LRO/Guides/Your first tunnel

Your first tunnel in 5 minutes

Time · ~5 min Level · Beginner You need · an account + a machine to reach

By the end of this guide you will reach a service — a web admin panel, an SSH daemon, a database — running on a remote machine, straight from your own computer. No inbound ports, no port forwarding, no VPN. The remote machine only needs ordinary outbound internet access.

Two agents, two roles

A tunnel always joins two LRO agents, and it matters which role each one plays:

The flow is: you → the support agent’s local port → LRO core → the client agent → the target service. So the machine you reach from runs Support, and the machine you reach into runs Client. Both dial out to LRO; the relay between them is end-to-end encrypted.
  1. Create your account

    Open app.lro.link/signup. Use Create account with your email, or By invite if a teammate sent you a code. Accept the Terms and sign in.

    LRO sign-up form with Create account and By invite tabs
    Fig 1. The sign-up form — e-mail, password and an optional referral code.
  2. Install the agent on both machines

    On Linux or macOS, run the one-liner on each machine — the remote one that hosts the service, and the computer you will connect from:

    $ curl -fsSL https://lro.link/install.sh | sh

    An interactive menu opens. Pick 1) Install / update binary. (For Windows or an offline install, download the archive for your platform from the dashboard’s Download agent panel instead.)

    The install.sh interactive menu in a terminal
    Fig 2. The installer menu. The same menu registers the agent and installs it as a service.
  3. Register the client and the support agent

    In the panel go to Agents and click Register. Name the agent and pick its mode:

    • On the remote machine that hosts the service, choose Client (remote network).
    • On your own computer, choose Support (tech specialist).

    (Dual is also available when one machine needs to play both roles.)

    Register new agent dialog with name and mode fields
    Fig 3. Register new agent — name it and choose Client, Support or Dual.

    Click Get token. The panel shows a short registration token and waits for the agent to come online.

    Registration token dialog showing a numeric token and Waiting for agent registration
    Fig 4. A one-time registration token. The panel waits for the agent to check in.

    On the machine, paste the token into the installer menu — 2) Register agent — or from the command line:

    $ lro -t <your-token>

    If you run the desktop app instead of the console agent, paste the token into Settings → Registration and click Register:

    LRO desktop agent Settings dialog with a token field and Register button
    Fig 5. The desktop agent — paste the same token under Settings → Registration.

    Do this on both machines with their own tokens. Both then appear in Agents as Connected, one in Client mode and one in Support mode.

    Agents table showing a Client agent and a Support agent, both Connected
    Fig 6. Both agents online — the service host in Client mode, your computer in Support mode.
  4. Subscribe the client agent

    The client agent — the side that opens tunnels and is billed for traffic — needs an active subscription; a brand-new agent shows No subscription and cannot open tunnels until it has one. Top up your balance under My balance, open the client agent, go to its Billing tab, choose Subscribe to plan, pick a plan and confirm the charge. The support agent does not need its own subscription.

    A subscription keeps the client agent active and includes a small traffic bucket. Traffic beyond the bucket is billed by the byte (about 0.1 coin per GB). Interactive SSH or a web panel is effectively free; only large transfers move the needle.
  5. Describe the service as an endpoint — on the Client

    Go to Endpoints → Create endpoint. Choose the client agent (the remote machine), give it a name, and set the target and port — the address the service listens on as seen from that machine (for a service on the same box, that is usually 127.0.0.1).

    Add endpoint dialog with agent, name, target and port fields
    Fig 7. The endpoint is “which service, on which client agent” — here a web app on 127.0.0.1:8000.
  6. Open the tunnel and connect

    Go to Tunnels → Add tunnel. Pick the support agent (your computer — the side that opens the local listener), then the endpoint from the previous step, and a listen port. Click Create; the tunnel goes Active once both sides finish their key exchange.

    Tunnels table showing an active tunnel with a client agent and a support agent
    Fig 8. An active tunnel — Agent is the client (with the target), Support is your machine, Listening is the local port it opens.

    Now point your tool at the listen address on the support machine (your computer). If the endpoint was a web app and the listen port was 5000:

    $ curl http://127.0.0.1:5000/

    For SSH it would be ssh user@127.0.0.1 -p 5000, for a database your usual client pointed at 127.0.0.1:5000, and so on — the tunnel is a raw TCP pipe and never inspects the protocol on top. Every stream shows up live under Streams, with the client and support agents and the bytes moved.

    Stream log showing live streams with client agent, support agent, source, destination and traffic
    Fig 9. Live streams — each one names the client and support agent, the destination service and the traffic, updated in real time.

That is a complete tunnel: an encrypted path from your computer to a service on a remote machine, with nothing exposed to the public internet. Close it any time from the Tunnels page; the agents stay connected and ready for the next one.

Next steps

Ready to open yours?

Create an account →