Skip to content
Paron
GitHub

How a tunnel works

A tunnel connects a machine to Paron when the server cannot open a connection to the machine, for example when the machine is behind NAT or a firewall.

The connection

Section titled “The connection”

The machine runs paron tunnel. This program opens one connection to the server and keeps it open. The server then uses that connection to reach services on the machine, for example the SSH server.

Paron server home network Paron tunnel Machine 1 tunnel office network Paron tunnel Machine 2 tunnel Paron tunnel Machine 3 tunnel
  • The machine does not need an open inbound port.
  • The server does not open a port for each machine. All tunnels use the address and port of the web UI.

Transport

Section titled “Transport”
Transport Use
QUIC, over UDP The tunnel tries this first.
TLS, over TCP The tunnel also tries this when QUIC does not connect in a short interval.

The tunnel keeps the first connection that it can use, and closes the other.

Paron server network allows UDP Paron tunnel Machine 1 QUIC over UDP network blocks UDP Paron tunnel Machine 2 QUIC over UDP, no answer TLS over TCP

Both transports encrypt the connection. With TCP, one lost packet delays all streams of the connection, so QUIC is better when the network allows UDP.

Identity

Section titled “Identity”

The tunnel uses TLS 1.3 with mutual authentication: each side proves that it has its private key. No public certificate authority is used. Each side accepts only a key that it already knows. This method is known as key pinning.

Paron server Machine Setup, one time 1. You copy the token from the web UI 2. The machine connects to the server 3. The server shows its certificate 4. The machine checks it against the fingerprint in the token 5. The machine shows its public key and sends the secret 6. The server checks the secret, then registers that key Every connection after that 1. The machine connects to the server 2. The server shows its certificate 3. The machine checks it against the fingerprint from setup 4. The machine shows its public key 5. The server checks it against the registered key
  • The server. The server has a root key, in the file broker-ca.key, and it signs its own tunnel certificate with that key. The token from Set up tunnel holds a fingerprint of the root key. The machine accepts only a certificate that this root key signed. A new certificate from the same root key is accepted, so the server can replace its certificate and the machines stay set up. The tunnel does not use the HTTPS certificate of the web UI for this.
  • The machine. paron tunnel bootstrap creates a key pair for the machine. In the TLS handshake, the machine proves that it has the private key. Then it sends the secret from the token. The server checks the secret, and only then registers the public key of that connection. After that, the server accepts the machine by this key. The token is not used again.

Access control

Section titled “Access control”

The server can reach only the ports and sockets that you allow. The tunnel refuses each other connection. The check is done on the machine, not on the server.

Paron server Machine Paron tunnel allows port 22 SSH server port 22 Database port 5432 tunnel SSH through it in the list not in the list

© 2026 Nicola Bovolato. Paron is source-available under the PolyForm Shield License 1.0.0.