How it works
Four steps, a few minutes
Both ends make an ordinary outbound connection and meet in the middle. Nothing is opened on either firewall, and nothing is installed into either operating system — it is one binary, run by an ordinary user.
Once, on your own machine
Run finder with one command from app.piertun.com. It downloads a single binary into your own user profile and puts it on your PATH — no admin rights, and your PATH is the only thing it touches. Type finder to open it.
Authenticate finder
Generate a token at app.piertun.com and enter it in finder. The token is the credential, it works once, and it expires in minutes — so one that leaks later is worth nothing to whoever finds it.
Create a tunnel
Name the tunnel, then choose how the connector gets onto the remote machine: a direct token, or a prepared curl, wget, or PowerShell command. It is copied to your clipboard.
Deliver the command
The operator at the remote machine runs it in a terminal. No installer, no administrator rights, no configuration — the tunnel appears in finder a few seconds after the one-liner runs.
Define a connection
Give it a destination — a host and port the remote machine can reach — and a local port to expose it on. Your tools connect to localhost and land on the far side. One tunnel carries as many of these as you need.
The mechanism
Why an inbound connection usually fails
Routers and internet providers share one public address between many machines, so there is often no address an incoming connection could even be aimed at. Instead of trying to receive a connection, both ends make an ordinary outbound one — exactly like a browser does — and meet in the middle. Nothing is opened, nothing is forwarded, and neither machine ever accepts an unsolicited connection from the internet.
The signalling service
It introduces the two ends to each other and then steps out of the data path. It knows that a connection happened; it does not carry what goes through it.
The direct path
Whenever the network allows it, the two machines hold an encrypted peer-to-peer connection with nothing in between — the fastest path and the smallest surface.
The relay fallback
Where no direct path exists, an encrypted relay forwards packets it holds no key to open. You lose some latency; you do not lose confidentiality.
Installing the connector
Run it on the remote machine
One line, pasted by whoever is sitting at the machine. The token in the link is generated by your finder and is short-lived.
Windows PowerShell
irm "https://piertun.com/connector/windows/powershell?token=<token>" | iexLinux
curl -fsSL "https://piertun.com/connector/linux/bash?token=<token>" | bashIt writes one binary into the user's own profile. No administrator rights, no driver, no network adapter, nothing registered with the operating system.
Questions
What people ask about the mechanism
How long does the install link stay valid?
Minutes, by design, and it works once. Once the window closes the script refuses to run and you generate a new one from the finder, so a link that leaks later is worthless.
Can something reach my machines over HTTP?
No. The web service carries signalling and the tunnel’s own settings — ports, addresses, names — so you do not retype them every session. No request to it can open a connection or start a tunnel; the connector only acts on what the finder sends it inside the tunnel itself.
What is left on the remote machine afterwards?
Nothing that was not there before: no service, no boot entry, no driver, no firewall or routing change. Close the tunnel and the machine is as it was.
What happens if the network drops?
The tunnel drops on its own. Connector will ask for token and finder just shows that tunnel not connected. After network drop tunnel must be restablished.
Questions about what we can and cannot see are answered on the trust page.
Two minutes, and nothing to uninstall
Create a tunnel, paste one line at the far end, and close it when you are done.
Get started — free