end (Edge) sits on servers in Japan, and traffic is TLS along the entire path. It is our own stack — not dependent on overseas managed pay-as-you-go tunnels. On top of that, the entrance can be narrowed in two ways.

check_circleFixed forwarding destinations: the agent never connects to anywhere other than the destination you configured — so the tunnel can never be repurposed as a pathway into your network.
check_circleCaller IP restriction: restrict the entrance to the fixed IPs of legitimate callers, and your public endpoint effectively becomes a leased line.

Completed on servers in Japan, TLS along the entire path. Only external access that passes the double gate of caller IP restriction and authentication / 8 kinds of access protection enters the tunnel and reaches your company network

In addition, 8 kinds of access protection — IP / country / BASIC / Bearer / time window / path / automatic blocking / stealth — plus per-canal access logs are available on all plans. See the Security page for details.

Install with a one-liner

The agent is a static single binary for Windows / Linux (amd64, arm64 and 32-bit ARM). No runtime required — drop in one file and it runs. Installation is a single one-liner.

irm https://download.wirecanal.com/install.ps1 | iex

curl -fsSL https://download.wirecanal.com/install.sh | sh

check_circleGreat on Raspberry Pi and IoT devices: Linux support includes arm64 (64-bit ARM) and 32-bit ARM (armv6/armv7). Small, low-memory boards like the Raspberry Pi or Luckfox Pico install with the same one-liner, letting you publish the web UI or API of a home server or IoT device as it is (verified on real Raspberry Pi 5 and Luckfox Pico hardware).
check_circleMultiple canals: one machine and one agent can keep multiple canals open at the same time.
check_circleAutomatic updates: the agent updates itself unattended from signed releases (on by default), staying current and secure at all times.
check_circleProxy environments supported: even where a corporate proxy is mandatory, just set proxy_url in wirecanal.json (independent of the environment variables of the host).
check_circleEnglish display supported: add a single line "lang": "en" to wirecanal.json and the agent's messages switch to English (the default is Japanese).

Get started free See pricing

Connect your internal systems to the outside world through a secure tunnel