Existing users checking what's changed, or anyone evaluating the pace of development.
What's new in TYO Reach
Release notes for the desktop app, Android app, gateway, and web dashboard. We ship often.
Security hardening: local-only by default
- The local proxy and every TCP forward now bind to
127.0.0.1(loopback) by default instead of being reachable from elsewhere on your network. Need another device on your LAN to reach them? Turn on the new "Share on local network" toggle in the tray (orexpose_on_lanin config.json) - Gateway hardened against SSRF: outbound requests the gateway makes on your behalf are now validated before they leave
- Long-poll session tokens are now bound to the session that requested them
- Windows terminal session names are validated before being used to create a session
- Update manifests are now signed
In-app 2FA, cross-gateway remote access, Australia region
- Two-factor sign-in now completes inside the desktop app — approve the push on your phone, enter a TOTP code, or request a one-time code by email — instead of bouncing out to the browser; email/TOTP fallback means no lock-out without an approver phone
- Reach Sessions and Share this PC work across gateway regions: the host and the viewer no longer need to be on the same gateway, and the relay path carries sessions between regions
- New Australia gateway region (au.reachgateway.net) — an Australian exit IP for Australians overseas and for teams that need an Australian egress address
- Sessions polish: attach reliably to existing tmux sessions;
reach connectaccepts a session name or host; named sessions; the shell picker (PowerShell / CMD / Bash / zsh) now on macOS as well as Windows; terminal-rendering (TERM) and CLI fixes
Reach Sessions on Windows & pick your shell
- Host terminal sessions on Windows (via ConPTY) — the "Host sessions on this PC" toggle is now available on every desktop platform
- "New session" detects the shells you have installed and lets you choose: PowerShell, CMD, Bash (Git Bash/Cygwin) or WSL; sessions can be given a name when created
reach connectaccepts a session name on its own, or a host name — you no longer have to spell out both- Hosted terminals now advertise 256-colour support, fixing "terminal does not support clear" inside sessions
The short reach command
- The .deb and .rpm packages now install a short
reachcommand alongsidetyoreach, soreach host,reach sessionsandreach connectwork as documented (Windows and macOS keeptyoreach)
Reach Sessions — your terminal follows you
- Host persistent terminal sessions on a Linux or macOS machine and attach to them from any of your devices; whatever is running keeps running when you disconnect
- If tmux is installed, Reach exposes your existing tmux sessions; otherwise it serves fresh shells
- Attach from the tray (Remote Machines → host → session) or from a terminal with
reach sessionsandreach connect reach hosthosts sessions headlessly on servers with no GUI- Same-LAN attaches go peer-to-peer; otherwise they fall back to the gateway relay automatically
- Sessions are owner-only: you attach to your own machines from anywhere, and they work without the proxy switched on
Share this PC for Mac, signed Linux repos, org access policy
- Share this PC is now protocol-aware: sharing a Mac exposes it over VNC (macOS Screen Sharing), Windows/Linux over RDP, and the viewer opens the matching client automatically
- Mac app: "Share this Mac" toggle, native "Add viewer" dialog, Remote Targets submenu and in-app Google / TYO ID sign-in
- Peer-to-peer fast path is only taken on your own subnet, so a viewer on a different private network can never be bridged to the wrong machine
- Linux packages are now served from GPG-signed APT and DNF repositories, refreshed automatically on every release — install once, update with your system updater
- Organisation access policy: admins can restrict when and where members may connect — allowed countries, IP ranges, office hours and trusted devices
- Europe and US-West gateway regions join Singapore, Hong Kong and Taiwan in the region picker
Share this PC: viewers, revocation, LAN fast path
- "Add viewer (TYO ID)…" grants a named person access to a shared machine; the recipient is validated as a real TYO ID, and "Shared with…" lists and revokes access
- Viewers on the same network as the shared machine connect directly, peer-to-peer, at near-LAN speed; everyone else goes via the gateway relay
- Each device now has its own identity, so two machines on one account no longer collide when both are shared
- "Share this PC" is reachable from the tray on all platforms; gateway relay throughput improved for RDP and SSH
Linux parity, iPhone & Mac App Store
- Linux tray gains Remote Targets, Share this PC and the access log — feature parity with Windows and macOS
- TYO Reach is approved on the Apple App Store: the iPhone app runs as a VPN profile with the same gateway picker, and a native Mac menu-bar app joins Windows and Linux
- Your plan, usage and gateway preferences are shared across every device on your account
Remote Targets: Google Cloud IAP, AWS and Azure
- New "Remote Targets" tray menu — one-click RDP or SSH to cloud servers defined in your organisation's dashboard, with no jump box, public IP or command line
- Google Cloud: connects through Identity-Aware Proxy using your Google account (loopback OAuth sign-in)
- AWS: EC2 Instance Connect Endpoint and SSM Session Manager backends, with "Sign in with AWS" via IAM Identity Center or your standard credential chain
- Azure: native Azure Bastion tunnel with "Sign in with Microsoft" (1.9.48 adds per-target tenants and clearer device-code prompts)
- Windows: native Microsoft sign-in through the system account broker — no browser hand-off (1.9.44)
Microsoft sign-in fix, in-app sign-in, per-app routing
- Fixes the Microsoft work/school sign-in error AADSTS5000611 in Chrome and Edge by routing Microsoft's login endpoints direct in unrestricted regions
- Windows: sign in to Reach inside the app with your username and password — no browser required, ideal for locked-down machines
- Team plans: split-tunnel routing engine that matches traffic by destination and by Windows process, with a one-click Microsoft 365 preset
Connection log is now opt-in
- The connection/access log is switched off by default and only recorded when you or your organisation turn it on
- Sign-in reaches TYO ID from inside restricted networks such as mainland China via a keyless login proxy
- Android: connection mode picker (Auto / Fast / Disguise), defaulting to Disguise in restricted regions
Taiwan region, live gateway picker, Share this PC preview
- Gateway regions: Singapore, Hong Kong and Taiwan — the picker probes each gateway when opened so you choose from what is actually up
- Switching gateway now applies to live connections, not just new ones; transport is chosen automatically per region
- First preview of "Share this PC" and "Remote Machines" — inward access to a machine on your network over the Reach relay, with no firewall ports opened
- The app self-heals if a device identity collides with another install on the same account
Connection modes: Auto, Fast, Disguise, Slow
- New connection mode picker in the tray. Auto picks the transport for your network; Fast is plain HTTPS; Disguise wraps traffic so it passes deep packet inspection on restrictive networks; Slow is the long-poll fallback
- Disguise mode now works on every gateway, not only the China-oriented ones
- Usage metering moved onto Reach's own infrastructure beside the gateways — a metering hiccup can no longer interrupt your browsing
- Snappier RDP and SSH through the relay; a Windows Remote Desktop error (0x609) caused by an over-eager security-layer tweak is fixed
TCP Forwards on Linux and macOS, Safari support
- TCP Forwards submenu in the Linux and macOS tray menus, matching Windows
- Refresh Policies detects a switch between a personal and a corporate account
- Safari is supported as a routed browser on macOS (1.9.26); the macOS proxy no longer stays stuck on after quitting (1.9.28)
- Windows sign-in callback works on machines where localhost resolves to IPv6 (1.9.28)
17 languages, access rules on mobile
- The desktop tray and Windows installer follow your system language across 17 languages
- Android and iOS enforce your account's IP access rules (allow/deny lists) and show a banner when access is restricted
- Personal routing rules sync across all your devices
Gateway auto-failover, install to any drive
- If the active gateway becomes unreachable, the app fails over to the next one automatically
- Windows installer adds a directory picker so you can install to D: or any other drive (1.9.20)
- RDP forwards gain a Secure Mode filter and show per-forward latency
- Agent mode remembers its state across restarts and reports a missing relay URL instead of failing silently
Per-member inward access & connection audit
- ZTNA phase 2: organisation admins grant inward access per member, and every connection is written to the audit log
- Windows installer closes a running copy of Reach before upgrading it
Managed Windows devices, access log, device visibility
- Windows installs at user level with no admin rights or elevation — Reach now runs on endpoint-protected corporate laptops (1.9.12–1.9.13)
- When a browser or the clipboard is blocked by policy, the sign-in link falls back to Notepad, and Ctrl+Click on Sign in switches to server-poll mode
- Per-connection access log for organisation admins
- Each device registers a stable identity on login, giving admins visibility of every device using the organisation
- Group TCP forwards and personal forwards are merged, so both apply at once
- ZTNA phase 1: inward-access rules and the reverse-tunnel relay that lets authorised members reach services on your LAN without opening firewall ports
Cloud-managed policy, system proxy mode, TCP forwards
- Policy set in the dashboard — browser routing, gateway choice, domain rules — is pushed to every device automatically
- System proxy mode on Windows (Pro and above): route all apps through Reach, not just the chosen browser, with per-process rule enforcement on Windows and Linux
- Built-in TCP port forwarding for RDP and other protocols, with one-click .rdp files; Refresh Policies in the tray
- Two-level IP access rules on the gateway (global list plus per-user override) and group-based gateway access
- Linux: fixes Brave showing "No internet" after install (1.7.4) and improves proxy reliability with clearer gateway error pages (1.7.5–1.7.8)
Graceful data-limit handling
- Proxy stays active in limited mode when your monthly data cap is reached — no more silent "no internet"
- Block page redirects to reach.tyo.com.au/limit so you can top up without disabling the gateway
- Square payment is allowlisted in limited mode so you can pay through the gateway itself
- Tray menu shows a "I've topped up — retry now" option that re-activates full access immediately
China transport & gateway picker
- WebSocket tunnel transport for networks that block standard HTTPS proxy connections (including GFW-restricted networks)
- Hong Kong gateway option for China-based users and anyone needing a lower-latency APAC exit
- Windows in-app auto-updater checks GitHub releases and prompts when a new version is available
- Chromium browser support added alongside existing Chrome support
DNS over UDP
- DNS queries now use UDP transport instead of TCP, reducing latency on first connection
- Cold-start connection time reduced noticeably on high-latency networks
- No configuration changes required — the improvement applies automatically
Linux system tray
- Native system tray on Linux using direct GDBus StatusNotifierItem — no ayatana or appindicator dependency
- Tray icons refresh automatically when the desktop theme changes — no restart needed
- DEB package for Ubuntu and Debian-based distributions
- RPM package for Fedora, RHEL, and Arch-based distributions
Android app (beta)
- TYO Reach for Android now available on Google Play
- Native Go proxy client embedded as a shared library — no separate process required
- Supports arm64-v8a and x86_64 ABIs, both 16KB page-size compliant for Android 16+
- Team policy applies automatically when users sign in to their group account
Usage metering
- Monthly data allowance tracked in real time with a running byte counter
- Usage visible in the system tray and synced to your account dashboard at reach.tyo.com.au
- Overage warning notification at 80% of your monthly limit
- Second warning at 95% — gateway stays active until the limit is reached