L4 Tunnel
L4 Tunnel (BYOS)
GRE tunnels between your own servers — game traffic through a private pipe.
How it works
01
Pick two of your servers
An edge (front) and an origin (backend) from your fleet. We configure both ends.
02
We build the tunnel
The daemon configures GRE with policy routing on both boxes — traffic enters the edge, exits the origin with real client IPs.
03
Route what you want
TCP/UDP port ranges, per-source rate limits, and live byte/packet metrics per tunnel.
Features
Real client IPs
Transparent forwarding — the origin sees the true source, no PROXY protocol needed.
Port-range mapping
Expose exactly the ports you choose, TCP and UDP.
Rate limiting
Per-source packet/connection caps enforced with nftables meters.
Live metrics
Per-tunnel traffic charts with 1-minute resolution, 48h retention.
Silent features
The parts nobody advertises but everybody relies on.
Collision-proof naming
Tunnel IDs are namespaced so BYOS and platform objects never collide on one box.
Daemon-managed state
Tunnels are recreated idempotently on every apply — reboots and re-runs converge, not duplicate.
Fail-closed teardown
Removal cleans rules, routes and interfaces — nothing lingers to leak.