A socket on your Mac is behind your home router, which by default lets nothing in. There are two ways through, and Slash Socket supports both. Nothing you serve passes through slash.tools in either case — it only helps set the route up.
Your Mac dials out to Cloudflare and visitors arrive over its edge. There's no port to forward, no address to reserve, and it works even when your provider shares one public address between many homes (CGNAT). Cloudflare also terminates TLS, so you get wss:// with no certificate to manage and no port on the end of the address.
- Make a Cloudflare API token at dash.cloudflare.com → My Profile → API Tokens, with Account → Cloudflare Tunnel: Edit, Zone → DNS: Edit and Zone → Zone: Read.
- Paste it into Dashboard → Socket → Cloudflare. It's stored encrypted and never leaves the server.
- Pick the domain, a subdomain and the Mac. slash.tools makes the tunnel, points the hostname at it, and hands that Mac the credential to run it.
- In Slash Socket, Overview → Cloudflare tunnel → Get it, then Turn on. It fetches cloudflared, checks its signature, and keeps it running while the server runs.
Clients then connect to wss://ws.example.com — no port, because Cloudflare answers on 443.
Visitors reach your router's public address and it passes them to your Mac. Slash Socket first asks the router to do this itself over UPnP-IGD and then NAT-PMP; many routers have both switched off, in which case the Public access row walks you through the one rule to add, with your Mac's own address and port filled in and ready to copy.
- Open your router (the Overview's guide links straight to it).
- Find Port Forwarding, Virtual Server or NAT.
- Add a TCP rule: external port 3001 → your Mac's address, internal port 3001.
- Reserve that address for your Mac (DHCP reservation), or the rule stops working when it changes.
- Press Check in Slash Socket — slash.tools connects back from outside to confirm.
This route needs a certificate for https pages. Point a domain at your Mac in Dashboard → Socket (DNS Forwarding) and Slash Socket gets one from Let's Encrypt over DNS-01, serving https and wss on the same port. Clients then use wss://ws.example.com:3001.
Public access → details names each link: your public IP, your Mac's address on the network, the router, the router's own internet address, whether your provider is doing the natting (CGNAT), what the router said, the macOS firewall, and whether slash.tools could connect back. Copy sends the lot, and the fix, as plain text.
- Provider NAT (CGNAT): Yes — port forwarding can never work on this connection. Use a tunnel, or ask your provider for a public IP.
- “No answer” from both UPnP and NAT-PMP — the router has automatic mapping off. Turn it on, or add the rule by hand.
- macOS firewall · stealth — turn off Stealth mode in System Settings → Network → Firewall → Options.
- Reachable, but https fails — the certificate hasn't arrived yet, or the domain doesn't point at this Mac.