HTTP Tunnels Core

Expose your local HTTP server to the internet with a single command. NFLTR creates a secure, encrypted tunnel from your localhost to a public HTTPS URL — no port forwarding, no DNS configuration, no firewall changes required.

Tutorials: Share a local web app · Share a log or command output

How It Works

When you run nfltr http 3000, the agent establishes an outbound gRPC connection to the NFLTR server. Incoming HTTPS requests to your public URL are relayed through this encrypted tunnel to your local service. The connection is always initiated from your machine — no inbound ports needed.

Quick Start

1. Start your local server

# Any HTTP server on any port
node server.js          # Express on :3000
python -m http.server   # Python on :8000
go run main.go          # Go on :8080

2. Create the tunnel

nfltr http 3000

That's it. You'll see output like:

Agent ID:    alice.cranky-fox
Forwarding:  https://nfltr.xyz/browse/alice.cranky-fox/ → http://localhost:3000
Share URL:   https://k3vq7mzt2xw4hn5rbsd6jyfa2e.nfltr.xyz/

3. Access your service

Anyone on the internet can now reach your local server via the share URL or the stable browse URL. All traffic is encrypted with TLS end-to-end.

Multi-Route Support

Route different URL paths to different local ports. Perfect for microservice architectures where your frontend and API run on separate ports:

# Frontend on :5173, API on :8080, WebSocket on :4000
nfltr http 5173 \
  --route /api=8080 \
  --route /ws=4000

Named Endpoints

Give your tunnel a stable, human-readable name that persists across restarts:

nfltr http 3000 --name my-api

Your service is always available at https://nfltr.xyz/browse/alice.my-api/ — the URL never changes, even if you restart the agent. It is your own entry point: after dashboard sign-in it redirects to the agent's own origin, https://b-<hash>.nfltr.xyz/, so the agent's pages never run on the dashboard origin (scripts send their API key and follow the redirect, curl -L). If the agent is temporarily offline, the server returns 503 Service Unavailable with a Retry-After header instead of 404, so clients know the endpoint exists and will come back.

Streaming & SSE Support

NFLTR transparently proxies all HTTP response types:

• Server-Sent Events (SSE) — text/event-stream responses stream continuously
• Chunked Transfer — Large file downloads, streaming APIs
• WebSocket Upgrade — Via --route /ws=4000
• Long-Polling — No timeout interference, configurable keep-alive

AI chat interfaces, live log tails, real-time dashboards — they all work transparently through the tunnel.

Uploads and downloads

Request bodies stream to your local server as they arrive: your app gets the first bytes of an upload while the client is still sending the rest, and neither the relay nor nfltr holds the whole body in memory. A request body can be up to 1 GiB; a larger one is refused with 413 and the message request body too large: the relay accepts at most 1 GiB (http.server.max_request_body_size). Responses (downloads) have no size limit and support Range requests, so an interrupted download can resume.

Agents built before streaming uploads (and the sample agents) read each body whole; for them the limit stays at 10 MiB, and a larger body gets a 413 that says so. Update nfltr to lift it.

Security

CLI Options

Use Cases

• Local development — Share your dev server with teammates for review
• Webhook testing — Receive GitHub, Stripe, Razorpay callbacks locally
• OAuth flows — Get a public HTTPS callback URL for OAuth testing
• Demo & presentations — Show a client your work without deploying
• CI/CD integration — Run integration tests against live local code with Newman/Postman
• NAT/CGNAT traversal — Expose services behind NAT or CGNAT with a stable encrypted URL