A stable URL for your Raspberry Pi — even behind CGNAT
Your ISP won't give you a public IP, and port forwarding is a hole in your home network waiting to be found. Run one outbound agent on the Pi and reach its services by hostname from anywhere.
CGNAT means there is no port to forward
Behind carrier-grade NAT, your router never sees a public address, so forwarding rules and dynamic-DNS tricks simply can't work. And when they do work, they expose your home router to the whole internet. Tollan inverts the problem: the Pi dials out, and you connect to the relay — the device opens no inbound ports at all.
Register the Pi
Add it as a device in the console and choose what to expose.
Run one agent
Download a preconfigured agent or mint an enrollment token, run one installer, and the device connects itself. ARM builds cover Pi-class boards.
Open your URL
Your Pi's services get their own hostnames, reachable from any browser — at home, at work, on mobile data.
Expose what's running on and around the Pi
One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route. A Home Assistant dashboard, a camera stream, Grafana, Node-RED, or your own REST API — each behind its own route with its own rules.
- Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
- Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload.
- Tinkering with microcontrollers too? There's an ESP32 & Arduino library that speaks the same protocol.
Your Pi, online in one sitting
The free tier covers a Pi with two routes and 5 GB of traffic — no card required.