TunnelSats: Hybrid Lightning Node Setup

Privacy-focused VPN tunnels for Lightning nodes. Run your node hybrid (clearnet + Tor) without exposing your home IP.

---

⚡ Quick Start

New to TunnelSats? Get up and running in 3 steps:

1. Subscribe at tunnelsats.com and download your WireGuard config
2. Run the installer on your node:

   wget -O tunnelsats.sh https://github.com/tunnelsats/tunnelsats/raw/main/scripts/tunnelsats.sh
   sudo bash tunnelsats.sh install

3. Configure your node with the VPN settings from the installer output

👉 See full installation guide and compatibility matrix →

---

Why Hybrid Mode?

The Lightning Network needs fast, reliable, discoverable nodes for efficient routing. While Tor provides privacy, it can be slow and unreliable. TunnelSats solves this by:

• ⚡ Clearnet Speed – Direct connections for faster routing
• 🔒 VPN Privacy – Your home IP stays hidden
• 🧅 Tor Fallback – Maintains .onion connectivity
• 🛡️ Split Tunneling – Only Lightning traffic goes through VPN

---

Supported Platforms

Platform	Type	LND	CLN	Installation Method
Umbrel (umbrelOS 1.0+)	Docker App	✅	✅	Native Umbrel App (Community App Store / Official Review Pending)
RaspiBlitz (v1.11+)	Systemd	✅	✅	Host Script (tunnelsats.sh)
Bare Metal (Debian/Ubuntu)	Systemd	✅	✅	Host Script (tunnelsats.sh)
myNode (v0.3+)	Systemd	⚠️	⚠️	Host Script (tunnelsats.sh - Experimental)
StartOS (Start9)	Service Package	❌	❌	❌ Unsupported (LXC isolation prevents cross-package egress routing)

ℹ️ Security Architecture Note: The tunnelsats.sh bash installer is designed for bare-metal / systemd nodes (RaspiBlitz, RaspiBolt, MiniBolt, myNode). Due to container sandboxing, manual host script execution is unsupported on Umbrel — please use the native Umbrel App installation. StartOS is unsupported as its LXC architecture does not allow third-party packages to encapsulate peer node egress.

See scripts/README.md for detailed compatibility info.

---

Subscription & Renewal

New Subscription

1. Visit tunnelsats.com
2. Select a server location close to you
3. Choose duration (1-12 months)
4. Pay the Lightning invoice
5. Download your WireGuard config

Renewal

• Web: tunnelsats.com → Renew Subscription
• Dashboard: Log in → My Dashboard → Renew
• API: api.tunnelsats.com

Your existing configuration remains valid after renewal – no changes needed!

---

Uninstallation

To remove TunnelSats and restore your original configuration:

sudo bash tunnelsats.sh uninstall

---

Development & Contribution

Local Setup

This repository uses Git hooks to maintain script integrity. To set up your local development environment:

1. Initialize hooks:

   chmod +x scripts/hooks-install.sh
   ./scripts/hooks-install.sh

   This will automatically configure the pre-commit and post-rewrite hooks to keep the scripts/tunnelsats.sh.sha256 file in sync.

---

Development & Contribution

Local Setup

This repository uses Git hooks to maintain script integrity. To set up your local development environment:

1. Initialize hooks:

   chmod +x scripts/hooks-install.sh
   ./scripts/hooks-install.sh

   This will automatically configure the pre-commit and post-rewrite hooks to keep the scripts/tunnelsats.sh.sha256 file in sync.

---

Support

• 💬 Telegram: Tunnel⚡Sats Group
• 📖 Guide: tunnelsats.com/guide
• ❓ FAQ: tunnelsats.com/faq
• 🐛 Issues: GitHub Issues

---

Credits

Built with ⚡ by @ziggie1984, @TrezorHannes, and @blckbx.

Special thanks to @LightRider5 (lnvpn.net) for inspiration and support.