Home / Egress and tunnels
arena-tunnel
github.com/dc-holdings-spa/arena-tunnelTool (wireguard transport)egress/arena-tunnelJSONcomparereport an errorprovider JSON
- Free allowance
- No service and no account; AGPL-3.0 source with static binaries, described as "Free public ingress through any CDN"
- Verdict
- self-hosted, last resortverdict paid-only: no free allowance; listed for its price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- no price statedsee Price below
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented4 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | no service and no account; AGPL-3.0 source with static binaries, described as "Free public ingress through any CDN" unit none; metered on none |
|---|
| Price | USD 0 |
|---|
| Binding | none the constraint is a WireGuard server host plus a way to publish an HTTP port, which is the same host requirement as every other wrapper |
|---|
| Identity | anonymous no account for the DIY path; the vendor's own deployment adds a browser pairing flow with a signed-in identity |
|---|
| Egress | not applicable; the tunnel's ceiling is the CDN's, and the README states none; ingress: tcp free allowance: none published |
|---|
| Interface | cli arena-tunnel client and arena-tunnel-server |
|---|
| Tooling | single Go binary per platform, cloudflared or any HTTP publisher in front |
|---|
| Composes with | the intended composition is cloudflare-tunnel Free in front of arena-tunnel-server, which makes an HTTP-only hosted tunnel carry WireGuard for the first time without a paid plan. |
|---|
| Reliability | new and lightly used; client needs root for the TUN device; one WebSocket per session means a dropped TCP connection restarts the tunnel |
|---|
| Notes | The clearest statement's central problem: "Most free CDNs (Cloudflare Free, Fastly, Bunny) only proxy HTTP/WS", so WireGuard has to be framed into WebSocket to use them. Released two days before this read, four stars, single purpose. It still needs the WireGuard server host, so its claim of no VPS rental assumes the reader already has somewhere to put the server half. Frame-per-datagram framing avoids putting a length-prefixed stream in the datagram path, but the websocket still rides TCP. |
|---|
| Evidence note | documented a measured run behind a free Cloudflare Tunnel would raise it, and is the single most useful measurement leaves open |
|---|
| Parsed numbers | - has-free-tier 0
- price USD 0
|
|---|
Evidence 4
More fields 9
| wg path | none |
|---|
| wg detail | "encapsulating each WireGuard UDP datagram inside one binary WebSocket frame"; a user runs wireguard-go locally and the server hands frames to a local WireGuard interface |
|---|
| ingress | tcp |
|---|
| volume stated | not applicable; the tunnel's ceiling is the CDN's, and the README states none |
|---|
| bytes transit | yes |
|---|
| transit note | through cloudflared and Cloudflare's edge, then to the server half |
|---|
| hosting requirement | a WireGuard server host plus cloudflared or another HTTP publisher; a user half needs root for a TUN device |
|---|
| last release | v1.2.1 2026-10-21 |
|---|
| stars | 4 |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer