Chisel

Chisel is a cross-platform network tunneling utility that encapsulates TCP and UDP streams inside an HTTP connection secured with SSH. A single static binary serves as both client and server, allowing engineers to bypass restrictive firewalls and NAT configurations without routing traffic through a commercial middleman. Multiplexing multiple endpoints over one persistent WebSocket connection keeps transport efficient while blending into standard web traffic.

Why Chisel instead of Packetriot

Commercial tunneling services like Packetriot and ngrok operate managed relay infrastructure, charging recurring subscription fees tied to active tunnel counts, reserved TCP ports, and monthly bandwidth caps. For developers spinning up ephemeral test environments or DevOps teams managing automated CI pipelines, these per-tunnel and per-port constraints rapidly inflate operational costs. Chisel eliminates subscription line items by putting deployment entirely on your own infrastructure. Running a Chisel server on a basic virtual private server gives you unmetered data transfer, unrestricted concurrent tunnels, and flexible port mappings with no third-party meter tracking your traffic.

The trade-off is operational responsibility. Packetriot handles public IP allocation, custom domain routing, and automated TLS termination across a global edge network. With Chisel, DevOps engineers must provision their own server host, configure DNS records, and secure network access themselves. While Chisel can automatically request certificates via Let's Encrypt when running directly on port 443, it does not provide public vanity URLs or web dashboards for traffic inspection. For internal network access, remote database debugging, and firewall traversal where server infrastructure already exists, Chisel delivers dependable transport plumbing without ongoing license overhead.

What it does well

• Packages both client and server into a single lightweight Go binary with zero external runtime dependencies.
• Supports bidirectional tunneling, handling both standard local port forwarding and reverse port forwarding to expose internal services through remote bastions.
• Embeds a SOCKS5 proxy on both ends, enabling ad-hoc dynamic routing through isolated network segments without deploying dedicated VPN software.
• Provides standard input and output transport mode that pairs with SSH ProxyCommand, allowing native SSH sessions over HTTPS.