Home / Egress and tunnels
Freehold
github.com/maceip/freeholdPublic anycast relay (QUIC/H3)egress/freeholdJSONcomparereport an errorprovider JSON
- Free allowance
- Your service is now reachable at freehold.lit.app:8080.
- Verdict
- fails: egressdata cannot be read back out at a usable rate or price
- Cost
- not statedsee Price below
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- inferred3 sources; reasoned from other evidence
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | Your service is now reachable at freehold.lit.app:8080. unit none; metered on unstated |
|---|
| Price | USD 0 |
|---|
| Limits | - volume-quota no byte allowance published for the public relay source
|
|---|
| Binding | none The relay is a public anycast endpoint with no published quota; what stops the UDP test first is the data path, which is described as QUIC/H3 rather than a raw datagram forward. |
|---|
| Identity | anonymous No account: the client registers itself with the relay over UDP and completes an HMAC challenge. |
|---|
| Egress | No byte allowance is published for the public relay: 'Test the public relay without installing anything.'; ingress: http-only free allowance: none published |
|---|
| Interface | cli 'freehold --relay freehold.lit.app:9999 --port 8080 --backend 127.0.0.1:3000' |
|---|
| Tooling | The freehold Rust client; the relay itself needs a Linux host with eBPF and root, which is the operator's problem and not a user's |
|---|
| Composes with | Nothing to chain until the datagram question is settled. |
|---|
| Reliability | NAT traversal is best-effort: the port spray 'opens Bob's NAT' only if the carrier allocates ports sequentially, and traffic falls back to the relay otherwise. |
|---|
| Notes | A free public anycast relay that a client can register with anonymously is the only such relay found. What it exposes is an HTTP/3 service on a shared anycast name: the README diagram shows a QUIC request being rewritten, not a raw datagram being forwarded, and the client software is a Rust binary, not a tunnel daemon. If that reading is wrong, this becomes the strongest lead of its kind, which is why the reading is labelled inferred and not treated as settled. |
|---|
| Evidence note | inferred This is a reading of the architecture diagram and the feature list, not a test. |
|---|
| Parsed numbers | |
|---|
Evidence 3
| date | source | what it proved |
|---|
| 2026-10-23 | github.com/maceip/freehold | 'Give any device a real public IP address. Host services that browsers trust - not tunnel URLs.' |
| 2026-10-23 | github.com/maceip/freehold | 'This relay announces the 142.248.222.0/24 anycast prefix.' and 'A public relay is available at freehold.lit.app:9999' |
| 2026-10-23 | github.com/maceip/freehold | The data path is 'Browser (Alice) ... QUIC/H3 request ... XDP SNAT+DNAT', and the feature list names 'Optional HTTP/3 reverse proxy with automatic TLS' |
More fields 6
| wg path | none |
|---|
| wg detail | No WireGuard; the relay terminates QUIC and rewrites addresses with XDP. |
|---|
| ingress | http-only |
|---|
| volume stated | No byte allowance is published for the public relay: 'Test the public relay without installing anything.' |
|---|
| bytes transit | yes |
|---|
| transit note | The relay's XDP program forwards to the registered client, or a user and peer go direct after a successful punch. |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer