BitBang: Peer-to-Peer Remote Access Without Accounts or Port Forwarding

BitBang is a peer-to-peer remote access multitool that allows users to reach machines behind NAT, CGNAT, or locked-down networks directly from a web browser or a CLI. By leveraging WebRTC/DTLS for transport instead of traditional TCP, BitBang eliminates the need for port forwarding, VPNs, or account creation, providing an end-to-end encrypted path to a remote machine's shell, files, and local network apps.

Core Capabilities and Use Cases

BitBang provides three primary functions to enable remote management and access without complex network configuration:

  • Interactive Shell: Provides a full terminal in the browser (supporting colors, resizing, and copy/paste) or via the BitBang CLI for scripting and pipes.
  • File Management: A built-in file browser allows users to preview, download, and upload files. The CLI also supports scp-style file copying.
  • Network Proxying: A generic proxy allows users to access web applications on the remote machine's local network by specifying the target LAN address at connection time.

Technical Architecture and Security

BitBang is designed as a single static Go binary that operates as a listener (bitbang serve) and a connector (browser or CLI).

Trustless Signaling and Connectivity

Unlike traditional remote access tools, BitBang does not use a central authority for authorization. The signaling server (bitba.ng) only brokers the initial introduction between the listener and connector and then steps aside.

  • Data Path: Approximately 75% of connections are direct peer-to-peer. When a direct path is impossible, a TURN relay carries only ciphertext.
  • Identity: A device's identity is derived from the hash of its public RSA key. The signaling server never sees the credentials that authorize a connection, as access codes are passed via URL fragments which browsers do not send to the server.
  • Encryption: All traffic is end-to-end encrypted using WebRTC's DTLS.

Secure Pairing

For environments where URLs or QR codes cannot be easily shared, BitBang implements a Short Authentication String (SAS) pairing method. The listener prints a 6-digit code; the connector enters this code and is presented with a second 6-digit challenge. Once the listener verifies this second number, the connection is approved. This mechanism prevents machine-in-the-middle attacks because a third party cannot force the two independently computed fingerprints to match.

Comparison with Existing Tunneling Solutions

BitBang differentiates itself from common tunneling and mesh VPN tools by removing the requirement for accounts and client-side installations for the connector.

Feature ngrok Cloudflare Tunnel Tailscale BitBang
Account Required Yes Yes Yes No
Connector Install No No Yes No (Browser)
E2E Encrypted Not by default No Yes Yes
Data Path Their servers Their servers P2P P2P
Self-hostable Server No No No Yes
Setup Effort Account + Token Account + DNS Account + Login Run one command

Command Reference and Usage

Running a Listener

Users can launch a listener with bitbang serve, which by default provides all capabilities on one URL. Specific modes can be restricted:

  • bitbang serve shell: Shell access only.
  • bitbang serve files [PATH]: File access only (use -upload to allow uploads).
  • bitbang serve proxy [TARGET]: HTTP/WebSocket reverse proxy.

Connecting to a Host

Connections can be established via a browser using the provided URL or via the CLI:

  • bitbang connect <url>: Opens an interactive shell.
  • bitbang connect <url> -- <command>: Executes a one-shot command.
  • bitbang cp <url>:/path <local_path>: Copies files from remote to local.

Successful connections are saved to ~/.bitbang/devices.json, allowing users to reconnect using a short alias (e.g., bitbang connect nas1).

Roadmap and Future Development

BitBang is currently focused on shell, file, and proxy capabilities. Planned features include:

  • Serial Bridging: Enabling remote access to /dev/ttyUSB0 for hardware development (e.g., Arduino IDE over the internet).
  • TCP Port Forwarding: Adding -L style forwarding to reach LAN-only services.
  • Remote Desktop: Implementing screen sharing over WebRTC video tracks with keyboard/mouse input over data channels.

Sources