v2.0.9

Lantunnel v2.0.9

Built from 6f994e1475a740d65244a4c050dabbb1775bf1c1. The attached packages and checksum manifest are the exact files accepted by the release workflow.

Choose a download

Client — connect this device

Client is the right download for most people. Use the same Client program on every Peer, with the default desktop UI or --headless.

Download	Platform	Trust note
Windows x64	Windows 10 or later	Intentionally unsigned preview
macOS Intel	Intel Mac	Signed, notarized, and stapled
macOS Apple Silicon	Apple Silicon Mac	Signed, notarized, and stapled
Linux x64	64-bit Intel/AMD Linux	Verify SHA-256
Linux ARM64	64-bit ARM Linux	Verify SHA-256

Gateway — relay and coordinate a Tunnel

Install Gateway only when you operate an independent or Platform-connected Gateway host.

Download	Platform
macOS Apple Silicon	Apple Silicon Mac
Linux x64	64-bit Intel/AMD Linux

Admin — create independent Tunnel files

Admin is only for offline provisioning with an independent Gateway; Connected Gateway and Lantunnel Gateway modes do not use it.

Download	Platform
macOS Apple Silicon	Apple Silicon Mac
Linux x64	64-bit Intel/AMD Linux

Trust and signatures

• macOS Client DMGs are Developer ID signed, notarized, and stapled.
• The Windows Client executable is an intentionally unsigned preview; Windows may show Unknown publisher. Verify its SHA-256 before running it.
• Gateway and Admin command-line binaries and Linux AppImages are not code-signed. Verify their SHA-256 before running them.
• macOS Gateway and Admin CLI binaries are unsigned and not notarized. If Gatekeeper or an organization policy blocks one, build it from source. Do not bypass Gatekeeper or an organization policy.

Install

Client

• Windows: download the .exe, verify it, and run it. Review the Windows security prompt before continuing.
• macOS: open the .dmg, drag Lantunnel Client to Applications, then open it from Applications.
• Linux: make the AppImage executable with chmod +x <downloaded.AppImage>, then run it.

Gateway and Admin

Verify the downloaded CLI, make it executable, rename it to lantunnel-gateway or lantunnel-admin, and place it on the appropriate machine's PATH.

System requirements

• Windows 10 or later on x86-64.
• macOS 10.15 Catalina or later on Intel.
• macOS 11 Big Sur or later on Apple Silicon.
• 64-bit Linux on x86-64 or ARM64; the desktop Client requires GTK 3 and WebKitGTK 4.1.
• Gateway and Admin packages are available for Apple Silicon macOS and x86-64 Linux.

Verify SHA-256

Download your chosen file and checksums.txt. Set FILE to the downloaded filename, then verify only its matching entry.

Linux:

FILE=lantunnel-client-2.0.9-linux-amd64.AppImage
grep "  ${FILE}$" checksums.txt | sha256sum --check --strict -

macOS:

FILE=lantunnel-client-2.0.9-macos-arm64.dmg
grep "  ${FILE}$" checksums.txt | shasum -a 256 --check -

Windows PowerShell:

Get-FileHash .\lantunnel-client-2.0.9-windows-amd64.exe -Algorithm SHA256
Select-String -Path .\checksums.txt -Pattern 'lantunnel-client-2.0.9-windows-amd64.exe$'

The two displayed SHA-256 values must match. The complete accepted changelog is also attached as CHANGELOG.md.

Choose an installation mode

1. My Gateway — deploy your own independent Gateway; no lantunnel.app account is involved.
2. Friend's Gateway — own your Tunnel while a friend operates the independent Gateway.
3. Connected Gateway — connect your own or a friend's Gateway to the lantunnel.app Platform.
4. Lantunnel Gateway — install only Client while Lantunnel operates the Gateway.

Lantunnel Gateway quick start

1. Create your account.
2. Create a Tunnel in the Dashboard and keep its Tunnel ID.
3. Create a separate Peer for every device, then download that device's private .peer profile. Never share or reuse a Peer profile.
4. Install Client on each device, import its own profile, and connect with its Tunnel ID.
5. Keep Client running. It prefers a Direct path and falls back to Encrypted Relay when Direct connectivity is unavailable.

See the full Lantunnel Gateway quick start for the complete walkthrough.

What changed in 2.0.9

Added

• lantunnel-gateway init --public-ip <PUBLIC_IP> now prepares an independent Gateway in
  one local command. It writes the runtime config, a persistent self-signed certificate and
  key, and the Scope directory without contacting lantunnel.app.
• The command defaults to QUIC on UDP 8443 with mapping on UDP 8444; --mapping-port selects
  another mapping port, and lantunnel-admin init-tunnel --gateway-mapping-port records the
  same fact in independent Peer profiles. Repeating the same command preserves the existing
  identity; changed listener facts at the same config path are refused instead of replacing
  a certificate already pinned by Peer profiles. Hostname and public-CA setups remain manual.

Fixed

• A settings file the Client could not read no longer leaves this machine open
  to the rest of your Tunnel. Settings that could be read but not applied
  already fell back to refusing everything; a file with a stray character, a
  setting name that no longer exists, or a value of the wrong type skipped that
  fallback and started the Client on defaults instead — and a Client nobody has
  configured is reachable by every Peer holding a profile for its Tunnel. Both
  cases now refuse incoming access and say so in Settings, and a file that is
  simply absent still opens, so a fresh install is reachable as before. Your
  saved file is left untouched either way, so it can be repaired by hand.