Skip to content

Feature Tour

A guided walk through everything tunlx can do. Each tile links to a deeper how-to or reference page so you can drill in when you're ready.

Proxy flavors

tunlx ships three proxy blueprints — pick the one that matches the shape of the service you want to publish.

Standard proxy Reverse-proxy a single upstream Xtream provider. Stable inbound URL, optional MediaFlow handling, EPG automation, and per-proxy routing. Standard proxies

Composite proxy Merge selected categories from any combination of standard proxies into one curated Xtream endpoint for clients. Composite catalogs

Xtream service Operate your own Xtream-compatible panel with groups, channels, users, expirations, and concurrent-connection limits. Xtream services

Networking

Inbound & outbound modes Control global listener exposure (public / Tailnet / both) and outbound egress (public, WireGuard, Tailscale exit-node) from one screen. Configure modes

WireGuard & Mullvad Bring a WireGuard config, or let tunlx fetch and rotate Mullvad configurations on a schedule. Per-proxy route: vpn opt-in. Set up VPN

Tailscale (embedded tsnet) Run tunlx on your Tailnet with an embedded node — no sidecar needed — and pick exit nodes from the dashboard. Tailnet access

Per-proxy egress

Every proxy and Xtream service can set route independently:

Mode What it does When to use
system Use the host's default routing table. Default. Works everywhere.
vpn SO_BINDTODEVICE onto the WireGuard interface (default wg0). Force a specific upstream through your VPN.
tsexit Send the proxy's egress through the configured Tailscale exit node. Use a Tailnet peer for outbound — no WireGuard required.
direct Bind to an explicit sourceIP so host policy routing applies. Bypass VPN by source-IP policy without touching system routing.

Anti-block toolkit

Real-world upstreams fight client identification. tunlx ships several features so you can match them.

uTLS fingerprints Replace Go's TLS ClientHello with chrome, firefox, safari, ios, edge, android, or randomized to defeat JA3/JA4 detection on Cloudflare-fronted origins.

Header normalization Set upstreamUserAgent and enable normalizeUpstreamXtreamHeaders to send VLC-style request headers, which routinely sidestep WAF rules.

Referer preservation Turn on forceStreamReferer to keep the original Referer when an upstream gates content on hotlink-protection.

302 redirect mode Set redirectStreams to issue HTTP 302 to the upstream URL for stream paths. tunlx steps out of the data path, the client connects directly, and the upstream sees the client's IP.

Operations

Category manager Drag-and-drop reorder, prefix labels, enable only what your clients need. Saves back to config.json on every change. Daily operations

Stream health tests Async probes for HLS, MPEG-TS, MP4 and Matroska. Configurable timeouts, retries, and auto-disable thresholds. Run a test sweep

Activity & telemetry Bandwidth counters, audit policies for player_api.php and stream paths, live tail of the last 200 user events. Audit traffic

Simple / Advanced UI Hide composite and Xtream service surface from junior operators with a one-click mode toggle. UI modes

MediaFlow handling Route /live, /movie, /series, /hls through MediaFlow Proxy for better seeking and adaptive buffering. Integrate MediaFlow

IPTV-org imports Build groups from public catalogs filtered by country and category — refreshable on demand. Import groups

Built-in web player

The web player is the fastest way to verify a stream actually plays before you put it in front of users.

  • Proxy and Direct URLs side by side so you can compare with the proxy in and out of the data path.
  • EPG timeline view that pulls fresh data on open and respects your auto-refresh schedule.
  • Honors publicBaseURL so the redirect URL it generates resolves from outside the LAN.

Web player

Authentication and admin surface

  • Username + bcrypt password from webCredentials in config.json.
  • Signed sessions using sessionSecret (32 bytes, base64 / hex / ASCII).
  • Rate limiters on the login endpoint (deters brute force) and on EPG.
  • CSP, HSTS, X-Frame-Options, and CORS configurable at the server level.
  • Optional enforceHttps 301 redirect that respects X-Forwarded-Proto.

Programmable

Everything the dashboard does is also reachable over HTTP. See CLI & Environment for flags and env vars, and Xtream API Reference for the client-facing endpoints your IPTV apps will hit.

What's next