relaynet

Raw networking for the browser.

Browsers can speak HTTP, WebSocket and WebRTC, but not plain TCP or UDP. relaynet carries Ethernet frames over a WebSocket, so code in a page that has its own TCP/IP stack (a virtual machine, an emulator, or a user-space stack compiled to WebAssembly) gets DHCP, DNS, TCP and UDP to the public internet. Your sessions also share a private network, so a browser tab can reach a machine you run elsewhere.

relaynet is in an invite-only beta. Sign in, then redeem your invite code. By signing in you agree to the Terms and Acceptable Use Policy.

See what it is for

What it is for

Browser VMs and emulators

v86, Linux or Zephyr compiled to WebAssembly: the guest runs DHCP and then uses apt, git and curl as usual.

Remote shells

An SSH client in a page connects straight to port 22 of any public host. Encryption is end to end; the relay carries ciphertext and never holds your keys.

USB/IP and device sharing

A page that reads a device through WebUSB serves it over USB/IP, and a Linux machine on your account's network attaches it with usbip. Best for low-bandwidth devices: serial adapters, keys, debug probes.

Debug protocols

Connect a web IDE to a GDB server or OpenOCD, or bridge a probe the browser holds through WebUSB to gdb on another machine of yours.

KVM and consoles

VNC (RFB), IPMI and serial-over-TCP consoles of hosts with public addresses, or of a LAN reached through a machine of yours joined to your account's network.

Custom and peer-to-peer protocols

TCP and UDP to any public port except mail: WireGuard, QUIC, libp2p, Noise-based and game protocols that browsers cannot speak directly.

Is it the right tool?

A good fit when

  • You need TCP, UDP or whole Ethernet frames to hosts you do not control.
  • Your code already has an IP stack: a VM kernel, or lwIP, smoltcp or gVisor's netstack in WebAssembly.
  • You want encryption to the real endpoint, not a proxy that terminates TLS.
  • Two ends you own should share a small private network without opening inbound ports.

Use something else when

  • You run the server and only need a byte stream: a plain WebSocket or WebTransport needs no IP stack and saves a hop.
  • Browsers talk to each other, especially audio and video: WebRTC is peer to peer and faster; relaynet always relays through California.
  • You call HTTP APIs: use fetch.
  • You need your home or office LAN, or inbound connections from the internet: use a VPN or tunnel (WireGuard, Tailscale, Cloudflare Tunnel). relaynet has no inbound ports and blocks private addresses.
  • You move bulk data or need low latency far from California: sessions are capped at 1 MiB/s.
  • You need IPv6, ping to the internet, multicast or port 25: not supported.

How it works

1. Get a token

Sign in with your invite and create an API token from your dashboard.

2. Open the WebSocket

Connect to wss://relay.relaynet.network with the token in the subprotocol list. Ethernet frames go in, Ethernet frames come out.

3. Bring an IP stack

The relay answers DHCP and ARP and forwards TCP and UDP. Plug in a VM's network card, a user-space TCP/IP stack, or a bridge to a TAP device on a machine you run.

Connecting from a page

const ws = new WebSocket("wss://relay.relaynet.network", [
  "relay.v1",
  "relay.token." + token,   // an API token from your dashboard
]);
// hand `ws` to your VM's network card or your TCP/IP stack

Browsers cannot set headers on a WebSocket, so the token travels as a subprotocol entry. Non-browser clients may send Authorization: Bearer instead.

Beta account

  • Long-lived API tokens, up to 4 concurrent sessions
  • Any port except mail, 1 MiB/s each direction
  • 12 hour sessions, 20 GB per month