haha. nope, no tunnelling required. it just sits on a home network or similar and watches a relay for NIP46 request events (connect, sign_event, nip04_encrypt etc)