Direct
Peer-to-peer connections, no relay in the hot path
Encrypted
Every connection encrypted end-to-end by default
Embedded
A library in your app, not a client to install
Anywhere
Automatic NAT & firewall traversal, with relay fallback
Reaching a device that isn't sitting on the public internet usually means standing up a VPN: a coordination server to run and secure, client software to distribute, and firewall rules to get right. Or it means reverse SSH tunnels and all the operational shenanigans that come with them.
“Thinking about implementing a SOCKS proxy on top of iroh to get into my self-hosted service at home without WireGuard infra and all the related network shenanigans.”
But what if your app could just dial the other device directly—no separate network to join, no client to install, no infrastructure to babysit?
Every iroh node has a public key as its address. To reach a device, you dial that key directly from inside your own application—there's no separate VPN client for your users to install, and no central network your traffic has to join.
One developer building an agentic coding app described swapping out planned reverse SSH tunnel infrastructure for iroh in about a day:
Every node has a cryptographic identity. Connect to a device by its public key, wherever it is.
Iroh punches through NATs and firewalls automatically to connect devices directly.
Every connection is end-to-end encrypted, so your platform can't see or modify traffic between devices.
Iroh ships inside your app, so the connection is just part of your product—not a separate piece of software your users manage.
“I read iroh's headline ‘dial keys, not IPs’…I think that was last Tuesday. By Wednesday it was in our app as one of the most load-bearing pieces.”
Iroh automatically establishes direct connections when possible, for the lowest latency and highest throughput. When a direct connection isn't possible—due to symmetric NATs, restrictive firewalls, or carrier-grade NAT—traffic falls back to an encrypted relay, so the connection stays up either way.
Use n0's hosted relays, or run your own for full control over that part of the stack.
Why iroh
| iroh | Tailscale / WireGuard | |
|---|---|---|
| Embeds directly in your app | ||
| No separate client to install | ||
| NAT & firewall traversal | ||
| End-to-end encrypted by default | ||
| Whole-device network overlay |
Iroh connects your app's own devices directly—it's not a general-purpose replacement for joining a whole network of unrelated machines.