Egress Recon vs Tunnelless

You are on a guest Wi-Fi you did not choose. Something will not connect and nobody can tell you why. Egress Recon answers that from your phone, in under a second. WHICH PORTS GET OUT Sixteen common outbound ports, tried against real public services. You get more than "open" or "closed": • Refused and timed out are different answers. One means something on the network actively rejected the connection; the other means it was dropped silently. • Intercepted is its own finding. The connection succeeded, but the thing that replied was not the service you asked for — a portal, a proxy, or a middlebox re-signing TLS. WHAT NAT YOU ARE BEHIND Your public address, and whether your NAT gives you a reusable mapping or a symmetric one — the reason a video call falls back to a relay. Carrier-grade NAT is reported with its confidence and the evidence behind it, never as a bare label. IPv6 and NAT64 state, and whether you can reach your own public address from inside. WHAT IT DOES TO DNS Whether plain DNS gets out. Whether the network's resolver agrees with a public one. Whether it invents answers for names that cannot exist. And whether DNS over HTTPS and DNS over TLS still work when plain DNS does not — each tested with a real query, not just a connection. WI-FI VERSUS CELLULAR The most useful thing a network tool can tell you is "this Wi-Fi blocks it, and your cellular connection does not." Egress Recon runs the same tests over both and shows the difference — attributing it correctly in both directions, because blaming the café for something your carrier blocks helps nobody. BEHIND A CAPTIVE PORTAL It tells you the portal is there, shows the URL it is pushing you to, and labels the results "before you sign in." Sign in, run again, and it shows you exactly what changed. IT SHOWS ITS WORK Every verdict comes with what was actually observed: the banner the server sent, the certificate it presented and who issued it, the exact response that came back. You can check the reasoning instead of trusting a colored label. Where something cannot be determined, it says so and why. Two ports in the standard set have no public server to test against, so they stay untested rather than showing a red cell that means nothing. Share any run as text, a web page, a PDF, or JSON. Saved runs are grouped by network. PRIVACY • No analytics, no telemetry, no accounts, no ads, no third-party SDKs. • It never scans your network. Every probe goes to a public internet service — never your router, never your other devices. That is why it never asks for local network permission. • It does not read your Wi-Fi name. That needs location permission, which it never requests. • Saved runs stay on your device. A report leaves only when you share it. Egress Recon for Mac and for iPhone and iPad are both free apps on one App Store record. Requires iOS 17 or iPadOS 17.

Tunnelless puts your iPhone, iPad, or Mac on your private Tailscale network without installing a VPN profile. Apps that reach a private network normally need a system VPN: a NetworkExtension, an "Allow VPN configuration" prompt, and a profile that takes over device-wide routing and conflicts with any other VPN you already run. Tunnelless does none of that. It runs a userspace network node inside the app and exposes a local SOCKS5 proxy, so only this app's traffic uses your private network. The rest of your device is untouched, and you can keep running your work VPN at the same time. WHAT IT DOES • Joins your existing Tailscale network with a standard browser sign-in • Shows your node's private IP address once connected • Exposes a local SOCKS5 proxy address for reaching machines on your network • Signs out and deletes local state on demand REQUIREMENTS • A Tailscale account. Tunnelless connects to a network you already have. It is not an account, hosting, or subscription service, and it does not create networks for you. PRIVACY Tunnelless collects no data, includes no analytics, and performs no tracking. Sign-in happens directly with Tailscale; your credentials are never seen by us. Network state is stored only on your device and is removed when you sign out. Tailscale is a registered trademark of Tailscale Inc. Tunnelless is built by Indiagram LLC and is not affiliated with, endorsed by, or sponsored by Tailscale Inc.