21tunnel
21tunnel.com · Egress and tunnels · 1 record · JSON
21tunnel Egress and tunnels
deademailno cardMper-ip-shaping
| Free tier | Everything, $0 forever: Unlimited concurrent tunnels, Unlimited bandwidth and requests, Private VPN over WireGuard, No card, no trial, no expiry unit unlimited; metered on none |
|---|---|
| Price | USD 0 |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | Unlimited bandwidth and requests, with 'Bandwidth is fair-use guidance, not a meter - we don't throttle or bill per-GB.'; ingress: udp free_allowance: none published |
| Identity | email 'mytunnel login' opens a browser and saves a 90-day token; signup is at login.21tunnel.com, which does not resolve (see notes) |
| Limits |
|
| Binding | per-ip-shaping On the published terms nothing binds: unlimited bandwidth, 60-second per-source idle window that matches WireGuard keepalive. That is the terms as written. The service is not reachable, which is a stronger failure than any constraint. |
| Interface | cli, rest mytunnel udp 51820 --public-port 31099, mytunnel wg up, and a REST API at login.21tunnel.com/api |
| Tooling | mytunnel CLI, systemd unit, REST API |
| Composes with | would have been answer: a free WireGuard endpoint with a reserved UDP port, composed with any free VM |
| Reliability | the documented relay and dashboard hostnames do not exist in DNS as of 2026-10-23; the marketing site is a static Cloudflare page |
| Notes | The best-designed free WireGuard ingress and the only provider that ships the .conf, the reserved UDP port and a WireGuard recipe together. It is not running. Candidates considered for the NXDOMAIN, all tested on 2026-10-23: (1) never deployed, docs ahead of code - supported, both the relay host and the dashboard host are absent from an authoritative zone that otherwise works; (2) hostnames moved - refuted, the live marketing site's own signup and install links point at login.21tunnel.com, which is the host that does not resolve; (3) this network's resolver is stale or filtered - refuted, the Cloudflare DoH answer is authoritative and 21tunnel.com resolves on the same zone; (4) a WAF answering non-browser clients - impossible, a WAF cannot return NXDOMAIN. The wildcard caveat that applies to playit (a bare subdomain legitimately NXDOMAIN while a wildcard serves) does not apply here because login.21tunnel.com is a named host, not a wildcard member. |
| Evidence rung | measured The death is measured, not inferred: agent.21tunnel.com and login.21tunnel.com both return DNS status 3 (NXDOMAIN) for A and AAAA from Cloudflare DNS-over-HTTPS, an independent resolver, while 21tunnel.com resolves to Cloudflare addresses on the same zone. What would reopen it: the two hostnames resolving again and a login flow completing. |
| Checked | 2026-10-23 (live); stale on 2026-12-22 |
| Parsed numbers |
|
Evidence (6)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | 21tunnel.com/pricing/ | 'It's free. All of it.' - unlimited tunnels, unlimited bandwidth and requests, Private VPN over WireGuard, no card, no trial, no expiry |
| 2026-10-23 | 21tunnel.com/docs/private-vpn/ | reserved public UDP port, generated wg0.conf with Endpoint agent.21tunnel.com:31099, 'Free on all plans' |
| 2026-10-23 | 21tunnel.com/docs/tunnels/ | 'WireGuard endpoint behind NAT' with 'mytunnel udp 51820 --public-port 31820' and a 60-second idle window' |
| 2026-10-23 | probe:https://cloudflare-dns.com/dns-query?name=agent.21tunnel.com&type=A | DNS status 3, NXDOMAIN, no answer record; the same query for 21tunnel.com returns status 0 with 172.67.170.252 and 104.21.87.222 |
| 2026-10-23 | probe:https://cloudflare-dns.com/dns-query?name=login.21tunnel.com&type=A | DNS status 3, NXDOMAIN, for A and AAAA; a direct HTTPS request to login.21tunnel.com from this host returns no status code and no remote IP |
| 2026-10-23 | 21tunnel.com/vs/ngrok/ | 'We're newer, and we're up-front about it - MVP-stage', which is consistent with docs published ahead of deployment |
More fields (7)
{
"wg_path": "registration-api",
"wg_detail": "the vendor documents the full path: '21tunnel reserves a public UDP endpoint and relays datagrams to it', clients get a .conf with 'Endpoint = agent.21tunnel.com:31099', and 'mytunnel udp 51820 --public-port 31099' is the exact relay command; 'Free on all plans.' https://21tunnel.com/docs/private-vpn/",
"ingress": "udp",
"volume_tib_month": null,
"volume_stated": "Unlimited bandwidth and requests, with 'Bandwidth is fair-use guidance, not a meter - we don't throttle or bill per-GB.'",
"bytes_transit": "yes",
"transit_note": "the relay would carry the datagrams; as of this reading there is no relay to carry them"
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable