tcpforward

English | 中文

English

Tunnel your DeepSeek Harness (DSH) to the LAN without modifying any DSH configuration, so phones and other devices can access it via http://<LAN-IP>:<port>. To expose it to the public internet later, use your platform's intranet tunneling feature.

Why you need it

DSH only listens on 127.0.0.1 by default, so LAN devices cannot reach it directly. Changing the configuration to 0.0.0.0 is not only cumbersome — if you forget to change it back later, DSH may even silently suffer attacks from the public internet.

This forwarder listens on 0.0.0.0 instead and forwards traffic to the DSH loopback target, with no configuration changes required. Start and stop it at will: as long as the forwarder is shut down, DSH will not leak to the external network.

Technical notes

Compared with plain traffic forwarding, this DSH-specific forwarder also solves the following problems: DSH checks whether traffic belongs to the local loopback, and browsers block certain features over HTTP:

• Server-side validation: rewrites Host / Origin / Referer headers to the loopback address, passing the target's local validation and anti-CSRF checks
• Browser restrictions: LAN http:// is a non-secure context — injects polyfills for crypto.randomUUID and navigator.clipboard; patches the frontend isLoopback check to unlock privileged features such as settings / credentials

Quick start

# Option 1: run from source (requires Node >= 18)
node app.js

# Option 2: prebuilt executable (no Node needed)
dist\tcpforward.exe

After startup, all reachable addresses are printed:

Available on:
  http://172.22.112.1:3080
  http://127.0.0.1:3080
Hit CTRL-C to stop the server

Open any listed LAN address from your phone or another device.

Options

Example:

node app.js --port 8080 --target-port 3000 --log-level debug

License

MIT

中文

把 DeepSeek Harness（DSH）穿透到局域网，完全不修改 DSH 任何配置，供手机/其他设备通过 http://<局域网IP>:<端口> 访问。若之后需要开放到公网，用平台的内网穿透即可。

为什么需要它

DSH 默认只监听 127.0.0.1，局域网设备无法直接访问。如果欲配置修改为 0.0.0.0，不仅操作麻烦，若后续忘记改回，甚至可能无声无息地遭受外网攻击。

而本转发器可监听 0.0.0.0，把流量转发到 DSH 回环目标，无需修改配置。并且随开随停，只要转发器关闭，DSH 就不会泄漏到外网。

技术说明

相对于普通的流量转发，本 DSH 专用转发器还解决了一下问题：DSH 会检测流量是否属于本机回环和浏览器会阻止HTTP下某些功能的启用：

• 服务端校验：改写 Host / Origin / Referer 头为回环地址，通过目标的本地校验与反 CSRF 检查
• 浏览器限制：局域网 http 是非安全上下文，注入 polyfill 补齐 crypto.randomUUID、navigator.clipboard；改写前端 isLoopback 判定，解锁 settings / credentials 等特权功能

快速开始

# 方式一：源码运行（需 Node >= 18）
node app.js

# 方式二：打包好的可执行文件（无需 Node）
dist\tcpforward.exe

启动后显示所有可达地址：

Available on:
  http://172.22.112.1:3080
  http://127.0.0.1:3080
Hit CTRL-C to stop the server

手机/其他设备访问列出的局域网地址即可。

参数

示例：

node app.js --port 8080 --target-port 3000 --log-level debug

License

MIT