Use stunnel4 to place a TLS-encrypted connection between your application and a Redis server that only listens on localhost. The stunnel server accepts encrypted traffic on a firewall-protected port and forwards it to Redis on 127.0.0.1:6379; the client-side stunnel accepts local plaintext and creates the TLS connection to that listener. This protects the inter-host hop without changing Redis itself, provided you validate certificates, lock down private keys, and block direct access to Redis.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What stunnel changes—and what it does not
Stunnel is a TLS wrapper for an existing TCP service. It does not turn Redis into a TLS-aware server. Instead, two stunnel processes sit at the ends of the connection:
As an Amazon Associate I earn from qualifying purchases.
- Server side: accepts TLS on a reachable address and port, decrypts the stream, then connects to local Redis.
- Client side: accepts an application’s local plaintext connection, opens TLS to the remote stunnel listener, and forwards the stream.
The Redis protocol remains unchanged. Your application and the local client-side stunnel may communicate in plaintext on the same host, and the server-side stunnel and Redis may also communicate in plaintext over localhost. A compromise of either host can therefore expose commands and credentials. The design protects the network segment between the two hosts, not every segment of the data path.
When this design is appropriate
Stunnel is useful when the Ubuntu hosts cannot use Redis native TLS, when an existing Redis build lacks TLS support, or when you need to encrypt one client-to-server path without changing an application’s Redis settings beyond its host and port. It is a good fit for a simple standalone deployment.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
It is not a complete substitute for Redis native TLS in a topology that uses replication, Sentinel, or clustering. A client/server stunnel pair covers the connection you explicitly wrap; it does not automatically protect replication links or cluster-bus traffic. If your Redis version and build support native TLS, that option generally provides broader protocol coverage.
Plan the addresses, ports, and trust model
Choose separate listener ports so it is obvious which endpoint is encrypted. In the example below, Redis listens only on the server’s loopback interface, the server-side stunnel listens on TCP 6380, and the client-side stunnel listens on local TCP 16379. Using 16379 avoids colliding with a local Redis process; you can use local port 6379 only when that port is free.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Component | Example address | Purpose |
|---|---|---|
| Redis on server | 127.0.0.1:6379 |
Unencrypted Redis socket, reachable only locally |
| Server-side stunnel | 0.0.0.0:6380 |
TLS listener allowed from the client host |
| Client-side stunnel | 127.0.0.1:16379 |
Local socket used by the application or redis-cli |
| Remote destination in client config | redis.example.net:6380 |
Address and port of the server-side stunnel |
Replace every example hostname, address, password, certificate name, and port with values from your deployment. The hostname in the client’s certificate check must match a name in the server certificate’s Subject Alternative Name (SAN), or validation will fail.
Install stunnel4 and Redis tools on Ubuntu
Run the package installation on both tunnel hosts. Install redis-tools wherever you will use redis-cli for testing.
sudo apt update
sudo apt install stunnel4 redis-tools opensslUbuntu package behavior and available directives vary by release. Record the installed version and supported options before deploying:
stunnel -version
stunnel -optionsInspect the service unit as well, because the exact startup mechanism is package-specific:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
systemctl cat stunnel4
systemctl status stunnel4On package versions that use /etc/default/stunnel4, set the enable flag:
sudo editor /etc/default/stunnel4Set:
ENABLED=1Do not assume that setting this variable is sufficient on every Ubuntu release; confirm the unit and then enable it at boot:
sudo systemctl enable stunnel4Prepare certificates and private keys
The server needs an X.509 certificate and its private key. The client needs the CA certificate (or CA bundle) that can validate the server certificate. Keep the server private key on the server; do not copy it to clients. Store key files with restrictive ownership and permissions, for example:
sudo chown root:root /etc/stunnel/redis-server.key
sudo chmod 600 /etc/stunnel/redis-server.key
sudo chmod 644 /etc/stunnel/redis-server.crt /etc/stunnel/ca.crtUse your organization’s certificate authority and issuance process for production. A test environment can create a private CA and a server certificate with a SAN for the server hostname, but a self-signed certificate is not secure merely because encryption is enabled: clients must still be configured to trust the intended CA and verify the server identity.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Some historical stunnel examples put the certificate and private key in one PEM file. Stunnel can also use separate cert and key files; follow the syntax supported by your installed package and your certificate-management policy.
Configure the Redis server host
Bind Redis to localhost
Edit the Redis configuration used by your service, commonly /etc/redis/redis.conf, and make the Redis socket local:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
bind 127.0.0.1 ::1
port 6379Keep Redis’s normal port off the network. If Redis is already configured with a public bind address, remove that exposure before opening the stunnel listener. Restart Redis and verify its listening sockets:
sudo systemctl restart redis-server
sudo ss -ltnp | grep redisCreate the server-side stunnel service
Create a dedicated configuration such as /etc/stunnel/redis-server.conf:
pid = /run/stunnel-redis-server.pid
setuid = stunnel4
setgid = stunnel4
[redis-server]
accept = 0.0.0.0:6380
connect = 127.0.0.1:6379
cert = /etc/stunnel/redis-server.crt
key = /etc/stunnel/redis-server.keyaccept is the externally reachable TLS endpoint. connect is the decrypted destination, which must remain loopback. If your package requires a combined PEM file, use the package’s documented certificate option instead of guessing. If you require mutual TLS, add the CA file and client-certificate verification directives documented by your installed stunnel version; otherwise the server authenticates itself to clients but does not require a client certificate.
Restrict the firewall
Allow the stunnel port only from the client host or its private network. For a single client, an uncomplicated firewall rule can be expressed as:
sudo ufw allow from CLIENT_IP to any port 6380 proto tcp
sudo ufw deny 6379/tcp
sudo ufw status verboseAdapt the commands to your firewall policy. The important controls are that TCP 6380 is reachable only by approved clients and TCP 6379 is not reachable from the network.
Configure the Ubuntu client host
Create a client-mode configuration
Create /etc/stunnel/redis-client.conf:
client = yes
pid = /run/stunnel-redis-client.pid
setuid = stunnel4
setgid = stunnel4
[redis-client]
accept = 127.0.0.1:16379
connect = redis.example.net:6380
CAfile = /etc/stunnel/ca.crt
verifyChain = yes
checkHost = redis.example.netclient = yes reverses the roles used by the server configuration: stunnel accepts local plaintext and creates the outbound TLS connection. CAfile identifies the trust anchor. The verification and hostname-check directives shown above are supported by many current builds, but option names and defaults are release-sensitive; confirm them with stunnel -options and the Ubuntu manpage. Do not remove verification simply to make a failing connection work.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
If the application must use port 6379, change accept to 127.0.0.1:6379 only when no local Redis daemon owns that port. Otherwise keep 16379 and set the application’s Redis host to 127.0.0.1 and port to 16379.
Start and enable the tunnel
Place the file in the directory loaded by your Ubuntu stunnel service, then restart the service:
sudo systemctl restart stunnel4
sudo systemctl enable stunnel4
sudo systemctl status stunnel4If you operate multiple independent tunnels, verify how your package discovers files in /etc/stunnel and whether each configuration needs its own service unit. A configuration can be syntactically valid yet never start if the service is not loading that file.
Verify encryption, identity, and Redis authentication
Check local and remote listeners
On the server, confirm that Redis is local-only and stunnel owns the external port:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →sudo ss -ltnp | grep -E '6379|6380'On the client, confirm that only the local listener is exposed:
ss -ltnp | grep 16379Inspect the TLS handshake
From an approved client host, inspect the certificate and trust chain:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
openssl s_client -connect redis.example.net:6380
-CAfile /etc/stunnel/ca.crt
-verify_hostname redis.example.netA successful result should show a certificate chain that validates to the supplied CA and a hostname match. A handshake that succeeds without certificate verification is not evidence that the client reached the intended server.
Run a Redis command through the local tunnel
Point redis-cli at the client-side listener, not at the server’s Redis port:
Recommended Free Tools
redis-cli -h 127.0.0.1 -p 16379 PING
redis-cli -h 127.0.0.1 -p 16379 AUTH 'YOUR-REDIS-PASSWORD'
redis-cli -h 127.0.0.1 -p 16379 INFO serverUse your deployment’s ACL username and password syntax where applicable, and do not place real credentials in shell history. The expected first response is PONG. Check stunnel logs while testing:
sudo journalctl -u stunnel4 -fFinally, test that the server’s Redis port is not directly reachable from the client network. A refused or filtered connection to redis.example.net:6379 is expected; applications should use only the local stunnel endpoint.
Understand the security boundaries
Redis authentication alone does not encrypt traffic. Redis documents that the AUTH command, like every other Redis command, is sent unencrypted; anyone able to eavesdrop on that network segment can capture it. The tunnel must therefore be established before sending authentication and data.
Stunnel also does not protect a compromised client or server. On the client, an attacker with local access can read the application-to-stunnel stream. On the server, an attacker can read the stunnel-to-Redis stream or the Redis process’s memory. Use host hardening, least-privilege service accounts, restrictive key permissions, patching, and network segmentation in addition to TLS.
Certificate validation is the control that prevents an encrypted connection to the wrong endpoint. Trust the correct CA, check the server name, rotate certificates before expiry, and monitor stunnel logs for verification failures rather than disabling checks.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Client listener is absent | Service did not load the configuration or failed to start | systemctl status stunnel4, journalctl -u stunnel4, file location, permissions, and syntax |
| “Connection refused” to the remote port | Server stunnel is stopped, firewall blocks the client, or the listener address is wrong | Server ss -ltnp, firewall rules, and the accept/connect values |
| TLS handshake fails with an unknown CA | Client lacks the issuing CA or has the wrong CA bundle | CAfile path, file readability by the stunnel account, and certificate chain |
| Hostname verification fails | Configured name is absent from the certificate SAN | Use the certificate’s SAN name in connect/checkHost, or reissue the certificate |
| Tunnel connects but Redis commands fail | Wrong local port, Redis is not listening on loopback, or authentication is required | Redis logs, local port ownership, bind/port, ACLs, and credentials |
| Address already in use | Another Redis or stunnel process owns the chosen local port | ss -ltnp; select an unused local port such as 16379 |
Stunnel versus native Redis TLS
| Consideration | Stunnel | Redis native TLS | Managed Redis service |
|---|---|---|---|
| Redis support | Works with an existing TCP Redis service and does not require Redis TLS support | Requires a Redis version and build configured with TLS | Provider determines supported Redis or Valkey features |
| Traffic covered | Only the explicitly wrapped client/server path | Can cover clients, replication, and cluster-bus traffic when configured | Provider documents the encrypted paths and controls |
| Certificate work | Manage stunnel certificates, keys, trust stores, and service files on tunnel hosts | Manage Redis TLS certificates and client settings | Provider may issue or rotate certificates; optional mutual authentication depends on the service |
| Operations | Operate Ubuntu packages, firewall rules, monitoring, and two tunnel endpoints | Operate Redis TLS settings and the Redis deployment | Less host-level maintenance, with provider-specific networking and pricing |
| Performance | TLS adds CPU and latency overhead; no authoritative universal figure applies | Also incurs TLS overhead, with fewer proxy hops | Depends on the provider, instance type, and configuration |
Redis’s native TLS interface uses a TLS port and can disable the ordinary non-TLS port by setting it to zero. Its tooling includes redis-cli --tls with certificate, key, and CA options. Native TLS is usually the stronger choice for replication or clustering because those connections can be configured as part of Redis itself. A managed service such as Amazon ElastiCache can be preferable when maintaining Ubuntu tunnel hosts, certificates, and firewall rules is not desirable; evaluate its documented TLS mode, mutual-authentication options, network placement, and cost for your region.
Operational checklist
- Redis binds to loopback or another private interface and is not directly reachable from untrusted networks.
- The server-side stunnel port is allowed only from approved client addresses.
- The client uses
client = yesand connects to the server-side TLS port, not to Redis port6379. - The client trusts the correct CA and verifies the server certificate and hostname.
- Private keys are readable only by the required account and are never copied to clients unnecessarily.
- Both tunnel endpoints start after reboot and their logs are monitored.
- Applications and maintenance commands use the local stunnel listener.
- Redis authentication is still enabled; TLS protects credentials in transit but does not replace authorization.
- Replication, Sentinel, and cluster-bus links are separately assessed; do not assume a client tunnel covers them.
The Bottom Line
Stunnel is a practical way to encrypt Redis traffic between Ubuntu hosts when native Redis TLS is unavailable: keep Redis private, expose only a restricted stunnel listener, validate the server certificate, and send clients to the local tunnel port. Choose native Redis TLS when you need integrated protection for replication or cluster traffic.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
