Access an ESP32 from anywhere — no port forwarding
Your sketch serves a sensor readout or a little control page beautifully — on the bench. From outside the network it's invisible: NAT, CGNAT, and the router's firewall all stand in the way. One library call fixes that.
The board dials out, the world dials your hostname
The ESP32 & Arduino library opens the same outbound mutual-TLS connection as the full agent and speaks the same wire protocol — your board answers at a public hostname with no inbound port.
Register the board
Add it as a device in the console and mint an enrollment token for it.
Drop the library into your sketch
Arduino IDE or PlatformIO: configure the agent, register one callback, and call it from your loop. Your code answers the traffic.
Open your board's URL
The relay routes visitors to the board over the tunnel the board itself opened. The router config never changes.
Serve from the sketch, or proxy the neighbours
In handler mode the board is the service — your callback answers each connection, perfect for dashboards and sensor APIs. In forwarding mode the board doubles as a tiny device-side proxy, piping connections to other hosts on its network — a printer, a camera, a legacy controller.
- Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously.
- The ESP32 & Arduino library is an early build: its wire protocol passes the same conformance tests as the fleet agents, and broader on-hardware validation is ongoing.
- Need more muscle on the same network? A Raspberry Pi or industrial PC can run the full agent as a gateway for everything around it.
Curious what's on the wire? The tollan.v1 protocol is documented end to end.
ESP32 questions we get
Do I have to change anything on the router?
No. The board opens the connection outward, so no port is forwarded and no inbound rule is needed. The ESP32 & Arduino library opens the same outbound mutual-TLS connection as the full agent and speaks the same wire protocol — your board answers at a public hostname with no inbound port.
Arduino IDE or PlatformIO?
Both. The library installs either way; you configure the agent, register one callback, and call it from your loop.
Can the board expose other devices on its network?
In forwarding mode the board doubles as a tiny device-side proxy, piping connections to other hosts on its network — a printer, a camera, a legacy controller.
Is it the same protocol as the full agent?
Yes — the board speaks the same wire protocol as the Linux, macOS and Windows agents, so a fleet can mix microcontrollers and full operating systems without a second access model.
How production-ready is the library?
The ESP32 & Arduino library is an early build: its wire protocol passes the same conformance tests as the fleet agents, and broader on-hardware validation is ongoing. For anything load-bearing today, a gateway running the full agent alongside the board is the more conservative choice — see the gateway pattern.
Put your first board online
The free tier covers one device with two routes — no card required.