⚡🧅 TunnelSats for StartOS v1.0 is here!

Hi Stackers 👋

TunnelSats is a WireGuard VPN built only for Lightning node P2P traffic: paid over Lightning, with a static server IP and a forwarded port for your node. Today it lands natively on StartOS 0.4 for LND, Core Lightning and Eclair. https://marketplace.start9.com/?registry=https%3A%2F%2Fcommunity-registry.start9.com%2F

Why we built it

Tor-only nodes are private, but they are slow to reach and flaky to route through. Going clearnet from home exposes your home IP. Hybrid through a VPN is the middle ground, but on StartOS it used to mean fiddling with system-wide gateway settings, port checks and manual external host entries. We wanted it to feel like the rest of StartOS: install, click, done.

The flow

1. Install TunnelSats from the StartOS community registry.
2. Run Buy Subscription: choose the target node, a server region and 1 / 3 / 6 / 12 months.
3. The package generates a WireGuard keypair on your device. Only the public key is sent to us.
4. Pay the BOLT11 invoice: a Pay Invoice task pops up on your own Lightning node, or use any wallet.
5. Once it settles, the config is claimed and assembled on your box. No file to download.
6. Accept the 1-click clearnet-vpn task on your node. The node brings up wg0 inside its own container, listens on the tunnel address and announces your TunnelSats endpoint.

Already a subscriber? Import Subscription takes your existing .conf.

What you get

• No box-wide changes. Nothing in StartOS system settings, no port forwarding, no port 9735 conflicts between nodes. Only the target node's traffic uses the tunnel.
• Hybrid stays hybrid. While wg0 is up, outbound clearnet peer traffic (handshakes, gossip, ping/pong) and inbound connections go through the tunnel, so clearnet peers see our server address instead of your home IP. Onion peers keep using Tor.
• Renewals your way. Renew Subscription any time, or Connect Wallet (Nostr Wallet Connect, off by default) to renew automatically when you're 7 days out. Wallet relay traffic can go through Tor. If the wallet can't pay, you fall back to a Pay Invoice task and get a StartOS notification.
• Reminders. StartOS notifications at 7 days, 3 days and on expiry, plus a Renew task (at 7 and 3 days only when NWC auto-renew isn't doing the job).
• Dashboard. Renewal timeline, monthly bandwidth gauge (100 GB/month) with Reset Bandwidth from 70%, server regions and an inbound reachability check.
• Sovereign export. Export WireGuard Configuration shows your .conf whenever you want it.

The honest part

The tunnel and its routing belong to your Lightning node package, not to TunnelSats. Earlier node builds could send clearnet traffic over the home connection if wg0 went down, so we held the launch until the node packages shipped a kill switch. With LND 0.21.3-beta:10, Core Lightning 26.6.8:3 or Eclair 0.14.3:3 (or newer, which the package requires), the node's tunnel routing table carries a blackhole default route for IPv4 and IPv6: if wg0 goes down, is removed or loses its server, clearnet traffic is dropped instead of leaving via your home IP. Our QA verified it on a StartOS 0.4 test system, including boot and a failing endpoint DNS lookup at start, and Tor kept working.

One thing to know: if you turn TunnelSats off on purpose (Configure → disable, then accept the node's off-task), the tunnel is removed and clearnet goes over your home connection again. That's by design.

Please verify yourself on the node (start-cli package attach lnd):

wg show wg0
ip rule
ip route show table 51820      # default dev wg0 + blackhole default
ip -6 route show table 51820   # blackhole default
curl -4 -s https://ifconfig.me

The dashboard's reachability check only shows that inbound connections reach your node; it does not prove outbound routing.

What talks to us

The package calls https://tunnelsats.com/api/public/v1 for the server list, order/renewal creation, payment status, config claim, status sync (your WireGuard public key) and, only when you press the button, the inbound check (your node pubkey and tunnel address). Full list in the package README and our FAQ: https://tunnelsats.com/faq#how-do-i-configure-tunnelsats-on-startos-04

Your turn

Built by node runners for node runners, value for value. Tell us what's missing, what's confusing, or where it broke for you. Ask anything below, we'll answer every question. If it helped, zaps keep the tunnels humming

⚡🧡

https://stacker.news/items/1592233