Question 1

How is LRO different from VPN, TeamViewer and ngrok?

Accepted Answer

A VPN joins whole networks; remote-desktop tools show a human a screen; ngrok exposes one local port to the public internet. LRO opens an on-demand, end-to-end-encrypted TCP tunnel from a multi-tenant panel to a specific endpoint, with organizations, per-endpoint permissions and an audit log.

Question 2

Do I need to open ports or change the firewall on the remote machine?

Accepted Answer

No. The agent makes an outbound WebSocket connection to the LRO core and keeps it open. You add no inbound firewall rules, forward no ports and touch no NAT. If the machine can reach the internet outbound, LRO works.

Question 3

Does it work if both machines are behind NAT?

Accepted Answer

Yes. Both agents dial out to the public LRO core, which relays the encrypted stream between them. Neither side needs a public IP, port forwarding or hole-punching.

Question 4

Which services can I tunnel (SSH, RDP, web, databases)?

Accepted Answer

Anything that speaks TCP: SSH, RDP, VNC, HTTP/HTTPS admin interfaces, PostgreSQL/MySQL/Redis, internal APIs and custom binary protocols. The tunnel is a raw TCP pipe and never inspects the protocol on top.

Question 5

Can I access a USB device on a remote machine?

Accepted Answer

Yes, indirectly. LRO relays TCP, and USB-over-IP software turns a USB device into a TCP service. Run a USB-over-IP server on the machine with the device, open an LRO tunnel to its port, and connect the matching client on your side — the OS then sees the device as if plugged in locally. Good for licence dongles, hardware keys and lab instruments; timing- or bandwidth-heavy devices depend on your network.

Question 6

Can LRO see my traffic?

Accepted Answer

No. Tunnel traffic is end-to-end encrypted between agents with per-tunnel X25519/ChaCha20-Poly1305 keys; the core relays opaque ciphertext it cannot decrypt. The control channel is independently encrypted with Noise XK.

Question 7

How is traffic billed?

Accepted Answer

Two parts. A subscription per agent — a recurring fee that keeps the agent active and includes a small traffic bucket; without it the agent can't open tunnels. And traffic beyond the bucket, billed by the byte (about 0.1 coin per GB). Pricing is in coin, topped up with real currency. Idle time adds no per-byte traffic cost, but the subscription still applies.

Question 8

How much traffic and coin will I use?

Accepted Answer

Traffic follows the protocol and costs about 0.1 coin per GB: interactive SSH or a web panel use a few megabytes per session (effectively free), an hour of remote desktop moves a few hundred megabytes (~0.02–0.04 coin), and a file transfer costs its size (~0.1 coin per GB). These are traffic figures only — each active agent also carries a separate subscription fee. The panel shows current rates.

Question 9

Which platforms can I run the agent on?

Accepted Answer

Linux (x86-64, ARM64 and ARM32), macOS (Intel and Apple Silicon) and Windows (x86-64). The console agent is a single self-contained binary for all of them — including Linux ARM32, so it runs on small boards like a Raspberry Pi — and a desktop GUI app covers Linux, macOS and Windows on x86-64 and ARM64.

Question 10

What happens if the agent loses its connection?

Accepted Answer

The agent reconnects automatically with backoff and jitter. Tunnels reopen once it is back; the panel shows the drop and recovery in real time via push events, with no page refresh.

Question 11

How much CPU and RAM does the agent use?

Accepted Answer

The agent is a single statically-linked binary. Idle cost is small; each active relayed stream uses a fixed buffer of roughly 64 KB. CPU scales with throughput because each chunk is encrypted with ChaCha20-Poly1305.

Question 12

Can a team or organization use LRO, or is it only for a single user?

Accepted Answer

Both. You can run a personal account on your own, or turn it into an organization and bring in a team. An organization groups people and machines: you invite teammates by email, each member is either an org-admin (manages members, invites and every agent, endpoint and permission in the org) or a regular member. Agents and endpoints are shared by granting per-user, per-endpoint permissions, so each person reaches only what they were given. The organization has its own shared balance the team's usage is billed against, and every action is recorded in an org-scoped, append-only audit log with the acting user and IP.

Question 13

Is LRO suitable for compliance and audit requirements?

Accepted Answer

Panel actions — tunnels and permissions, user/agent/endpoint and organization changes, and billing actions like subscriptions, top-ups and pricing changes — are written to an append-only audit log with the acting user and IP (or the system for automatic events). Combined with end-to-end encryption and per-user, per-endpoint access rights, it supports common access-control requirements.

Question 14

Can I self-host LRO on my own infrastructure?

Accepted Answer

Today LRO is a hosted SaaS at app.lro.link, which is the fastest way to start. An on-prem core for closed organisations or high-volume MSPs is on the roadmap — write to info@lro.link with your use case.

Frequently asked questions