Choose your front door: private network, tunnel or reverse proxy

Reach a home app from outside with a private network, a tunnel, or a reverse proxy. Here is how they work and who they let in.

Three front doors

Your apps run at home behind your router. To use them from your phone on the train, or to share them with a friend, something must let traffic in. You have three choices:

1. A private network. Your devices join one encrypted network. Only they can reach the app.
2. A tunnel. A connector at home dials out to an internet server. That server gives your app a public web address, while your router stays closed.
3. A reverse proxy with an open port. You forward port 443 on your router to an internal proxy, and the proxy directs each visitor to the right app.

The first option is the safest. The last asks the most of you. Why you should not open ports explains the risk behind that order. For each door, the sections below cover four questions: who can reach the app, what you need, what can go wrong, and when people use it.

Private network (mesh VPN)

Tools: Tailscale, Headscale, NetBird, and plain WireGuard with wg-easy.

Who can reach the app. Only devices you added to your network. A stranger who finds your IP address sees nothing. A friend can join, but must install the client app first.

What you need.

• Tailscale: a free account. You sign in through a provider such as Google, Microsoft, GitHub or Apple. Tailscale has no passwords of its own. The free Personal plan covers up to 6 users for non-commercial use. Sign in with a personal address from a public provider such as Gmail. An address on your own domain starts a 14-day Enterprise trial instead, though you can switch to the free plan. Whoever controls that sign-in account controls your network, so turn on two-step sign-in there. No domain, server, or port forward needed.
• NetBird: a hosted account (the free plan covers up to 5 users and 100 machines), or your own server. Self-hosting NetBird needs a Linux machine with a public IP, a domain name, and open ports: TCP 80, TCP 443, and UDP 3478. A small rented server (a VPS) works best.
• Headscale: your own coordination server, also on a machine with a public IP and HTTPS on port 443. Your devices use the standard Tailscale apps.
• wg-easy: one UDP port forwarded on your router (51820 by default), and a public IP address at home. WireGuard stays silent to anyone without a valid key, so this open port does not show up in scans like a login page does.

What can go wrong. Every user needs the client app on every device. That rules out borrowed laptops or relatives who refuse to install software. Plain WireGuard fails if your internet provider shares one public IP among many customers (CGNAT), because you cannot forward ports. Tailscale and NetBird bypass this. When they cannot connect two devices directly, they route traffic through a slower relay server.

Typical use. Apps for your household: photo libraries, password managers, media servers, and admin pages for your router or NAS.

Tunnel

Tools: Cloudflare Tunnel, Pangolin.

Who can reach the app. Anyone with the web address, unless you add a login page. Cloudflare provides Cloudflare Access for this. Pangolin includes its own login layer.

What you need.

• Cloudflare Tunnel: a free Cloudflare account and a domain on Cloudflare, so Cloudflare manages your domain's DNS. Tunnel is available on all plans. You run a small program, cloudflared, at home.
• Pangolin: your own server with a public IP, usually a VPS, and a domain that points to it. The server needs TCP 80 and 443 and UDP 51820 open, plus UDP 21820 if you use Pangolin's client apps. At home, the connector dials out and needs no open port.

What can go wrong. The login page is public. Keep the app updated and use strong passwords. With Cloudflare, TLS ends at Cloudflare, so Cloudflare can read your unencrypted traffic. Its terms for Free, Pro, and Business plans limit serving video and a disproportionate share of pictures, audio, or other large files. With Pangolin, you own the server, so you patch it, back it up, and pay for it.

Typical use. Sharing one app with people who will not install clients: recipe sites, shared calendars, or family sign-up forms. Read the media limits in Cloudflare Tunnel explained first. Tunnels also work when your provider gives you no public IP.

Reverse proxy with an open port

Tools: Caddy, Traefik, Nginx Proxy Manager.

Who can reach the app. Anyone on the internet. The proxy routes the request, but every visitor reaches your home network.

What you need. A public IP at home (not behind CGNAT), a domain name, and minimal port forwards: 443, plus 80 only if your certificate setup requires it. Let's Encrypt uses port 80 to verify domain ownership via its HTTP-01 challenge. Never forward SSH, remote desktop, SMB, databases, or admin panels. If your home IP changes, use a dynamic DNS service to update your domain records.

What can go wrong. Everything covered in Why you should not open ports. Scanners probe public IPs constantly, so expect traffic on port 443 soon after you open it. Any software bug or weak password behind the proxy becomes exposed. Your home IP appears in public DNS records. Lower the risk by placing an auth tool like Authentik in front of apps, updating everything regularly (the auth tool faces the internet too), and using CrowdSec or fail2ban to block addresses that keep failing to log in. These steps reduce risk, but do not remove it.

Typical use. Public websites hosted at home, or media servers shared with friends when you need no third party and no file size limits.

Which one to pick

You can mix them. Keep admin pages and private apps on a private network, and place a shared app behind a tunnel. Start with a private network. Add a public entrance only for apps that require it.

Next: What is Tailscale? and Cloudflare Tunnel explained.

Checked October 2026.