Reverse tunnel
Also called: outbound tunnel, NAT traversal, remote access tunnel
A reverse tunnel lets you reach a device behind a home router by having the device open the connection outward, so no ports need forwarding.
A reverse tunnel solves reaching a machine that has no public address.
Home and office networks sit behind NAT: the device can make outbound connections, but nothing on the internet can start one inbound. The usual fix is port forwarding, which means changing router configuration and exposing a service directly to the internet.
A reverse tunnel inverts it. The device opens and holds an outbound connection to a relay. When you visit the public URL, the relay passes the request back down that existing connection. Nothing is forwarded and no port is opened.
The security property that matters: the device decides what to expose. A relay can only reach services the agent chose to publish, so a compromised relay cannot wander the LAN.
Alternatives include WireGuard or Tailscale, which build a private network instead of publishing a URL — better for personal access, worse for sharing a link.