WebSocket Tunnels · Smart Routing · TCP Port Forwarding

Secure Web Proxies.
Instantly.

Onifast Relay connects your local servers and development services securely to the public web. Bridge HTTP and raw TCP protocols via robust websocket pooling.

Get Onifast Panel Explore Tunnels
gateway log — onifast-gateway :4034
[GATEWAY] Starting Onifast Gateway (Ports: 4034 [Internal Dialing], 4053 [Web Proxy Output])
[GATEWAY] Unified Service ready on Port 4034 (Local only, proxied via HTTPS).
 
[RELAY-CONN] Worker added for user1.tunnel.onifast.com
[WEB-PIPE] Routing HTTP request to local worker (X-Tunnel-Host: user1.tunnel.onifast.com)
[PORT-FORWARD] TCP Listener started on Port 3306 -> Tunnel Host: user1, Port 3306
4034port
Unified Dialing / Smart Routing
4053port
Web Proxy Public Output
Active
Connection Peeking (Host / SNI)
Static
TCP Forwarding (MySQL/Redis)
SQLite
Auth & Routing Store
What's included

An Intelligent Tunneling Gateway

Bridge development environments, expose local databases, and route traffic intelligently with a single unified gateway.

Web Proxy (Relay)
Route public HTTP/HTTPS requests to secure backend workers. Enables serving websites hosted behind NAT routers.
Smart Routing
Connection peeking reads HTTP Host headers and TLS SNI extensions to route packets to correct websocket streams without termination.
TCP Port Forwarders
Map public-facing TCP ports directly to tunneled hosts. Securely expose databases (MySQL, Redis) and SSH servers.
Built-in Offline Page
Includes an embedded user-friendly offline status page served automatically whenever client tunnels disconnect.
Connection Pool APIs
REST endpoints query active proxy status and web pool worker counts in real-time, backed by SQLite storage.
Robust Draining
Worker pools automatically rotate and purge stale connections, keeping websocket connections live and responsive.
Network Layers

Proxy vs Tunnel Mode

Choose the protocol bridge that fits your deployment architecture.

Web Relay (HTTP)

Web Relay handles HTTP requests by transferring incoming traffic over secure websocket connections to local HTTP endpoints.

  • Streamlined HTTP header rewriting.
  • Simulates access from `localhost`.
  • Seamlessly proxies WebSocket upgrades.
tunnel registry — onifast-gateway 
# Web pools status (JSON)
GET /relay/pools
{
  "user1.onifast.com": 3,
  "user2.onifast.com": 1
}

# Tunnel pools status (JSON)
GET /tunnel/pools
{
  "db.onifast.com": 2
}
routing algorithm — main.go 
# Read target host from connection
host = peekConnectionInfo(conn)

# Route based on protocols
if isHTTPRequest(peekedData) {
    // Serve HTTP via Dial Mux
    http.Serve(listener, dialMux)
} else {
    // Pipe raw TCP to websocket pool
    pool = findPool(host)
    ws = <-pool
    io.Copy(ws, conn)
}
Inside the Gateway

Zero configuration routing

The gateway inspects connections dynamically without decrypting SSL payloads, retaining security boundaries.

  • Zero Overhead: Connections are piped natively between sockets.
  • Domain Buckets: Resolves routes against sqlite database tables dynamically.
  • Status Notifications: Auto-notifies panel administrators on connect/disconnect events.

Tunnels made simple. No third-party SaaS.

Install Onifast Panel and run your private tunneling infrastructure securely.

Get Onifast Panel Onifast.com