Expose your local services to the world securely. Dual transport modes, HTTP, TCP & UDP tunneling, path filtering, and enterprise-grade security - all in one powerful solution.
Everything you need to securely expose local services with enterprise-grade features
Subdomain-based routing for web applications, APIs, and webhooks.
Port-based routing for any TCP protocol - databases, SSH, custom services.
Session-based UDP forwarding for gaming, VoIP, and DNS servers.
WebSocket-based transport - firewall-friendly, no SSH required.
Traditional SSH reverse tunneling for maximum compatibility.
Whitelist or blacklist URL paths to expose only specific endpoints.
**, *)Protect HTTP tunnels with end-user authentication.
Three-level IP restriction system for granular control.
End-to-end encrypted communication for all tunnels.
Choose your own subdomain name for memorable URLs.
Time-limited access with automatic cleanup.
Works on Windows and Linux without modifications.
Resilient connections with configurable retry logic.
Run tunnels as background services for production deployments.
4 log levels with multiple output destinations.
Centralized orchestration for multi-bridge deployments.
Full bidirectional WebSocket tunneling for real-time apps.
Get your local service online in seconds. Download the client and run a single command.
# Expose local port 8080
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key
# With custom subdomain
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -Subdomain myapp# Expose a database or any TCP service
EndpointBridgeClient -LocalPort 5432 -ApiKey your_api_key -Tcp
# Expose multiple ports in one command (range, list, or mix - TCP/UDP only)
EndpointBridgeClient -LocalPort 5000-5005,5008 -ApiKey your_api_key -Tcp# Expose a game server, DNS, or VoIP service
EndpointBridgeClient -LocalPort 27015 -ApiKey your_api_key -Udp# Use WebSocket transport instead of SSH
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -Transport signalr# Expose only a single path (exact match)
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -AllowedPaths "/api/webhook"
# Expose multiple paths with wildcards
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -AllowedPaths "/api/webhook/**,/callback"
# Block sensitive paths
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -DeniedPaths "/admin/**,/internal/**"# Require end-user authentication
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -EnableTunnelAccessKey
# Output includes the tunnel access key:
Tunnel Access Key: tak_live_a1b2c3d4e5f6...
(Share this key with authorized users)# Allow only specific IPs
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -AllowedIps "192.168.1.0/24,10.0.0.5" -IpRestriction
# Block specific IPs
EndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key -DeniedIps "1.2.3.4" -IpRestrictionEndpointBridgeClient -LocalPort 8080 -ApiKey your_api_key \
-Transport signalr \
-Subdomain myapp \
-ExpiresIn 8 \
-WarnBeforeExpiry \
-AllowedPaths "/api/**" \
-DeniedPaths "/api/internal/**" \
-EnableTunnelAccessKey \
-AllowedIps "10.0.0.0/8" \
-IpRestriction \
-LogLevel detailed \
-RetryPolicy UnlimitedCreate an endpoint-bridge.config JSON file for persistent settings. The client auto-discovers config files in the current directory, executable directory, or ~/.endpoint-bridge/.
Complete command-line options for the EndpointBridge client.
| Option | Description |
|---|---|
-LocalPort |
Local port(s) to expose (required). Accepts a single port (5000), a range (5000-5005), a list (5000,5001,5002), or a mix. Ranges and lists are TCP/UDP only, capped at 64 ports. |
-ApiKey |
API key for authentication |
-Server |
Manager URL for Bridge assignment (if not default) |
-Transport |
Transport mode: ssh or signalr |
-LocalScheme |
Force local protocol: auto (default), http, or https |
-Tcp |
Enable TCP tunnel mode (default: HTTP) |
-Udp |
Enable UDP tunnel mode (requires SignalR transport) |
-FailFast |
With a multi-port -LocalPort: abort all tunnels and exit on the first failed startup registration |
-Subdomain |
Custom subdomain name |
-ExpiresIn |
Tunnel lifetime in hours |
-WarnBeforeExpiry |
Warn 5 minutes before expiry |
-AllowedIps |
IP whitelist (comma-separated, CIDR supported) |
-DeniedIps |
IP blacklist (comma-separated, CIDR supported) |
-IpRestriction |
Enable IP restriction checking |
-AllowedPaths |
URL path whitelist (HTTP only, glob patterns) |
-DeniedPaths |
URL path blacklist (HTTP only, glob patterns) |
-PathFiltering |
Enable path filtering |
-EnableTunnelAccessKey |
Require end-user authentication (HTTP only) |
-SshKeyPath |
Custom SSH key directory (SSH mode, service/system deployment) |
-WebDebug |
Enable HTTP request logging |
-ShowTimestamps |
Show timestamps in console output (useful for debugging) |
-Debug |
Debug mode — shortcut for verbose logging + timestamps |
-LogLevel |
silent, normal, detailed, verbose |
-Output |
console, log, both |
-LogLocation |
Log file path |
-RetryPolicy |
NoRetry, Limited, Unlimited |
-RetryCount |
Max retry attempts (for Limited policy) |
-RetryInterval |
Seconds between retries |
-EndpointFile |
Write tunnel URL to file |
-Config |
Path to config file |
-Help |
Show help information |
-Transport signalr if SSH is blocked by your firewall./api/** for recursive, /api/* for single segment).-LogLevel verbose and -WebDebug for detailed diagnostics.