A tunnel connects a domain you own to any server you run — on GreatHost or anywhere else. We terminate TLS, issue the certificate automatically and filter malicious traffic at the edge before a single request reaches your machine. No firewall changes, no exposing your real IP, no separate anti-DDoS bill.
What you're seeing: your domain points at the GreatHost Edge, not at your server. Blue requests from real visitors get through; red packets from bots and floods are dropped at the shield. Only clean traffic, in green, travels on to your server, whose IP never appears publicly. The counters are an illustration.
Watch what happens to the same machine when an attack arrives, first exposed directly to the internet and then sitting behind a tunnel.
Your IP is public, so anyone can aim traffic straight at it. Bots and floods share the same pipe as your real visitors, the server burns all its CPU answering junk and the people you actually care about wait until they give up.
Your domain points at our edge instead. Attackers only ever see GreatHost, the junk is absorbed at the shield and your server receives a calm, filtered stream of real visitors. Nothing changes on the machine itself.
No SSH into a load balancer, no manual certificates. Point, configure, pick a plan, done. Everything happens from your dashboard.
Add a CNAME record for your domain (or subdomain) pointing to control.greathost.es. Already got a domain? Perfect, you keep it.
Give us the IP and port where your app or server listens. We validate it, issue a free SSL certificate and wire up the routing automatically.
Every plan includes SSL and edge filtering. Higher tiers add automatic mitigation, under-attack mode, country blocking and longer analytics. Pay with coins, change plan any time.
From then on, every request hits our edge first: rate limits, bot filtering and IP bans are applied before anything reaches your server.
Every request walks through the same checkpoints in a few milliseconds. Green packets pass, red ones are stopped at the gate that catches them. Every tunnel, even the cheapest one, gets real protection.
The connection is encrypted with a free, auto-renewed Let's Encrypt certificate, and plain HTTP visitors are redirected to HTTPS.
Every planKnown bad bots, scanners and suspicious user agents are dropped before they can crawl or probe your app.
Every planPer-IP request and connection limits stop floods before they reach your app, tuned to your protection level.
Custom limits on Pro+Your own blocklists and allowlists, CIDR ranges, whole countries or allowlist-only mode for private tools.
IP bans Pro+ · countries Business+Only clean requests reach your origin, with X-Forwarded-For headers so you still see each visitor's real IP.
Read it left to right: each card is one checkpoint a request has to pass. A request stopped at any gate never travels further, so the work of rejecting junk happens on our infrastructure, not on your CPU. Everything is logged, which is what feeds your analytics and the automatic mitigation below.
Per-IP request and connection limits stop floods before they can reach your app, tuned automatically to your protection level.
When traffic spikes look like an attack, "under-attack mode" kicks in on its own on Pro plans and above, tightening the rules until it settles.
Block specific IPs, CIDR ranges or entire countries yourself whenever you spot something you don't want reaching your server.
Requests, visitors, response times, status codes, countries, devices and browsers, all from the same pipeline that powers our own dashboards.
On Business and Enterprise, show your own branded page instead of a generic error whenever your destination is down for maintenance.
Lock a tunnel behind HTTP basic auth or restrict it to an allowlist of IPs, ideal for staging environments and internal tools.
A simulated flood against a Pro tunnel. Watch incoming traffic explode while the line that reaches your server barely moves.
How automatic mitigation reacts: the edge keeps watching requests per second, requests per IP, error rates and bot share. When a spike looks like an attack it bans the loudest IPs for a while, forces under-attack mode for a cooldown period and opens an incident in your dashboard. Once traffic is back to normal the forced mode expires and the temporary bans lapse on their own. Automatic mitigation and under-attack mode are included from the Pro plan. The numbers here are simulated.
If it speaks HTTP or HTTPS and listens on a port, a tunnel can put it online, safely, under your own domain.
Put a Pterodactyl panel, your Minecraft web map or store, a bot dashboard or any internal tool behind a real domain, with an optional password gate on higher plans.
Give a Node, Python or any backend a real HTTPS domain to test webhooks, mobile app callbacks or third-party integrations properly.
Expose a service running on your home server, NAS or Raspberry Pi under a real domain with SSL, without publishing your home IP in your DNS records.
Already renting a VPS somewhere else? Point a tunnel at it and get our anti-DDoS layer, analytics and free SSL without moving anything.
If your project has ever gone down from a flood of requests, this is exactly the problem tunnels solve: filtering happens before your server even sees the traffic.
Share a clean, branded HTTPS link with a client or your team instead of an IP and a port number.
One flat price per tunnel, billed monthly in coins. Upgrade, downgrade or cancel whenever you want.
Loading plans...
1 € ≈ 100 coins. Prices shown per tunnel, per 30-day period.
Still unsure about something? Here's what people usually ask before creating their first tunnel.
No. A tunnel just needs a public IP and port to reach your destination. It works with a GreatHost VPS, a server at home, a VPS from another provider, or anything else that can accept incoming HTTP/HTTPS connections.
You add a CNAME record (or an A record to the same IP) pointing your domain to control.greathost.es. We never touch the rest of your DNS zone, so your email, other subdomains and existing records are untouched.
Yes. We issue and renew a Let's Encrypt certificate automatically for every tunnel, at every plan level, at no extra cost.
Tunnels proxy HTTP and HTTPS, including WebSockets when you enable them. Websites, APIs, webhooks, game panels, web maps and dashboards all work. Raw game ports, such as the Minecraft port players join on, are not proxied by a tunnel.
Visitors get a clear error instead of a broken connection. On Business and Enterprise plans you can replace that default page with your own branded maintenance page.
Yes, from the tunnel's own management page. Tunnels are billed per 30-day period with no long-term contract, and you can pause, renew or delete a tunnel at any time.
A firewall protects your server once traffic already reaches it. A tunnel sits in front of your server at the network edge, so attack traffic is filtered before it ever gets close, and your real IP is never exposed publicly.
Create your first tunnel in a couple of minutes. Domain, IP, port and pick a plan — that's it.