Recommended Free Tools
A PageKite front end is a public Debian server that accepts authenticated tunnels from PageKite back ends and proxies requests for their kite domains. To run one, install PageKite, point DNS at the server, allow TCP 80 and 443, define the front-end protocols and shared secret in /etc/pagekite.d/20_frontend.rc, then coordinate the back-end and TLS settings.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This arrangement gives you control over the relay’s hostname, certificates and access policy, but you also become responsible for its security, availability, capacity and network bills. Most users can use the hosted pagekite.net service instead; self-hosting is intended for operators who already control a reachable Internet server.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What a PageKite front end does
PageKite separates the private service (the back end) from the public relay (the front end). A back end opens an outbound tunnel to the front end. When a visitor requests a kite domain, the front end authenticates the registration, accepts the public connection and forwards the request through that tunnel to the back end’s local service.
The front end therefore needs a stable public address and a DNS name. It is not merely another configuration file on the same machine as your web application. The Debian host must be reachable from the Internet, and its firewall and any upstream security group must permit the relay ports.
PageKite’s documentation describes a self-hosted front end as useful when you have an Internet server and want to use it instead of, or alongside, the commercial pagekite.net service. Choose self-hosting when you need control of DNS, certificates or relay policy and are prepared to operate a public service. If you only need occasional access to a private application, using a hosted front end avoids that operational work.
Requirements before installation
- A Debian server with a public IPv4 address, IPv6 address, or both, and administrative access through
sudo. - A DNS name for the relay, such as
frontend.your.domain, resolving to that server. Plan the wildcard or hostnames that your kite domains will use. - Permission to receive TCP connections on ports 80 and 443. Check both the Debian firewall and any VPS, router or cloud security-group firewall.
- A strong, unique shared secret for the domains that the front end will accept. Treat it like a password.
- The local address and port of every back-end service you intend to expose, plus the certificate and trust files required for TLS.
Do not assume that a generic VPS has a particular throughput or connection limit. The reviewed PageKite documentation publishes no current universal capacity number for a Debian front end; practical capacity depends on CPU, memory, network path, protocol mix and configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Install PageKite on Debian
Install the Debian package
Refresh package metadata and install the distribution package:
sudo apt update
sudo apt install pagekiteThe current official download instructions use apt install pagekite. PageKite also publishes its own packages and the standalone pagekite.py program. Debian’s package can lag a few PageKite releases, so check the version available for your Debian release if a feature or bug fix matters to your deployment. Do not mix package sources casually: choose one installation method and keep its files and service management consistent.
Understand the daemon configuration directory
The packaged system daemon reads every file matching /etc/pagekite.d/*.rc in lexicographic order. Numbering files makes dependencies obvious and prevents an early setting from being unexpectedly replaced later. A common layout is:
10_account.rcfor account, front-end or kite credentials copied from a working user configuration.20_frontend.rcfor the public relay declaration.80_backend.rcfor local service mappings.
After creating or changing these files, restart the daemon so it rereads them. The package guide also shows copying a known-good user configuration into /etc/pagekite.d/10_account.rc, then running sudo systemctl restart pagekite.
Point DNS and firewalls at the relay
DNS
Create an A record for the front-end name, and an AAAA record if the host is reachable over IPv6. The name used by clients, certificates and PageKite’s frontend= setting must resolve to the same server. If your accepted kite names are below a wildcard such as *.your.domain, ensure the DNS records or wildcard record cover those names as well.
Verify resolution from a separate network before troubleshooting PageKite:
getent ahosts frontend.your.domainThe result should contain the public address of the Debian host, not a private address such as 192.168.0.1.
Network access
Allow inbound TCP 80 and 443 on the host firewall and on any upstream firewall. If another web service already occupies those ports, decide whether to move that service, give PageKite a dedicated address, or bind PageKite explicitly with the host= option described below. A port that is open in Debian but blocked by a cloud security group will still appear unreachable from the Internet.
Create the front-end configuration
Open the front-end file as root:
sudo editor /etc/pagekite.d/20_frontend.rcPut the essential settings in the file:
isfrontend
ports=80,443
protos=http,https
domain=http,https:*.your.domain:MakeUpAPasswordHereisfrontend
This switches the process into front-end mode. Without it, PageKite behaves as a client/back end and will not accept tunnel registrations as your relay.
ports=80,443
This declares the TCP listener ports. Keep the values aligned with the ports allowed by your firewalls and with the ports advertised to clients. If you intentionally expose only one protocol, remove the unused port and its corresponding protocol rather than leaving a listener that cannot be reached.
protos=http,https
This limits the front end to HTTP and HTTPS traffic. The protocol names must match the protocols listed on the domain line.
domain=http,https:*.your.domain:MakeUpAPasswordHere
The domain declaration combines three pieces: the accepted protocols, the wildcard domain and the shared secret used to authenticate tunnel registrations. Replace *.your.domain with the namespace you control and replace the example password with a long, random value. Do not reuse an operating-system password or publish this file in a repository.
Keep the wildcard scope no broader than necessary. If you operate separate environments, use separate domain names and secrets so that revoking one registration does not require changing every service.
Binding a specific address
If another service already uses the host, the PageKite guide permits a host= line to bind the listeners to a particular local address. Use the address assigned to the relay interface, then confirm that DNS points to its corresponding public address. Binding to 127.0.0.1 would make the relay inaccessible from the Internet.
Map a local back end
Create the service mapping file:
sudo editor /etc/pagekite.d/80_backend.rcA documented example is:
service_on=http:192.168.0.1:127.0.0.1:80:The Debian man page documents the equivalent form as --service_on=proto:kitename:host:port:secret. In the example, substitute the kite name assigned to your service, the address on which the local web server listens, its port and the appropriate secret. The local host and port are not automatically inferred: if your application listens on 127.0.0.1:8080, use those values instead of 127.0.0.1:80.
Keep the back-end service bound to a private or loopback address unless it must be directly public. PageKite should be the controlled public entry point; exposing the application’s port separately can bypass the relay’s authentication and TLS policy.
When the back end is on another machine, use its reachable private address and ensure routing and local firewall rules permit the PageKite process to connect. The front end still needs the public listener; the back end needs outbound connectivity to the front end.
Configure TLS and certificate trust
Certificate on the front end
Obtain a certificate whose name covers the relay hostname that visitors and back ends actually use. The official guide shows a front end with a frontend.pem file and this declaration:
tls_endpoint=frontend.your.domain:/path/to/frontend.pemReplace the hostname and path with your deployment values. Follow the certificate issuer’s required file format and permissions, and protect any private key contained in or referenced by the PEM file. Only the PageKite service account and administrators should be able to read private key material.
Trust settings on the back end
Configure each back end to contact the relay and verify its certificate:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsfrontend=frontend.your.domain:443
fe_certname=frontend.your.domain
ca_certs=/etc/pagekite.d/site-cert.pemfrontend identifies the relay and port. fe_certname is the certificate name to verify, and ca_certs points to the CA bundle or site trust file used by the back end. The endpoint, certificate name and trust roots must describe the same host and certificate chain. A certificate for a different name, an incomplete chain or a CA file that the PageKite process cannot read will prevent a secure connection.
Use the same spelling everywhere. Do not configure the back end with an IP address while asking it to verify a certificate issued only to frontend.your.domain; either use the DNS name or issue a certificate that legitimately covers the address.
Start and verify the service
Restart the packaged daemon
After saving the files, restart PageKite. Debian systems commonly support either of these commands:
sudo systemctl restart pagekite
sudo invoke-rc.d pagekite restartUse the command appropriate to your package and init integration. Then check the service state and inspect the log:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo systemctl status pagekite
sudo tail -n 100 /var/log/pagekite/pagekite.logThe packaged service writes to /var/log/pagekite/pagekite.log. Look for successful listener startup, certificate loading and authenticated back-end registrations. A process that starts but cannot bind a port usually indicates an address conflict or insufficient permission; a process that listens but receives no registrations usually has a DNS, firewall, credential or back-end connectivity problem.
Run interactively for diagnosis
Stop the daemon before running a foreground diagnostic instance, otherwise both processes may compete for the same ports:
sudo invoke-rc.d pagekite stop
sudo pagekite --clean --optdir=/etc/pagekite.d --logfile=stdio --debugio--clean avoids stale state, and --optdir=/etc/pagekite.d tells PageKite to read the system configuration directory. --logfile=stdio prints log messages in the terminal; --debugio adds detailed connection I/O diagnostics. Restore the daemon after testing:
sudo invoke-rc.d pagekite startPerform an end-to-end test
- From a network outside the Debian host’s local segment, resolve the front-end name and confirm it returns the intended public address.
- Confirm TCP 80 and 443 are reachable through every firewall layer.
- Start the back end and watch the front-end log for an authenticated registration.
- Request the exact kite hostname over HTTP and HTTPS. Check that the response comes from the local application, not a default web server on the front end.
- For HTTPS, inspect the certificate name and chain from the client’s perspective. A successful TCP connection is not proof that certificate verification is correct.
Troubleshoot by symptom
| Symptom | Likely causes | Checks and fixes |
|---|---|---|
| PageKite will not start | Syntax error, missing file, invalid option or a port already in use | Run the foreground command with --logfile=stdio --debugio; inspect the first error; check which process owns ports 80 and 443; correct the relevant .rc file and restart. |
| Remote clients cannot connect | DNS points elsewhere, an upstream firewall blocks the port, or PageKite is bound to the wrong address | Resolve the hostname externally, verify both firewall layers, and review any host= setting. Confirm that the listener address is public and that the declared ports match the open ports. |
| The back end never registers | Wrong relay hostname or port, mismatched domain secret, blocked outbound connection or a later configuration file overriding an earlier one | Check frontend=, the shared secret and file ordering under /etc/pagekite.d. Run the back end interactively and compare its errors with the front-end log. |
| HTTP works but HTTPS fails | Missing tls_endpoint, certificate-name mismatch, untrusted CA or unreadable PEM file |
Verify the certificate covers the exact relay hostname, set fe_certname to that name, point ca_certs at the correct trust file and fix file permissions. |
| The wrong local application answers | Incorrect kitename, host or port in service_on, or another virtual host is selected |
Compare the mapping with proto:kitename:host:port:secret, test the local host and port directly, and ensure the requested kite hostname matches the registration. |
| Changes appear to have no effect | The daemon was not restarted, or a later lexicographic configuration file overrides the value | Restart PageKite, list the files in /etc/pagekite.d in order and search for duplicate options. Keep related settings in clearly numbered files. |
Security and ongoing operations
- Protect credentials. The
domainsecret, service secrets, certificate private keys and CA files are server credentials. Restrict ownership and permissions, and rotate secrets when an operator or machine is retired. - Minimize exposure. Allow only the relay ports you need. Keep the back-end application on a private interface where possible, and apply normal Debian updates and service-account restrictions.
- Monitor registration and relay health. Review
/var/log/pagekite/pagekite.log, disk space and system resource use. A front end is a shared dependency: its outage affects every registered kite. - Plan certificate renewal. Renew certificates before expiry, install the new PEM or trust files with safe permissions and restart or reload PageKite as required by your package. Test both the listener and back-end verification after renewal.
- Measure your own workload. Documentation does not provide a universal Debian front-end connection or throughput limit. Observe CPU, memory, file descriptors, bandwidth and latency under your actual protocol mix before deciding whether to add resources or another relay.
Self-hosted front end versus a hosted relay
| Consideration | Self-hosted Debian front end | Hosted pagekite.net front end |
|---|---|---|
| DNS and certificates | You choose the relay name, DNS records and certificate files, and must maintain them. | The hosted service supplies the relay infrastructure; your control depends on its account and service options. |
| Operational work | You handle Debian updates, firewalls, logs, monitoring, backups and incident response. | The provider operates the public relay, reducing server administration. |
| Public-host cost | You pay for and size the Internet-facing host and its network usage; no general price is established here. | You use the provider’s plans and availability rather than procuring a separate relay host. |
| Scaling | You are responsible for capacity, redundancy and network design; the documentation gives no universal performance comparison. | Scaling is subject to the hosted service’s policies and limits. |
| Policy control | You can set your own accepted domains, secrets, listener addresses and certificate trust policy. | You accept the hosted service’s relay policy and supported configuration. |
Use the self-hosted configuration when those control benefits justify running a public network service. Otherwise, a hosted front end is usually simpler and leaves fewer failure modes for you to maintain.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
