# unikraft instances tunnel

Forward a local port to an unexposed instance through an intermediate
TLS tunnel service.

When you need to access an instance on Unikraft Cloud which is not
publicly exposed to the internet, you can use the
`unikraft instance tunnel` subcommand to forward from a local
port to a port which the instance listens on.


```
unikraft instances tunnel <target> ... [flags]
```

## Examples

Forward local port 8080 to instance "nginx" port 8080:

```bash
unikraft instance tunnel nginx:8080
```

Forward local port 8333 to instance "nginx" port 8080:

```bash
unikraft instance tunnel 8333:nginx:8080
```

Forward multiple ports from multiple instances:

```bash
unikraft instance tunnel 8080:my-instance1:8080/tcp 8443:my-instance2:8080/tcp
```

Forward local port 8080 to instance "my-instance1" port 8080 on fra metro using TCP:

```bash
unikraft instance tunnel 8080:fra/my-instance1:8080/tcp
```

Use a custom relay port to avoid collisions:

```bash
unikraft instance tunnel -p 5500 my-instance:8080
```

## Options inherited from parent commands

```
  --config file               Path to the configuration file.
  --log-level level           Set the logging level. (default info)
  --log-type type             Set the log type. (default text)
  --profile name              Set the current profile.
  --telemetry                 Toggle anonymous usage analytics. (default true)
  --timeout duration          Set a deadline for the command (e.g. 30s, 5m, 1h).
```

## See Also

* [`unikraft instances`](../instances.mdx): Manage Unikraft Cloud instances.