arena-tunnel
github.com · Egress and tunnels · 1 record · JSON
arena-tunnel Egress and tunnels
paidanonymousno cardD
| Free tier | no service and no account; AGPL-3.0 source with static binaries, described as "Free public ingress through any CDN" unit none; metered on none |
|---|---|
| Price | USD 0 |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | not applicable; the tunnel's ceiling is the CDN's, and the README states none; ingress: tcp free_allowance: none published |
| Identity | anonymous no account for the DIY path; the vendor's own deployment adds a browser pairing flow with a signed-in identity |
| Binding | none the constraint is a WireGuard server host plus a way to publish an HTTP port, which is the same host requirement as every other wrapper |
| Interface | cli arena-tunnel client and arena-tunnel-server |
| Tooling | single Go binary per platform, cloudflared or any HTTP publisher in front |
| Composes with | the intended composition is cloudflare-tunnel Free in front of arena-tunnel-server, which makes an HTTP-only hosted tunnel carry WireGuard for the first time without a paid plan. |
| Reliability | new and lightly used; client needs root for the TUN device; one WebSocket per session means a dropped TCP connection restarts the tunnel |
| Notes | The clearest statement's central problem: "Most free CDNs (Cloudflare Free, Fastly, Bunny) only proxy HTTP/WS", so WireGuard has to be framed into WebSocket to use them. Released two days before this read, four stars, single purpose. It still needs the WireGuard server host, so its claim of no VPS rental assumes the reader already has somewhere to put the server half. Frame-per-datagram framing avoids putting a length-prefixed stream in the datagram path, but the websocket still rides TCP. |
| Evidence rung | documented a measured run behind a free Cloudflare Tunnel would raise it, and is the single most useful measurement leaves open |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
| Parsed numbers |
|
Evidence (4)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | github.com/dc-holdings-spa/arena-tunnel | "punches a WireGuard VPN through any HTTP/HTTPS path - including a free Cloudflare Tunnel. No VPS rental" and "one WS binary frame <-> one UDP datagram" |
| 2026-10-23 | github.com/dc-holdings-spa/arena-tunnel | the DIY section: "Requires a running WireGuard server on the same host and a way to publish your HTTP port (cloudflared tunnel, ngrok, etc.)" |
| 2026-10-23 | github.com/dc-holdings-spa/arena-tunnel | "Latency cost: ~80-150 ms one-way through a free CF tunnel from most of LATAM" - the author's own figure, not reproduced |
| 2026-10-23 | github.com/dc-holdings-spa/arena-tunnel | release v1.2.1 published 2026-10-21; last push 2026-10-23; 4 stars |
More fields (10)
{
"wg_path": "none",
"wg_detail": "\"encapsulating each WireGuard UDP datagram inside one binary WebSocket frame\"; the client runs wireguard-go locally and the server hands frames to a local WireGuard interface",
"ingress": "tcp",
"volume_tib_month": null,
"volume_stated": "not applicable; the tunnel's ceiling is the CDN's, and the README states none",
"bytes_transit": "yes",
"transit_note": "through cloudflared and Cloudflare's edge, then to the server half",
"hosting_requirement": "a WireGuard server host plus cloudflared or another HTTP publisher; the client half needs root for a TUN device",
"last_release": "v1.2.1 2026-10-21",
"stars": 4
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable