Guides › Best-of lists
How to access your home server remotely without port forwarding (2026)
Updated 10 November 2026
Short answer: Tailscale is the easiest way to put your phone and servers on one private network. Cloudflare Tunnel is best for publishing a web app. WireGuard is the do-it-yourself option. If what you actually want is to manage the machines (graphs, terminal, screen, files) rather than reach every port, an outbound-relay tool like bananana.dev does that with no VPN on your phone.
Disclosure: written by the bananana.dev team. Checked November 10, 2026.
Why avoid port forwarding
An open port is a door anyone on the internet can knock on. Many home connections are behind carrier-grade NAT anyway, so forwarding doesn't even work. All four options below make the connection go outward from your network instead.
1. Tailscale (mesh VPN)
Install on each device and they can reach each other privately. The Personal plan is free for up to 6 users with unlimited devices.
Good for: reaching any service on any port. Trade-off: every device you connect from needs the client, and you still need SSH or a dashboard on top.
2. Cloudflare Tunnel
A small daemon on your server connects out to Cloudflare and publishes a hostname. Pair it with Cloudflare Access to require a login.
Good for: sharing a web app (a media server, a wiki). Trade-off: traffic is decrypted at Cloudflare's edge, and it's built for HTTP rather than shells and desktops.
3. WireGuard
Fast, simple VPN you run yourself. Trade-off: you usually still need one reachable endpoint (a forwarded port or a VPS).
4. An outbound-relay management tool (bananana.dev)
Each machine and the dashboard connect outward over HTTPS to a relay. Traffic between your dashboard and machines is end-to-end encrypted (Noise IK, the framework WireGuard is built on), so the relay sees metadata, not content. From the web or the Android and iPhone apps you get monitoring, a terminal, screen control, files and Docker, with no VPN on your phone.
Trade-off: it's for managing machines, not for reaching arbitrary ports or publishing websites. The relay is run by the vendor, and opening the dashboard through its bananana.dev web address is encrypted in transit but not end to end.
Which one?
- Reach everything: Tailscale.
- Publish a web app: Cloudflare Tunnel.
- Full control, have a VPS: WireGuard.
- Monitor and fix machines from your phone: bananana.dev, alongside any of the above.
FAQ
Can I SSH into my home server without opening a port?
Yes, through Tailscale, a WireGuard VPN, or a tool whose agent connects outward, like bananana.dev's terminal.
Does bananana.dev replace Tailscale?
No. It's not a VPN. It gives you a management dashboard without one. Its "bunch" network feature is itself built on Tailscale's open-source client and Headscale.
Further reading
Try bananana.dev free for up to 10 devices: https://bananana.dev/pricing