ClawTunnel

Bind local services and access them remotely, zrok-style. HTTP and browser WebSocket tunnels publish as normal HTTPS/WSS wildcard domains. Raw TCP and UDP create a local listener on the accessing machine and move traffic over encrypted single-port ingress at animefu.space:3680. TCP/UDP bind prints a short 6-character access code, for example ABC123. HTTP/WS bind prints a public URL instead. The Linux ARM64 build is NativeAOT/no-CoreCLR to avoid low-memory GC heap startup failures.

Linux x64Linux ARM64Windows x64 EXEWindows x64 ZIPTermux CLIAndroid APK

Pixel install note: if Android says “App not installed,” uninstall the old ClawTunnel app first, then install this APK again. Android package installer is dramatic about stale local builds.

All downloadable clients now use raw TCP/UDP access port animefu.space:3680 and 6-character access codes.

Downloads

Current hashes

fb826580e85e70a9140bdaf1b35e00181ecd6407ef32f7f122e5914165a867f9  clawtunnel-linux-x64.zip
05021a72275ee1e629a412d692fffd505e9d517a70119442ee6b0c8557c6b356  clawtunnel-linux-arm64.zip
beefb0f02b71a37b63801c8036304450f126a7f03592ef2ca23232899b335fef  clawtunnel-windows-x64-current.exe
5d7fd0e165eeb787168788f3cfcdaaeab6770fc9b5ae1599e86faf67e0f18d68  clawtunnel-windows-x64-current.zip
cb77cf2234050f26aebdeab6ac8bac73ac63074430c99e8e9ce705288181e2d6  clawtunnel-current.py
68f9aa1b4576c79d0b99597e0cf78377e93226d646169884f03a44ab2ba52d07  clawtunnel-windows-x64.zip
725dc9d5faa7dcf5d34df2646692630cbc14fe9a066ae0fbc65b893cbe38bfb3  clawtunnel-source.zip
d1451a14817533890f8394471fbdf16b4280b39e29831355c559da199dd60d4e  clawtunnel-android-source.zip
aca1cda73bff205f91e2595b932393f1bc1d77c45051c4cba793557daf7ce5c4  clawtunnel-android-0.5.2-arm64-release.apk
2fbc011496cf3f0a5068091d13767abcadf4e45831dcef2382565d50805b3f9a  clawtunnel-termux-v0.5.5.zip

Signup is required to bind public tunnels

Anyone can create a tunnel after signing up on the website or official Android app. Anonymous binds are rejected. Signup returns your personal bind token.

VPN/proxy warning: signup cannot be completed from a VPN, proxy, or datacenter/hosting network. Turn off VPN/proxy before creating the account. Login and tunnel access can still be used normally after you have a token.

Signup result will appear here. Keep your token private.

After signup, export the token and bind SSH/TCP:

export CLAWTUNNEL_TOKEN='TOKEN_FROM_SIGNUP'
./clawtunnel bind --mode tcp --name phone-ssh --server wss://claw.animefu.space --target 127.0.0.1:8022

Android app signup is also allowed and uses the same VPN/proxy/datacenter block. CLI signup is disabled on purpose. Use the website form or Android app. CLI login still works for existing accounts:

./clawtunnel login --email you@example.com

HTTP website bind

Use this when you want a normal public website URL.

CLAWTUNNEL_TOKEN=*** ./clawtunnel bind \
  --mode http \
  --name demo \
  --server wss://claw.animefu.space \
  --target http://127.0.0.1:9000

Public URL: https://demo.animefu.space/

Browser WebSocket / WSS bind

Use this when browser JavaScript needs to connect directly with wss://.

CLAWTUNNEL_TOKEN=*** ./clawtunnel bind \
  --mode ws \
  --name echo \
  --server wss://claw.animefu.space \
  --target ws://127.0.0.1:8765/ws

Public WSS URL: wss://echo.animefu.space/ws

Encrypted TCP bind/access

On the machine hosting the service:

CLAWTUNNEL_TOKEN=*** ./clawtunnel bind \
  --mode tcp \
  --name sshbox \
  --server wss://claw.animefu.space \
  --target 127.0.0.1:22

It prints an access code. On the client machine:

./clawtunnel access \
  --server animefu.space:3680 \
  --code GENERATED_CODE \
  --listen 127.0.0.1:2222

Then point the app at the local listener:

ssh -p 2222 user@127.0.0.1

Encrypted UDP bind/access

On the machine hosting the UDP service:

CLAWTUNNEL_TOKEN=*** ./clawtunnel bind \
  --mode udp \
  --name game \
  --server wss://claw.animefu.space \
  --target 127.0.0.1:7777

On the client machine:

./clawtunnel access --udp \
  --server animefu.space:3680 \
  --code GENERATED_CODE \
  --listen 127.0.0.1:7777

Your game/client connects to 127.0.0.1:7777/udp.

Linux ARM64 notes

The ARM64 zip now ships a NativeAOT binary plus a diagnostic launcher. Run `./clawtunnel --help`; if it prints nothing, run `CLAWTUNNEL_DEBUG=1 ./clawtunnel --help`. It should not throw GC heap initialization failed or Failed to create CoreCLR. If your device instead says No usable version of libssl was found, install OpenSSL runtime libs: Debian/Ubuntu sudo apt install libssl3; Alpine apk add openssl-libs.

Compatibility aliases

Security model