Use case

Access to an internal web admin interface

The problem

Many internal tools — router/switch admin panels, monitoring dashboards, internal APIs — are only meant to be reached by a small number of authorized people, and are not exposed on the public internet.

Why traditional network access is excessive here

Putting the admin interface on a VPN-reachable network segment means everyone with VPN access can at least attempt to reach it, and the user's machine gains reachability to whatever else lives on that segment.

How TunnelCrib handles it

The TunnelCrib Agent on the Device hosting the interface advertises it as a named or custom-port TCP Service. Only Clients explicitly authorized for that Service can request a Tunnel to it.

Setup example

$ tunnelcrib connect network-switch-12:admin-web

device identity verified
direct Tunnel negotiated
Service Tunnel active
localhost:49318

Authorization example

Access to the admin interface is granted per Client, independent of any other Service on the same Device — someone authorized for the web UI is not automatically authorized for SSH on the same box, or vice versa.

User experience

The user opens http://localhost:<port> in their browser and authenticates with the interface's own login, exactly as if it were reachable directly.

Audit trail

The connect request and session are recorded (see audit events).

Security considerations

The interface is never bound to a public address; TunnelCrib only ever needs the Agent Device to make outbound connections. See architecture.