Iroh is a modular, Rust-based networking stack that establishes fast, direct, and secure peer-to-peer (P2P) connections between devices. Instead of relying on IP addresses, devices “dial” each other directly using public keys, bypassing NATs and firewalls.
Our first use case for Iroh Tunnels is with our desktop apps, which help you securely expose localhost to the internet. Future iterations will include “anywhere to anywhere” Tunnels.
You can also manage tunnels from the command line with the connect plugin for datumctl, which is in preview. It shares a service on your machine with your project or publicly, forwards a local port to a service on another Connector, and joins a device to a gVPC network. To install it and see its commands, see How tunnels use the relays.
How a tunnel connects
- Each tunnel endpoint keeps one outbound connection to its nearest Datum relay, its home relay, over HTTPS on port 443. The endpoint needs no public address and no open inbound port.
- Traffic starts through the relay, then moves to a direct UDP path when both sides can holepunch one. The relay stays available as a fallback.
- The connection is QUIC, encrypted end to end with TLS 1.3, so a relay forwards only packets it can’t read.
For details, see Iroh relays. Last modified on November 6, 2026
