{"rid":"egress/he-tunnelbroker","card":{"rid":"egress/he-tunnelbroker","eid":"tunnelbroker-2","topic":"egress","slug":"he-tunnelbroker","provider":"Hurricane Electric tunnelbroker","url":"https://tunnelbroker.net/","domain":"tunnelbroker.net","category":"IPv6 tunnel (free)","tier":null,"verdict":"qualifies-with-caveat","vorder":1,"grp":"usable","confidence":"documented","binding":"none","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":3,"usd_month":null,"usd_per_tb_month":null,"summary":"a free 6in4 tunnel and a routed /48","duplicate_of":null,"n_unknown":0},"record":{"topic":"egress","slug":"he-tunnelbroker","provider":"Hurricane Electric tunnelbroker","url":"https://tunnelbroker.net/","category":"IPv6 tunnel (free)","free_tier":{"stated":"a free 6in4 tunnel and a routed /48","unit":"unlimited","metered_on":"none","source_url":"https://tunnelbroker.net/","read_on":"2026-10-22","notes":""},"per_object_cap":{"stated":"not applicable: a routed prefix","bytes":null,"notes":""},"retention":{"stated":"not applicable","days":null,"notes":"","source_url":"https://tunnelbroker.net/"},"egress":{"terms":"not metered","metered":false,"free_allowance":null,"price_per_tb":null,"source_url":"https://tunnelbroker.net/"},"interface":["cli"],"tooling":"iproute2, netplan","chaining":"the free answer to a static address rather than to capacity: it composes with a dual-stack front and only with clients that have IPv6.","limits":[],"identity_cost":{"kind":"email","detail":"a tunnelbroker account","country":null},"reliability_note":"the site served an incomplete TLS chain on 2026-10-22","confidence":"documented","evidence":[{"url":"https://tunnelbroker.net/","date":"2026-10-22","proved":"a free tunnel plus a routed /48"},{"url":"probe:https://tunnelbroker.net/","date":"2026-10-22","proved":"the served TLS chain names only CN=tunnelbroker.net and openssl reports an incomplete chain; curl exits 35 CRYPT_E_REVOKED without -k and returns 200 with it"},{"url":"https://tunnelbroker.net/","date":"2026-10-23","proved":"'Our free tunnel broker service enables you to reach the IPv6 Internet by tunneling over existing IPv4 connections' and 'Ability to get your own /48 prefix once your tunnel is up'"}],"verdict":"qualifies-with-caveat","verified_at":"2026-10-23T00:00:00.000Z","notes":"Re-read 2026-10-23 and unchanged: still a free tunnel over an existing IPv4 connection with a /48 once the tunnel is up, still protocol 41 or GRE, and WireGuard is not offered. A WireGuard client therefore cannot use it directly and would need a second host to terminate the tunnel.","extras":{"stale_after_days":180,"bytes_transit":"yes","transit_note":"the 6in4 tunnel carries the endpoint's IPv6 traffic over Hurricane Electric's network","extras.wg_path":"none","extras.wg_test":"fails: no WireGuard transport is offered, so no .conf can be obtained and no WG datagram is carried except inside a 6in4 or GRE outer packet the client builds itself"},"binding":"none","interface_detail":"a 6in4 tunnel to a Hurricane Electric endpoint","binding_note":"nothing in the vocabulary binds: the protocol-41 requirement is a network capability the client's ISP passes or blocks, not a queue with a person in it, and the /48 itself has no volume limit","limits_note":"the endpoint must answer ICMP and accept protocol 41. That is not write-gated in the vocabulary's sense, because no curator or review stands between the client and the write; it is a capability the client's ISP either passes or does not, and none of the six kinds names it"},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[],"history":[],"drift":[]}