How to expose localhost to the internet
You built something locally — a Next.js app, a webhook receiver, a Flask API — and you need someone on the other side of the world to reach it. Your home router doesn't have a public IP. Your laptop sleeps. Your ISP blocks inbound port 80. This is the "expose localhost" problem, and there are four honest ways to solve it.
Option 1: A tunnel (fastest, what most people want)
A tunnel is a program that opens an outbound connection to a public server and tells it "any traffic arriving for this subdomain — send it back down this pipe to me." Your laptop never accepts inbound connections. The public server does.
This is what TezTun, ngrok, Cloudflare Tunnel, and localtunnel all do. The differences are in who runs the public server, how much you pay, and what the URL looks like.
$ teztun http 3000
Tunnel is active!
HTTPS: https://a3f8k2x9.ttn.uz → localhost:3000Good for: webhook testing, sharing work-in-progress with a client, demoing to a remote reviewer, IoT prototypes.
Bad for: production traffic, anything latency-sensitive where a round trip through someone else's server matters.
Option 2: Port forwarding on your home router
If you own the router and your ISP gives you a public IP, you can forward port 80/443 from the router to your machine. It works, it's free, and it's also a firehose of problems: your home IP changes, port 80 is almost always blocked on residential plans, TLS certificates for dynamic DNS hostnames are fiddly, and you're exposing a machine on your LAN to the open internet.
Use this if you run a home lab and know exactly what you're doing. Skip it otherwise.
Option 3: A reverse proxy on a VPS
Rent a $5 VPS, run Caddy or nginx on it, and use SSH reverse port forwarding to pipe traffic from the VPS down to your laptop:
ssh -R 0.0.0.0:8080:localhost:3000 [email protected]This is — literally — a tunnel. You're just the one operating both ends. Good if you want full control and don't mind the ops work. Painful if you want multiple tunnels, clean subdomains, auto-HTTPS, or a UI.
TezTun provides a hosted alternative: we operate the public tunnel servers, and you run the client alongside your local app. More on how tunnels actually work.
Option 4: A VPN
WireGuard or Tailscale lets you put your laptop on a private network with the person who needs to reach it. Great for small, trusted groups. Useless for "anyone with a link can see my demo" because every viewer has to install a VPN client and accept a peer.
Which one should you pick?
- Sharing a link with one or two people, right now → a tunnel.
- Testing webhooks from Stripe, GitHub, Telegram → a tunnel, every time.
- Permanently hosting something from your laptop → don't. Put it on a VPS. Your laptop will sleep.
- Small trusted team → Tailscale.
What to look for in a tunnel
Not all tunnels are equal. Things that matter in practice:
- Stable URL. If it changes on every restart, your Stripe webhook config is broken every time you reboot.
- Custom domain support.
a3f8k2x9.ttn.uzis fine for testing;myapp.comis what you show a client. - HTTPS by default. Most modern APIs refuse to call plain HTTP callbacks.
- Request inspector. TezTun's local inspector keeps the last 100 requests in memory with headers and captured bodies. It is a debugging view: it does not persist or replay requests.
- Cost. Compare hosted-service fees with the infrastructure and maintenance costs of self-hosted tools. TezTun's hosted service is free through December 31, 2027.
- Who owns the server. Every byte of your traffic passes through it. Pick accordingly.
Starting with TezTun
TezTun is free through December 31, 2027. New accounts receive Max access, including reserved stable subdomains and custom domains. Download the binary, create an account, and run teztun http 3000.