diff --git a/pkgs/tools/networking/rathole/default.nix b/pkgs/tools/networking/rathole/default.nix
new file mode 100644
index 000000000000..74eb894f0d0f
--- /dev/null
+++ b/pkgs/tools/networking/rathole/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, openssl
+, CoreServices
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "rathole";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "rapiz1";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-gqWgx03mUk6+9K4Yw5PHEBwFxsOR+48wvngT+wQnN1k=";
+  };
+
+  cargoSha256 = "sha256-dafOgZtiszkoi97PpAVMtdvJd5O3EK9hDVNLJ32FYzE=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin [ CoreServices ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = with lib; {
+    description = "A lightweight and high-performance reverse proxy for NAT traversal, written in Rust";
+    homepage = "https://github.com/rapiz1/rathole";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1b3a99113651..b31107ad96d4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16524,6 +16524,10 @@ with pkgs;
 
   ran = callPackage ../servers/http/ran { };
 
+  rathole = callPackage ../tools/networking/rathole {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };
+
   retry = callPackage ../tools/system/retry { };
 
   rizin = pkgs.callPackage ../development/tools/analysis/rizin { };