This policy governs your use of TunnelNet, a service operated by MinakiLabs LLC. It applies to every TunnelNet service, including TunnelNet Halo and TunnelNet VPN, and to every address leased through the service. Sections that apply to one product say so.
Every address we lease comes from a single block registered to us. If one address is used for abuse, the reputation of the entire block suffers. Mail providers, security vendors, and network operators frequently block whole ranges. That means one customer's misuse can break the service for every other customer, including people who have done nothing wrong.
This is the main reason this policy exists, and why we enforce it quickly.
You may not use a leased address to:
The service is inbound for TunnelNet IP. Your leased address exists so that people on the internet can reach your machine; outbound traffic sourced from a leased address is not part of what the service provides.
We drop outbound connections to TCP port 25 (SMTP) sourced from any leased address, and from every Halo server. This is enforced at both of our network edges, and there is no exception process. We do not offer an email product, and one sender is enough to have the entire block listed by mail providers, which would break the service for every other customer on it.
We do not currently filter any other outbound port. If that changes, we will update this page.
Egress mode is an opt-in setting on a single device. With it on, that device’s outbound internet traffic leaves through us and arrives at its destination carrying your leased address instead of ours. It is intended for hosting: sending mail from a server that also receives it, calling APIs that whitelist by IP, and anything else that needs a stable, predictable outbound identity. It is off unless you turn it on, and turning it on requires accepting the terms in this section.
Your traffic can be traced to your account; do not use this service to hide who you are. Your traffic is attributable to you. The address is leased to your account, we know which account it belongs to, and we record when egress was switched on and off and by whom. If we receive a complaint we will be able to say whose traffic it was, and we will. If you want your traffic not to be traceable to you, this is the wrong product.
Outbound TCP port 25 stays blocked, including with egress mode on. There is no exception process and there is no way to buy one. If you run a mail server, egress mode gives you a stable identity for receiving mail and for relaying through a provider that accepts authenticated submission — it does not give you raw outbound SMTP. Please check that this is what you need before you buy.
You are sharing a reputation. The addresses we lease all sit inside 23.187.152.0/24, and blocklists list the /24 rather than a single address. Traffic you send affects deliverability and access for every other customer in the block. That is why the list of things we do not permit above applies with more force here, and why we act quickly.
What we record, and what we do not. We record when egress was enabled or disabled for a device, who did it, which version of these terms was accepted, and how much traffic the device sent. We do not record where you connected to, what you sent, or the contents of anything. We keep enough to answer an abuse complaint about a specific address at a specific time, and no more.
We can switch it off. If we receive a credible abuse complaint we may disable egress for a device immediately, before contacting you. That leaves the rest of your service running: your address stays yours and inbound traffic keeps working. We will tell you what we received and what we did.
What Halo does with your traffic. Your devices connect to your own Halo server, which we run for you. It filters what they look up and connect to, blocking malware, spyware, trackers, ads and data brokers in the categories you choose, and it shows you what it blocked and why. You can switch any category off, and you can let any site through. Your choice always wins over ours. Your reports are built and kept on your own Halo server. Our central systems pass them to your dashboard when you open it, use them to send you malware alerts, and keep none of them.
Your devices, your household or business. Halo is for the devices you pay for, used by you, your household, or your business and its staff. You may not resell Halo, share it with people outside your household or business, or connect more devices than your plan includes. You are responsible for what anyone does through the devices on your plan, whether or not you knew about it.
You may not use Halo to:
Your analyst. Your analyst is on from the start. It runs on your own Halo server and works only from counts of website names that server keeps: how many times each device looked up each website’s name (the site’s main name, such as example.com, never the page), hour by hour, and how many of those Halo blocked. For a known threat it also keeps the full name that was looked up. It never sees the pages you open, what you type or send, or the contents of your traffic, and these counts are not sent to any outside AI service. It suggests fixes and never acts on its own: nothing changes until you press the button, and anything you apply can be undone in one tap. You can turn your analyst off in your Halo dashboard at any time. Turning it off does not stop malware alerts.
Your dedicated address. Every Halo plan includes a dedicated IPv4 address from our own network, 23.187.152.0/24, which is used only for Halo. It is yours to use while you have Halo. Everything in this policy applies to traffic from that address, and abuse from it is traced to your account. Don’t use Halo to hide who you are. Outbound mail on port 25 is blocked from it, with no exception. The address belongs to us: you can’t sell, transfer or take it with you. If you choose in your dashboard to use your Halo server’s own address instead, we hold your dedicated address for you for 30 days, then release it. When your plan ends, or a held address is released, it rests for 30 days before anyone else can get it, then goes back to our pool and may later be given to another customer.
Mail (port 25). Outbound connections to TCP port 25 from Halo are blocked. There is no exception, and no way to buy one. We block it because one sender of spam can get a whole range of addresses refused by mail providers.
Fair use. Each Halo plan includes up to 2 TB of traffic a month through your Halo server, which is far more than normal home or office use. Far above that, we may slow your Halo server for the rest of the month. We’ll email you before we do.
How we handle abuse reports. When someone reports abuse from your Halo server’s address, we use the address and the time to find which account held it. Depending on how serious it is, we may ask you to fix it first, or stop outbound traffic from your Halo straight away while we look into it. A suspension stops all your devices: while it lasts, none of them can reach the internet through Halo. We email you what we received, what we did and what we need from you, unless the law stops us. If the problem is resolved, we restore service. Serious or repeated violations end the service. Send reports to support@minakilabs.com; we reply within one business day.
What we keep for abuse handling. Which account held which address, and when, including after your service ends. When outbound traffic from your Halo was stopped or restored, by whom and why. Hourly counts of blocked connection attempts to your dedicated address are kept for 30 days. Our central systems never keep the contents of your traffic or a record of the sites you visit. Your own Halo server keeps daily counts of the website names each device looked up, for 30 days, so it can show you your reports; they are not copied to our central systems, and they are deleted when your Halo server is deleted.
We investigate abuse reports promptly, and we reply within one business day.
We investigate. Depending on severity we may contact you first, or suspend your address immediately and contact you after. Suspension stops traffic but does not release your address; if the issue is resolved we can restore service. For serious or repeated violations we will terminate the service and release the address.
We will tell you what we received and what we did, unless we are legally prevented from doing so.
We respond to properly formed notices under the Digital Millennium Copyright Act. Our designated agent is the Copyright Agent, MinakiLabs LLC, registered with the United States Copyright Office in the DMCA Designated Agent Directory (registration number DMCA-1082047). Send notices to support@minakilabs.com.
A notice must identify the work, identify the material you say infringes it and where it is, give your contact details, and include the two statements the DMCA requires: that you believe in good faith the use is not authorised, and that the information is accurate and you are authorised to act for the owner. See Terms of Service §13 for the full text.
We forward valid notices to the customer responsible for the address, and we terminate the service of anyone who repeatedly infringes.
If an address in 23.187.152.0/24 is being used abusively, email support@minakilabs.com with the address, timestamps including timezone, and any relevant logs. We take these seriously. We reply within one business day.