Skip to main content

​
Mental model

tunnelbyte spins up an ephemeral WireGuard tunnel from your machine to a chosen exit region and exposes it as a localhost proxy. Only the processes that point at that proxy go through the tunnel; your system default route stays untouched, no sudo required. The tunnel exists for as long as the foreground command runs - Ctrl-C tears it down and the proxy goes away with it. If you’ve used ssh -D for a SOCKS proxy, the shape is similar - just with WireGuard’s data plane and any region you want.

​
Install

Platforms today: macOS and Linux. Windows support is planned but the binary doesn’t exist yet - if you’d use a Windows build, email hello@tunnelbyte.dev to register interest.
brew install tunnelbyte/tap/tunnelbyte
Verify the apt signing key fingerprint against the one published on Security before adding it to your keyring. Trust on first install is the only place this matters.
Both install paths drop a single static tunnelbyte binary on your $PATH. No daemons, no system services.
macOS Gatekeeper, first run. Binaries are checksum-verified but not yet notarized, so macOS may warn on the very first launch. The Homebrew formula and the one-line installer both strip the com.apple.quarantine attribute for you. If you downloaded the tarball directly from GitHub releases, run once:
xattr -d com.apple.quarantine $(which tunnelbyte)

​
Run a tunnel

$ tunnelbyte sin
✓ tunnel up via 5.223.57.171 (sin) - anonymous tier
  proxy:           http://127.0.0.1:57412
  export HTTPS_PROXY=http://127.0.0.1:57412
  ↑ 0 B  ↓ 0 B  ·  3s  ·  daily: 0 B / 1.0 GiB · 0s / 30m 00s
  (Ctrl-C to tear down)
The port is allocated fresh by the OS each run - don’t hardcode it. Parse the proxy: line in stdout for the exact URL. That command:
  1. Picks the anonymous tier on first run (no signup; 1 GiB per rolling 7-day window, 30 minutes per day).
  2. Brings up a userspace WireGuard tunnel to the Singapore exit node.
  3. Exposes a localhost SOCKS5/HTTP proxy. Your system default route is untouched.
  4. Renders a live status line that refreshes every second: bytes up/down, elapsed time, and quota progress. On the paid tier, the line also shows live cost at €0.01/min + €0.02/GiB (e.g. · €0.04).
Point any process at the proxy to route through Singapore: 
$ curl -x $HTTPS_PROXY https://httpbin.org/ip
{ "origin": "5.223.57.171" }
Or wrap a single command (auto-injects HTTPS_PROXY into the child env): 
$ tunnelbyte sin -- curl https://httpbin.org/ip

​
Tear down

Ctrl-C in the terminal running tunnelbyte. The tunnel terminates, the proxy goes away, and billing stops (paid tier) or your quota clock pauses (anonymous / free).

​
Pick a region

$ tunnelbyte regions
fsn    Frankfurt        12 ms     1 node
ash    Ashburn, VA      94 ms     1 node
sin    Singapore        186 ms    1 node
With no argument, the CLI geolocates you and picks the nearest active region: 
$ tunnelbyte           # auto-picks based on geo
✓ tunnel up via 116.203.42.7 (fsn) - anonymous tier
The choice is persisted to ~/.config/tunnelbyte/region, so subsequent runs are instant. Pass an explicit region (or --region) any time you want to override.

​
Run multiple tunnels at once

Each tunnelbyte invocation gets its own localhost proxy on its own port. Run several in parallel - same shell, same second. 
$ tunnelbyte ash &          # proxy on :57412
$ tunnelbyte sin &          # proxy on :57418
$ curl -x localhost:57412 https://api.example.com   # → US
$ curl -x localhost:57418 https://api.example.com   # → SG
Both ports are random OS-allocated values; capture them from each invocation’s proxy: output. No system-route mess, no sudo, no waiting for one tunnel to tear down before the next comes up.

​
What you got

Works well for proxy-aware tooling against APIs and services that don’t block datacenter ASNs. For Cloudflare- or DataDome-protected targets, see the note in the introduction.
  • Anonymous tier: 1 GiB per 7-day window, 30 min per day, no signup.
  • Need more? Upgrade to a free account for 5 GiB per 7-day window + 2 h per day.
  • Need scrapers / CI / no caps? Go paid - €0.01/min + €0.02/GiB, no daily quota.

​
Next