Home / Egress and tunnels
Holesail
holesail.io/P2P tunnelegress/holesailJSONcomparereport an errorprovider JSON
- Free allowance
- Holesail is the world's first truly peer-to-peer proxy for TCP and UDP ports.
- Verdict
- self-hosted, last resortverdict qualifies-with-caveat: usable, with a named limit or an unprobed read path. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- free tier
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented5 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-04checked 2026-11-04 (live); stale on 2026-12-04
| Free tier | Holesail is the world's first truly peer-to-peer proxy for TCP and UDP ports. No port forwarding, servers or configuration required. unit unlimited; metered on none |
|---|
| Price | USD 0 |
|---|
| Limits | - per-ip-shaping no quota: the vendor documentation lists 'Unlimited bandwidth' with 'No artificial limits or throttling'; throughput is whatever the two peers' paths allow source
|
|---|
| Binding | none Nothing meters the bytes, so at 1 TiB/month the limit is the peer's uplink and NAT behaviour, not a vendor counter. |
|---|
| Identity | anonymous No account, email or card: the connection string is a public key derived from a keypair the client generates. |
|---|
| Egress | No allowance exists: the bytes travel between the two peers, and the public DHT only coordinates the holepunch.; ingress: tcp+udp free allowance: none published |
|---|
| Interface | cli npm i holesail -g; holesail --live 3000 prints an hs:// connection string. |
|---|
| Tooling | npm i holesail -g; holesail --live <port> then holesail <connection-string>. |
|---|
| Composes with | Carries a WireGuard handshake between a free VM and a laptop without opening a port on either, at the cost of installing a client on both ends. |
|---|
| Reliability | Depends on public HyperDHT bootstrap nodes; symmetric NAT defeats the holepunch and falls back to TCP, which breaks UDP-only protocols. |
|---|
| Notes | Not a hosted ingress: a third party cannot connect unless they run holesail with the connection string. It qualifies as free UDP capacity between two machines a user controls, which covers a WireGuard endpoint only if the far side also runs it. |
|---|
| Evidence note | documented A measured transfer between two peers behind different NATs would show the real throughput and whether the DHT path holds; that is the missing rung. |
|---|
| Parsed numbers | - has-free-tier 1
- price USD 0
|
|---|
Evidence 5
| date | source | what it proved |
|---|
| 2026-10-23 | github.com/holesail/holesail | Peer-to-peer proxy for TCP and UDP; npm install; connection string replaces a public address. |
| 2025-12-03 | news.ycombinator.com/item?id=46131627 | Launch post: no port forwarding, no VPNs, no servers in the middle, supports both UDP and TCP. |
| 2026-10-23 | news.ycombinator.com/item?id=46172495 | Mechanism: peers announce to HyperDHT, DHT nodes coordinate a UDP holepunch, then UDX carries the data; TCP fallback exists. |
| 2026-11-03 | docs.holesail.io/ | the vendor documentation lists unlimited bandwidth with no artificial limits or throttling |
| 2026-11-04 | docs.holesail.io/ | the documentation lists unlimited bandwidth with no artificial limits or throttling |
More fields 6
| wg path | inside-udp |
|---|
| wg detail | The transport after holepunching is UDX, a custom UDP protocol, with a TCP fallback. A WireGuard datagram can ride that path between two peers running holesail. |
|---|
| ingress | tcp+udp |
|---|
| volume stated | No allowance exists: the bytes travel between the two peers, and the public DHT only coordinates the holepunch. |
|---|
| bytes transit | overlay-only |
|---|
| transit note | Bytes go peer to peer after holepunching; only coordination metadata crosses the public DHT. |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer