---
title: Tunnels
description: Expose OpenChamber safely for remote and mobile access.
---

# Tunnels

A tunnel is a public link to your OpenChamber, so you can reach it from an ordinary browser on another network. Use `openchamber tunnel` to create one for a running instance.

> Connecting your **own devices** (the mobile app, another desktop) usually doesn't need a tunnel — [pair them](/connect-devices/) instead and let the end-to-end encrypted [Private Relay](/private-relay/) handle away-from-home access with zero setup.

## Prerequisites

OpenChamber starts the tunnel provider CLI on your machine. Install the provider you want to use first:

```bash
brew install cloudflared
brew install ngrok
```

Cloudflare quick tunnels can run with `cloudflared`. Ngrok requires an ngrok account and an authtoken from the ngrok dashboard:

```bash
ngrok config add-authtoken <your-ngrok-token>
```

## Quick start

1. Start OpenChamber:

```bash
openchamber
```

If you skip this step, `openchamber tunnel start` can auto-start a CLI server. When auto-starting, you can pass server options such as `--port`, `--host`, `--lan`, `--ui-password`, and `--api-only`.

2. Start a Cloudflare tunnel:

```bash
openchamber tunnel start --provider cloudflare --mode quick
```

Or start an Ngrok tunnel:

```bash
openchamber tunnel start --provider ngrok --mode quick
```

3. Check status:

```bash
openchamber tunnel status
```

When the tunnel is up, `status` shows a public URL. Open it, or scan the QR code, to reach OpenChamber from anywhere.

By default, OpenChamber prints a QR code in interactive TTY sessions. Use `--qr` to force QR output, or `--no-qr` to disable it.

## Providers

- `cloudflare`: quick, managed remote, and managed local modes
- `ngrok`: quick mode

## Managed modes

### Managed remote

Use a token + hostname managed by Cloudflare:

```bash
openchamber tunnel start --provider cloudflare --mode managed-remote --token-file ~/.secrets/cf-token --hostname app.example.com
```

### Managed local

Use a local `cloudflared` config:

```bash
openchamber tunnel start --provider cloudflare --mode managed-local --config ~/.cloudflared/config.yml
```

## Profiles (managed-remote)

Save a reusable profile:

```bash
openchamber tunnel profile add --provider cloudflare --mode managed-remote --name prod-main --hostname app.example.com --token-file ~/.secrets/cf-token
```

Start using the saved profile:

```bash
openchamber tunnel start --profile prod-main
```

## Useful commands

```bash
openchamber tunnel providers
openchamber tunnel ready --provider cloudflare
openchamber tunnel ready --provider ngrok
openchamber tunnel doctor --provider cloudflare
openchamber tunnel doctor --provider ngrok
openchamber tunnel stop --port 3000
```

## Behavior notes

- one active tunnel per OpenChamber instance (port)
- starting a new mode/provider on same instance replaces previous tunnel
- generating a new connect link revokes previous unused one
- tunnel auto-start preserves server flags like `--ui-password` and `--api-only` in the instance settings used by restart/update flows

## Related

- [Connect a Device](/connect-devices/) — pair your own devices without a public URL
- [Security](/security/) — protect the UI before exposing it
- [Desktop Tunnels](/desktop-tunnels/) — desktop app tunnel setup without CLI startup
- [PWA & Mobile](/mobile/) — reach OpenChamber from your phone
- [Troubleshooting](/troubleshooting/) — if the tunnel link doesn't work