• 1. The Public API
• 2. Privacy-First Authentication (NWC & LN-Auth)
• 3. Consolidated CLI (tunnelsats.sh)
• 4. Not a Consumer VPN
• 5. New Referral System
• Moving Forward

Four years ago, we launched TunnelSats with a simple mission: provide a secure, anonymous, and fast VPN routing layer specifically for ambitious Lightning node runners.

The goal was to offer the connectivity benefits of Clearnet (low latency, faster gossip propagation, higher HTLC success rates) with the privacy benefits of Tor, without forcing users to take on the technical debt of self-hosting their own VPN infrastructure.

On Genesis Day, we released TunnelSats v3. We have rewritten our middleware and frontend infrastructure from the ground up to support the next generation of node automation.

We didn’t just update the website theme; we changed how you interact with the service entirely.

Here is what is changing in v3:

§1. The Public API

This is the biggest shift in v3. We have opened up our backend to allow developers and power users to interact with TunnelSats programmatically.

• For Users: You can now script your renewals, check tunnel health, and automate failovers without leaving the terminal.
• For Platforms: Node OS providers (like Umbrel, Raspiblitz, MyNode) can now integrate anonymous VPN purchasing and configuration directly into their UI.

For example, this is all it takes to get a list of our available servers:

curl --location 'https://v3.tunnelsats.com/api/public/v1/servers'

Check the Postman Collection to start building, and feel free to share your integrations with us!

§2. Privacy-First Authentication (NWC & LN-Auth)

We have finally introduced lightning-worthy login methods with LN-Auth and NWC (Nostr Wallet Connect).

This means 🤚 no emails, 🤚 no passwords, and 🤚 no accounts linked to your real-world identity. You manage subscriptions using your node or signing device identity. We remain strictly 🚫 No-KYC and have minimized data retention even further by encrypting the bare-minimum session data required to keep your WireGuard tunnel alive.

§3. Consolidated CLI (tunnelsats.sh)

Managing the tunnel directly on your Linux node used to require juggling multiple scripts. We have consolidated everything into a single, robust bash script: tunnelsats.sh.

It handles install, uninstall, pre-check, restart, and status commands with significantly better error handling. It’s faster, transparent, and fully auditable. We are still looking for your help and feedback to let us know where we can improve it further.

§4. Not a Consumer VPN

A common point of confusion is comparing us to standard consumer VPNs meant for watching Netflix in different regions. We are not that. We are infrastructure for Lightning nodes.

Because our traffic profile is different (optimized for node gossip and routing connectivity rather than 4K streaming), we are generally much more affordable than generic VPNs, while offering tighter privacy controls and guaranteed open ports.

§5. New Referral System

We introduced a double-sided referral program. If you appreciate the service, share it. Both the referrer and the referee receive bonus months upon a successful sign-up.

§Moving Forward

We built these improvements based on years of feedback from the routing community. The new website is live, the API is ready, and the tunnels are stable.

We invite the community to review the changes on GitHub or join our Telegram Community to discuss.

Visit Tunnelsats.com