Security Best Practices

InTunnel is designed with security as a top priority. Follow these best practices to keep your tunnels secure.

Token Security

Your token is the key to your tunnel. Treat it like a password.

Do's

• ✅ Keep your token private
• ✅ Use environment variables to store tokens
• ✅ Regenerate tokens if compromised
• ✅ Use device binding for sensitive services

Don'ts

• ❌ Share your token publicly
• ❌ Commit tokens to version control
• ❌ Use the same token across multiple untrusted devices

Device Binding

Lock your token to specific devices to prevent unauthorized use.

How It Works

1. Go to Dashboard → Your Tunnel → Settings
2. Enable Device Binding
3. The first device to connect will be bound to that token
4. Other devices will be rejected

Resetting Device Binding

If you need to use a different device:

1. Go to your tunnel settings
2. Click Reset Device Binding
3. Connect from the new device

IP Whitelisting

Restrict tunnel access to specific IP addresses.

Use Cases

• Internal team access only
• Staging environments
• Sensitive admin panels

Configuration

1. Go to Dashboard → Your Tunnel → Settings
2. Enable IP Whitelisting
3. Add allowed IP addresses (comma-separated)
4. Save changes

TIP

You can find your public IP at whatismyip.com

Two-Factor Authentication (2FA)

Protect your InTunnel account with 2FA.

Setup

1. Go to Dashboard → Settings → Security
2. Click Enable 2FA
3. Scan the QR code with your authenticator app
4. Enter the verification code
5. Save your backup codes securely

Recommended Apps

• Google Authenticator
• Authy
• Microsoft Authenticator

HTTPS Encryption

All InTunnel tunnels use HTTPS encryption by default.

• Traffic is encrypted between users and InTunnel servers
• Valid SSL certificates are automatically provisioned
• No configuration required

INFO

Your local service can run on HTTP. InTunnel handles HTTPS on the public side.

Network Security Tips

For Development

# Only expose what you need
./intunnel -token YOUR_TOKEN -subdomain myapp -port 3000

For Production Testing

• Use IP whitelisting to limit access
• Enable device binding
• Set up proper authentication on your local service

Reporting Security Issues

Found a security vulnerability? Please report it responsibly:

• Email: security@intech-eg.tech
• GitHub: Open a private security advisory

We appreciate responsible disclosure and will acknowledge your contribution.