Multiplexed Multi-Tenant Tunnels: Running 50+ Local Services Over a Single QUIC Connection with HTTP/3 Extended CONNECT
Exposing a handful of local services to the internet is easy. Exposing dozens of them reliably is harder. A typical developer machine or edge gateway may run REST APIs, gRPC endpoints, WebSocket servers and admin UIs at the same time. Giving each one its own port, its own TCP connection, or its own tunnel process gets expensive quickly. This article looks at how modern tunnels solve the problem. They multiplex many services over one outbound connection , and increasingly that connection is QUIC on a single UDP port (usually 443) . It also covers what HTTP/3 Extended CONNECT does and does not give you, because the details matter for tunnel design. The Bottleneck: One Port or One Connection Per Service Three problems show up when a tunnel scales with the number of services it exposes. 1. Per-connection overhead If every exposed service gets its own TCP + TLS connection, the agent pays for it in several ways: Handshake cost. Each connection repeats a TCP handshake and a TLS han...
