Merakit Tunnel makes apps on your local network reachable from the internet through a public address. Your device does not need a public IP, and you do not need to open ports on your router. Everything is configured from the Tunnel menu in the Merakit console portal.
How It Works
- The Merakit agent is installed on a device that can reach your app, such as an office server, a Linux laptop, or a Raspberry Pi.
- The agent makes an outbound connection to the Merakit gateway through an encrypted WireGuard tunnel.
- A visitor opens the public address. The gateway checks access, forwards the request through the tunnel to the device, and the device forwards it to the target app.
The tunnel’s private key is generated on the device and is never sent out.
Device Requirements
| Requirement | Details |
|---|---|
| Operating system | Linux with systemd: Ubuntu, Debian, Raspberry Pi OS, or a Proxmox host |
| Architecture | amd64 or arm64 |
| Network | Outbound internet access. Outbound UDP is used for the tunnel. |
| Target app | Reachable from the device, on the device itself or on the same network |
Getting Started
- Sign in to the Merakit console and open the Tunnel menu.
- Choose Add device, name the device (for example
office-server), then choose Create install command. - Run the command shown in the device’s terminal:
curl -fsSL https://console.merakit.co.id/install.sh | sudo MERAKIT_TOKEN=<token-from-console> sh- Wait until the device status changes to Connected.
- Choose Add address, fill in the address and target, then save.
The install token is secret. Do not share it publicly.
Writing the Target
The target is written as address:port as seen from the device running the agent.
| App | Target |
|---|---|
| App on the device itself | 127.0.0.1:3000 |
| App on another server on the same network | 192.168.1.20:80 |
| App that already uses HTTPS | https://192.168.1.10:8006 |
For HTTPS targets with self-signed certificates, such as a Proxmox panel, leave Target must have a trusted certificate unchecked. Check it when the target uses a trusted certificate and you want the gateway to verify it.
Public Addresses
There are two address options:
- Merakit subdomain: enter a name, for example
client-demo, so the address becomesclient-demo.tunnel.merakit.my.id. It goes live immediately. - Your own domain: enter the full domain, for example
attendance.myoffice.id. It goes live after the domain is verified.
Verifying Your Own Domain
Add these two records at your domain’s DNS provider. The token and the gateway IP are shown in the console on the address row awaiting verification.
TXT _merakit.attendance.myoffice.id → merakit-verify=<token-from-console>
A attendance.myoffice.id → <gateway IP from the console>Once the records are saved, choose Verify. The HTTPS certificate is issued automatically a few seconds after verification.
Access Protection
Each address can have extra protection under Access protection:
- Username and password: visitors must enter credentials before the request is forwarded to the device.
- Allowed IPs only: enter allowed IPs or ranges separated by commas, for example
203.0.113.7, 10.0.0.0/8. Leave it empty to allow all IPs.
Rejected requests stop at the gateway and never reach your device.
Example Configurations
| Need | Target | Address | Suggested protection |
|---|---|---|---|
| Office Proxmox panel | https://192.168.1.10:8006 | pve.myoffice.id | Office IP only |
| Attendance app on a LAN server | 192.168.1.20:80 | attendance.myoffice.id | The app’s own login |
| Prototype demo from a laptop | 127.0.0.1:3000 | client-demo.tunnel.merakit.my.id | Password |
| Sensor dashboard on a Raspberry Pi | 127.0.0.1:1880 | warehouse-sensors.tunnel.merakit.my.id | Password |
| Payment webhook testing | 127.0.0.1:8000 | webhook-dev.tunnel.merakit.my.id | No extra protection, remove after testing |
Usage and Billing
- Rp1,000 per GB with a free quota of 5 GB per month per organization. Months follow WIB (UTC+7).
- Usage counts HTTP data passing through the gateway, in and out. Tunnel protocol overhead is not billed. 1 GB = 1,000,000,000 bytes.
- Charges are deducted hourly from your balance.
- A monthly cap keeps usage within budget.
- Data flow, response time, and response status charts are available in the Tunnel menu. Hourly details can be downloaded as CSV.
Address Status
| Status | Meaning | What to do |
|---|---|---|
| Active | The address is reachable | Nothing |
| Waiting for device | The agent is not installed or not connected | Run the install command on the device |
| Domain verification | The TXT record was not found | Check the DNS record, then choose Verify |
| Paused · balance | Not enough balance | Top up; the address resumes automatically |
| Paused · monthly cap | Usage reached the monthly cap | Raise the cap or wait for next month |
| Paused | Paused manually | Choose Resume |
Troubleshooting
- Device shows as disconnected: outbound UDP is usually blocked by a firewall or the network. Make sure the device can send UDP out, then check the logs with
journalctl -u merakit-agent -f. - Visitors see a 502 error: the target app is not running or the target is wrong. Try opening the target from the device, for example with
curl http://127.0.0.1:3000. - HTTPS target fails: if the target uses a self-signed certificate, make sure the trusted certificate option is unchecked.