Skip to main content

How to see who connects to a tunnel

Since app version 1.3.0

Open the tunnel under "Tunnels": on the "Overview" tab, the "Security" card shows the latest addresses that connected to it, and the "Connections" tab shows every connection. You can ban any real address from these lists in two clicks. This works for tunnels of any protocol.

The app keeps these lists on your computer. A reconnect of the tunnel keeps them; closing the tunnel, signing out and restarting the app start them over.

Latest visitors on the Overview​

The "Security" card, captioned "Latest visitors to the address", shows the three latest addresses: the country, how many connections came from the address and when the last one came. Below them is "Unique addresses" for the session. Until the first connection, it says "No visitors yet".

A connection is a new TCP connection or a new UDP flow, not a request: a browser sends many requests over one connection. Home network addresses have no country.

All connections​

Since app version 1.4.0

The "Connections" tab shows a row for each TCP connection and each UDP flow: "Visitor", "Started", "Duration", how much went "From visitor" and "To visitor", and "Closed by". At the top you see how many are connected now and how many closed this session, and the "All", "Live", "Closed" switch keeps the rows you need. It lists every live connection and the last 1000 closed ones.

"Closed by" says why a connection ended:

  • "visitor": the visitor left or the node disconnected them;
  • "service": your service closed the connection or stopped taking data;
  • "service unreachable": the service on this computer could not be reached; check that it runs on the port in the "Destination address" field;
  • "app": the request inspector or a change of the link's sign-in closed the connection;
  • "tunnel": the tunnel's connection to the node dropped;
  • "unknown": the tunnel service gave no reason.

How to block an address​

  1. On the "Overview", click the ban icon to the right of the address; on the "Connections" tab, click "⋯" in the row and pick "Block this address".
  2. In the "Ban …?" window, click "Ban". The app says "Address banned. Nodes apply the ban within 20 seconds".

The address goes into "Denied addresses" in the "IP addresses" section of the "Security" tab, where you also deny whole ranges and shared lists (access by IP). The same icon lifts the ban: on a banned address it is a check mark, "Unban …", and on the "Connections" tab it is "⋯" and "Unblock this address".

You can't ban:

  • an address that sent only UDP: such an address can be forged. An address that opened a TCP connection is real, and the "Connections" tab marks it "verified";
  • an address already denied by a range or a shared list: change it on the "Security" tab;
  • a new address once the IP rules have no free entries left (access by IP): remove ones you don't need on the "Security" tab.

Check​

A banned address is struck through in the list, and its new attempts to connect show in the "Refusals" section of the "Security" tab.