Freehold
github.com · Egress and tunnels · 1 record · JSON
Freehold Egress and tunnels
fails: egressanonymousno cardI
| Free tier | Your service is now reachable at freehold.lit.app:8080. unit none; metered on unstated |
|---|---|
| Price | USD 0 |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | No byte allowance is published for the public relay: 'Test the public relay without installing anything.'; ingress: http-only free_allowance: none published |
| Identity | anonymous No account: the client registers itself with the relay over UDP and completes an HMAC challenge. |
| Limits |
|
| Binding | none The relay is a public anycast endpoint with no published quota; what stops the UDP test first is the data path, which is described as QUIC/H3 rather than a raw datagram forward. |
| Interface | cli 'freehold --relay freehold.lit.app:9999 --port 8080 --backend 127.0.0.1:3000' |
| Tooling | The freehold Rust client; the relay itself needs a Linux host with eBPF and root, which is the operator's problem and not the client's |
| Composes with | Nothing to chain until the datagram question is settled. |
| Reliability | NAT traversal is best-effort: the port spray 'opens Bob's NAT' only if the carrier allocates ports sequentially, and traffic falls back to the relay otherwise. |
| Notes | A free public anycast relay that a client can register with anonymously is the exact shape wanted, and it is the only such relay found. What it exposes is an HTTP/3 service on a shared anycast name: the README diagram shows a QUIC request being rewritten, not a raw datagram being forwarded, and the client is a Rust binary, not a tunnel daemon. If that reading is wrong, this becomes the strongest lead, which is why it is labelled inferred rather than refuted. |
| Evidence rung | inferred This is a reading of the architecture diagram and the feature list, not a test. Sending a non-QUIC UDP service to freehold.lit.app and watching for the datagram at the origin would settle it in one run. |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
| Parsed numbers |
|
Evidence (3)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | github.com/maceip/freehold | 'Give any device a real public IP address. Host services that browsers trust - not tunnel URLs.' |
| 2026-10-23 | github.com/maceip/freehold | 'This relay announces the 142.248.222.0/24 anycast prefix.' and 'A public relay is available at freehold.lit.app:9999' |
| 2026-10-23 | github.com/maceip/freehold | The data path is 'Browser (Alice) ... QUIC/H3 request ... XDP SNAT+DNAT', and the feature list names 'Optional HTTP/3 reverse proxy with automatic TLS' |
More fields (7)
{
"wg_path": "none",
"wg_detail": "No WireGuard; the relay terminates QUIC and rewrites addresses with XDP.",
"ingress": "http-only",
"volume_tib_month": null,
"volume_stated": "No byte allowance is published for the public relay: 'Test the public relay without installing anything.'",
"bytes_transit": "yes",
"transit_note": "The relay's XDP program forwards to the registered client, or the client and peer go direct after a successful punch."
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable