# Porta
### Expose your local services to the internet. No public IP needed.
Porta lets you share apps running on your local machine with anyone on the internet - even if you're behind CGNAT, a firewall, or a double NAT.
```
Your laptop behind CGNAT Your friend on the internet
│ │
▼ ▼
localhost:3000 ──── WireGuard ──── vps.example.com:3000
│ │
Your app Their browser
```
---
## Who is this for?
| **Home lab enthusiast** | Want to access your services remotely | Expose them through a cheap VPS |
| **Developer** | Need to demo an app to a client | Share localhost instantly |
| **Gamer** | Want to host a server behind NAT | Open ports without port forwarding |
| **Self-hoster** | IPv4 CGNAT blocks incoming connections | Bypass it with a tunnel |
| **Small business** | No static IP for your office server | Use a VPS as a public entry point |
---
## Why Porta?
| **Zero config** | Interactive wizard sets everything up for you |
| **Secure by default** | All traffic encrypted via WireGuard |
| **One command** | `porta add-port --remote 80 --local 3000` and you're done |
| **No IP needed** | Works behind CGNAT, carrier-grade NAT, or firewalls |
| **Any protocol** | HTTP, HTTPS, SSH, WebSocket, gaming servers, DNS - anything TCP/UDP |
| **Firewall aware** | Automatically creates UFW rules on the server |
---
## Use cases
### Share your web app with a client
```bash
# Your app runs on localhost:3000
npm run dev
# In another terminal, expose it
sudo porta add-port --remote 8080 --local 3000 --desc "Client demo"
# Send them: http://your-vps-ip:8080
```
### Access your home server remotely
```bash
# SSH into your home machine through the tunnel
ssh -p 2222 user@your-vps-ip
# Porta forwards VPS:2222 → home:22
sudo porta add-port --remote 2222 --local 22 --protocol tcp --desc "SSH"
```
### Host a game server behind NAT
```bash
# Minecraft on port 25565
sudo porta add-port --remote 25565 --local 25565 --protocol tcp --desc "Minecraft"
```
### Run a DNS server
```bash
# Pi-hole or custom DNS
sudo porta add-port --remote 53 --local 53 --protocol udp --desc "DNS"
```
---
## Quick start
```bash
# 1. Install
git clone https://github.com/brzb0/Porta.git && cd Porta
cargo build --release
sudo cp target/release/porta /usr/local/bin/
# 2. Setup server (on your VPS)
sudo porta setup --role server
# 3. Setup client (on your machine)
sudo porta setup --role client
# 4. Add a port
sudo porta add-port --remote 8080 --local 3000 --protocol tcp
# 5. Start
sudo systemctl enable --now porta-server # on VPS
sudo systemctl enable --now porta-client # on your machine
```
---
## How it works
```
┌─────────────────────────────────────────────────────────────────┐
│ INTERNET │
└─────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ VPS (Public IP) │
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ UFW │───▶│ Porta │───▶│ WireGuard│ │
│ │ Firewall │ │ Server │ │ Tunnel │ │
│ └──────────┘ └──────────┘ └─────┬────┘ │
└──────────────────────────────────────────┼──────────────────────┘
│ encrypted
┌──────────────────────────────────────────┼──────────────────────┐
│ Your Machine (CGNAT) │ │
│ ▼ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ Your App │◀───│ Porta │◀───│ WireGuard│ │
│ │ localhost│ │ Client │ │ Tunnel │ │
│ └──────────┘ └──────────┘ └──────────┘ │
└─────────────────────────────────────────────────────────────────┘
```
1. **Porta Server** listens on the VPS's public IP
2. **Porta Client** connects through an encrypted WireGuard tunnel
3. Traffic flows: `Internet → VPS → Tunnel → Your machine → Your app`
---
## Commands
| `porta setup` | Interactive setup wizard |
| `porta add-port` | Expose a local port to the internet |
| `porta remove-port` | Stop exposing a port |
| `porta status` | See what ports are exposed |
| `porta metrics` | View traffic statistics |
| `porta logs` | View service logs |
| `porta run` | Start the service |
Full documentation: [docs/GUIDE.md](docs/GUIDE.md)
---
## Requirements
- Linux (Ubuntu 20.04+, Debian 11+, Fedora 36+)
- Root access (sudo)
- WireGuard kernel module
- Two machines: one with public IP (VPS), one behind CGNAT (your machine)
---
## Configuration
| Server config | `/etc/porta/server.toml` | Server settings + allowed clients |
| Client config | `~/.config/porta/client.toml` | Client settings + port mappings |
| Server key | `/etc/porta/server.key` | WireGuard private key (sensitive) |
| Client key | `~/.config/porta/client.key` | WireGuard private key (sensitive) |
---
## Security
- **WireGuard encryption**: All traffic is encrypted end-to-end
- **Zero trust**: Commands only flow from client → server, never the reverse
- **HMAC authentication**: Client must authenticate to register ports
- **No exposed keys**: Private keys are stored separately from config
---
## License
MIT
---
> **Warning**: Porta is experimental software. Use in production at your own risk. Tested on Ubuntu 24.04.