Reach your own computers from anywhere without opening your front door
What you will learn
- How to reach your home machines from anywhere without opening your house up
- Why this closes a hole instead of drilling one
- The routing mistake that looks exactly like slow hardware
You want to reach the machine at home from your phone in a coffee shop. The old answer was to open a hole in your router and hope, which is how a great deal of the internet ends up quietly working for somebody else. There is a better way, and it closes the hole rather than drilling one.
Imagine a hallway that only your own devices are allowed to walk down, laid quietly on top of the public internet.
Your laptop, your phone and the little machine in the cupboard all step into the same hallway and can talk to each other directly, from anywhere in the world. Everybody else on the internet cannot even see a door.
Underneath, it is an encrypted connection between your devices. You can set that up by hand, and the technology is genuinely good, but doing it manually means managing keys for every pair of machines, which gets tiresome quickly.
The shortcut is a service that handles the key exchange for you, so adding a device is just signing it in. Same connection underneath, none of the bookkeeping.
Why this beats opening a door
An open door in your router is a permanent invitation with your address on it, and the entire internet reads it.
A private network flips that round. Nothing is exposed, and the only things that can reach your machine are the devices you personally added. You get to your things from anywhere, and a stranger gets a wall with no door in it.
The point of this is that your particular network stays yours. Set it up, use it, and keep the details of which machines you run and how they connect to yourself.
The value here is the method. The map is nobody's business, which is precisely the point of a private network in the first place.
Now the part that looked like slow hardware
The first time I moved video over this it was sluggish, and I blamed the server.
Wrong. Both devices were sitting on the same home network, ten feet apart, but I was sending them to each other the long way round: out through the private network and back, instead of straight across the local wire.
The private network is for when you are away. At home, let them find each other locally.
The guide about keeping the films you paid for hit exactly the same wall, so if that one caught you too, this is the same fix.
Once I let devices on the same network talk over the local wire, and saved the private network for when I am actually out of the house, it was fast everywhere.
The tunnel was never the problem. The route was.
A private network your devices share, reachable from anywhere, with nothing exposed to the public internet. Replace anything in angle brackets with your own value.
1. Pick the connection
What to choose: the encryption itself is a settled question. Use WireGuard.
Two ways to run it: raw, where you manage the keys, or through a service that handles the key exchange so adding a device is a sign-in rather than editing files.
Which to start with: the service. You can drop to the manual version later if you want complete control.
Find it at tailscale.com for the easier path, or wireguard.com to run it yourself
2. Add each device
What to do: install the client on every machine you want in the hallway. Your laptop, your phone, the machine that stays on. Sign each one into the same private network.
What should happen: each device gets its own permanent private address that follows it anywhere in the world.
3. Reach your machine from anywhere
What this does: connects to your home machine by its private address, exactly as though you were in the same room.
What is happening in your router: nothing. Every door stays closed, and nothing about your home is visible from the public internet.
ssh <your-user>@<home-box-private-address>4. The routing trap: use the local wire at home
The rule: when two devices are on the same local network, let them talk across the local wire, not out through the private network and back.
What goes wrong if you mix these up: it looks exactly like slow hardware, and you will blame the wrong machine for a long time.
# same building = go straight across the local network (fast)
# out of the house = go over the private network (works anywhere)5. Keep the details to yourself
Now you can reach everything and expose nothing. The method is worth sharing, and this whole guide is. The specifics of your own network, which machines you run and how they connect, are the one thing you keep private.
A private network you describe in full is no longer private.
This page in the original Kyber Cypher voice: A private network for all your machines