A private network for all your machines
You want to reach the machine at home from your phone at a coffee shop. The old answer was to open a hole in your router and pray, which is how half the internet ends up in a botnet. There's a better way, and it closes the hole instead of drilling one.
The idea is a private overlay network. Picture a hallway that only your own devices are allowed to walk down, laid quietly on top of the public internet. Your laptop, your phone, and the little server in the closet all step into the same hallway and can talk to each other directly, by a stable private address, from anywhere in the world. Everyone else on the internet doesn't even see a door.
Underneath, it's an encrypted tunnel between your devices. You can wire that up by hand, and it's a genuinely good protocol, but the manual version means managing keys for every pair of machines, which gets old fast. The shortcut is a coordinator that does the key exchange for you, so adding a device is just signing it in. Same tunnel, none of the bookkeeping.
Why this beats opening a port
An open port is a permanent invitation with your name on it, and the whole internet reads it. A private overlay flips that: nothing is exposed, and the only things that can reach your machine are the devices you personally added to the network. You get to your stuff from anywhere, and an attacker gets a wall with no door.
What you do not publish: the point of this is that your specific network stays yours. Set it up, use it, and keep the details of which machines you run and how they connect to yourself. The value here is the method. The map is nobody's business, which is exactly the point of a private network in the first place.
Now the part that looked like slow hardware
The first time I moved my media over this, it was sluggish, and I blamed the server. Wrong. Both devices were sitting on the same home network, ten feet apart, but I was routing them to each other the long way, out through the overlay and back, instead of straight across the local wire. The overlay is for when you're away. At home, let them find each other on the local network. Field Log 003 hit the exact same wall with the media server, so if that one bit you too, this is the same fix.
Once I let same-network devices talk over the local wire and saved the overlay for when I'm actually out of the house, it was fast everywhere. The tunnel was never the problem. The route was.
A private network your devices share, reachable from anywhere, with nothing exposed to the public internet. Generic setup, your details stay yours. Replace every value in angle brackets with your own.
1. Pick the tunnel
The encryption is a settled question: use WireGuard. You can run it raw, or use a coordinator that handles the key exchange so adding devices is a sign-in instead of a config-file chore. Start with the coordinator, drop to raw WireGuard later if you want full manual control.
# the tunnel is WireGuard either way. the coordinator just
# does the key exchange for you so onboarding is a login.Source: tailscale.com for the coordinator path, or wireguard.com to run it yourself.
2. Add each device
Install the client on every machine you want in the hallway: your laptop, your phone, the always-on box. Sign each one in to the same private network. Each device gets its own stable private address that follows it anywhere.
# install on each device, then join the same private network
# <your-laptop>, <your-phone>, <your-home-server> all join
# each gets a private address that works from anywhere3. Reach your machine, from anywhere, no open ports
From the coffee shop, your phone reaches the home box by its private address as if they were in the same room. Your router keeps every port closed. Nothing about your home is visible to the public internet.
# from anywhere, talk to the home box by its private address
ssh <your-user>@<home-box-private-address>
# the router stays sealed. no port forwarding, no exposure.4. THE ROUTING GOTCHA: use the LAN at home
When two devices are on the same local network, let them talk over the local wire, not out through the overlay and back. Routing same-network devices through the tunnel is the mistake that looks like slow hardware (see Field Log 003). Overlay for away, local network for home.
# same building = go straight across the LAN (fast)
# out of the house = go over the overlay (works anywhere)
# mixing these up is the "why is this so slow" bug5. Keep the details to yourself
Now you can reach everything and expose nothing. The setup is worth sharing, this whole log is. The specifics of your network, which machines you run and how they connect, are the one thing you keep private. That's the entire reason to have a private network.
# share the method. keep the map.
# a private network you describe in full is no longer private.You now reach your machines from anywhere with nothing open to the world, and your actual layout never leaves your head.