A direct line to a machine you own, from any network.
No relay in the path, no account, nothing to install. The tunnel is clean-room WireGuard. Rendezvous runs on public infrastructure that only ever sees sealed bytes, and it crosses the CGNAT and IPv6-only carriers that defeat every port-forward.
Why it exists
Every remote-access tool I had used put a company in the path. Tailscale needs a control plane and falls back to relays that carry your packets. TeamViewer and ngrok are third parties that see the session. Raw WireGuard is honest and fast, and then it dies the moment you are behind CGNAT, or on a carrier that hands you no IPv4 and no port to forward.
Ruppler Link is the line I wanted: one I fully own, that still crosses those networks, and that opens from a browser with nothing installed.
What it is
No control plane, no DERP relay. You do not depend on anyone's servers to connect, ours included. There are none.
No third party in the data path, and no account. The session is end-to-end between your two devices, and nothing in the middle can read it.
It traverses CGNAT and IPv6-only carriers with no port-forwarding, and the far end is reachable from an unmodified browser.
How it works
Discover
Both ends learn their own public address from public STUN servers, and read the shape of the NAT in front of them.
Rendezvous
They exchange sealed connection offers over public Nostr relays. The relays carry only AES-GCM ciphertext; the box's answer is BIP340-signed by an identity you pinned at enrollment, so a relay can neither read it nor forge it.
Traverse
Both ends send at once to open their NATs, the WireGuard hole-punch. On a carrier that gives the phone no IPv4, the box's address is embedded in the carrier's own NAT64 prefix, so the carrier's translator delivers the packets. No port-forward, no UPnP, no relay.
Transport
The tunnel is clean-room WireGuard, Noise IKpsk2, end to end. The browser console rides a WebRTC DataChannel, DTLS-encrypted to the box.
Identity
Device keys are generated non-extractably in the browser and never leave it. The box is pinned on first use, the way SSH records a host key. Every enrollment link is single-use.
Proof
The hardest case, proven live: a stock Safari iPhone on a pure IPv6-only carrier reaching a home box with no public IPv6, no app, no relay, and no port-forward. A representative trace of that connection:
addresses are documentation ranges (RFC 5737). the NAT64 prefix is the well-known 64:ff9b::/96.
Status
What is proven, what is not. The tunnel does not carry real traffic until the crypto is independently audited, and this page says so.
Composition
Clean-room Rust, no third-party crypto. The primitives are a zero-dependency crate with unsafe forbidden, each checked against its RFC test vectors. The handshake is WireGuard's Noise IKpsk2, rebuilt from the whitepaper. Everything above it composes over those primitives.
Roadmap
Ruppler Link is early, and honest about where it is. The browser console works today and is the artifact you can use now. The native WireGuard data plane is built and waits on an independent crypto audit and a constant-time review before it carries real traffic.
Next: dial a machine by a stable name instead of a key, and a native client for the networks a browser cannot reach.