# https://tunnels.io/use-cases/homelab

[Home](https://tunnels.io/) / [Use cases](https://tunnels.io/use-cases) / Homelab

Homelab and self-hosting

# Reach your home server when your ISP will not give you a port.

A box in your house runs Home Assistant, a media server or a Git remote, and you want it reachable from outside. Your router has no public address to forward, so a client on the box dials out and carries traffic back in, on an address that does not change.

[Get started free →](https://tunnels.io/get-started) [See plans and limits](https://tunnels.io/pricing)

## Why can your ISP stop you forwarding a port?

Carrier-grade NAT means your router holds no public address of its own, because the address the internet sees belongs to your ISP and is shared with other customers. There is nothing on your side to forward a port from, so the router's port forwarding page cannot help you however carefully you fill it in. The giveaway is a WAN address on the router status page between `100.64` and `100.127`.

So do not fight the router. A client on the home box opens an ordinary outbound connection to our edge, and requests ride back down it to your service. That is [why an outbound connection works when an inbound one does not](https://tunnels.io/learn/what-is-a-reverse-tunnel).

## Why does dynamic DNS not help under CGNAT?

Dynamic DNS solves a different problem. It keeps a hostname pointed at a public address that keeps changing, which is the right tool when your ISP hands you a real address and moves it weekly. Under carrier-grade NAT the address your updater publishes is the carrier's, and not one port on it is yours. The record is correct, the connection still fails, and every layer reports success while it does.

If your line does come with a routable address, dynamic DNS plus a forwarded port is a legitimate answer, provided you also own a firewall rule and certificate renewal for the life of the machine. The article that [weighs port forwarding against the other approaches](https://tunnels.io/learn/how-to-expose-localhost) sets out that cost. A tunnel removes all three jobs at once.

## What do people run at home, and what does each one need?

Two questions decide it. Does the service speak HTTPS or raw TCP, and does anything but you have to remember the address? Those are the only protocols we carry, and raw TCP starts on Professional at $4 a month.

| What you self-host | Protocol | Plan needed | Note |
| --- | --- | --- | --- |
| Media server | HTTPS | Pro, $4/mo | Every plan carries it. Bandwidth is the limit, not the protocol. |
| Home Assistant | HTTPS | Pro, $4/mo | Phones and automations store the address, so it must survive a restart. |
| Git server | HTTPS plus SSH over TCP | Pro, $4/mo | Cloning over HTTPS is one tunnel. SSH remotes need a second, TCP one. |
| NAS web UI | HTTPS | Pro, $4/mo | Free proves it works once, then the random name is gone on restart. |
| Minecraft server | TCP | Pro, $4/mo | The free plan cannot open a TCP tunnel at all. |
| Personal site | HTTPS | Pro $4/mo, or Gold $10/mo | Reserved subdomain on Pro. Your own domain starts on Gold. |

Simultaneous tunnels, not price, are the usual homelab constraint: five on Pro but only one of those may be raw TCP, ten of any kind on Gold, uncapped on Premium. A Git server with an SSH remote takes one HTTPS tunnel and the single TCP one, which means a Minecraft server alongside it needs Gold. The TCP cases have pages of their own, for [Minecraft hosting](https://tunnels.io/use-cases/minecraft-server) and [remote SSH access](https://tunnels.io/use-cases/ssh).

## Running the client on a box that never sleeps

A homelab tunnel is not a terminal session you sit and watch. Put the client under systemd so it comes up at boot, waits for the network, and restarts if the process dies. The unit is the only glue the setup needs.

```
# /etc/systemd/system/tunnels.service
[Unit]
Description=tunnels.io client
After=network-online.target
Wants=network-online.target
[Service]
ExecStart=/usr/local/bin/tunnels --log stdout start-all
Restart=on-failure
RestartSec=5
User=tunnels
[Install]
WantedBy=multi-user.target
```

Named tunnels live in the client's config file, so `start-all` brings the whole set up under one unit instead of one per service. On a headless box, set `inspect_addr` to `disabled` if you would rather the request inspector was not listening on `127.0.0.1:4040`. Builds cover linux amd64, arm64, 386 and armv7, so the same unit fits a rack server or a Pi.

## What happens to the tunnel when your router reboots?

It drops, because the tunnel is a TCP connection through a device that just lost all its state. The client notices, waits, and dials again, backing off exponentially with jitter, and it honours a reconnect delay the server can specify, so a restart on our side is no stampede on yours.

Restart=on-failure and that backoff cover different faults, and you want both. systemd handles the process dying or the machine rebooting. The client handles the network vanishing underneath a process that is otherwise healthy, which is the common case.

What you come back as depends on the plan. A reserved subdomain or your own domain stays yours between sessions, so the box returns on the address already saved on your phone. On the free plan the random 16-character name is released and the next session gets a different one. Our note on [keeping one hostname across restarts](https://tunnels.io/learn/what-is-a-reserved-subdomain) covers the rest.

## Which plan you need

Pick on two things: whether you need raw TCP, and whose name the service answers on.

Basic, free

$0

4 GB a month, one tunnel, HTTPS only, and a random 16-character subdomain on tunnels.host, reassigned when the client restarts. Good for proving the box is reachable. Not an address you can give anyone.

Professional

$4/mo

Or $40 a year. Three reserved subdomains, five tunnels of which four may be HTTPS and one raw TCP, and 128 GB a month. The homelab plan: a fixed name for your HTTPS services that survives every reboot, plus the raw TCP a Git remote or game server needs.

Gold

$10/mo

Or $96 a year. Point a CNAME at us, a certificate is issued through Cloudflare for SaaS, and the box answers on your own domain. Three custom domains, ten static hostnames, wildcards, ten tunnels, 256 GB.

Premium is $20 a month for 512 GB, unlimited tunnels and no lease expiry. A 24-month prepay exists on the paid plans: $72 Pro, $144 Gold, $288 Premium. [Pricing](https://tunnels.io/pricing) is authoritative.

## What this does not do

### Bandwidth is metered, and a media server will eat it

4 GB a month on free, 128 GB on Pro, 256 GB on Gold, 512 GB on Premium. One film streamed to a hotel television is several gigabytes of that. Budget for what leaves the house; what you watch on your own LAN never touches the tunnel.

### We are not a backup service

The tunnel moves traffic and stores nothing. If the disk in that box fails, everything on it is gone and the tunnel neither noticed nor helped. Keep a real backup off that machine.

### There is no UDP, so no WireGuard

We carry HTTPS and raw TCP, and the server rejects everything else by name. WireGuard is UDP, so it cannot be carried here, and nor can anything else needing datagrams. There is no SMTP tunnel type either, although SMTP is itself TCP and so rides a raw TCP tunnel like any other TCP service.

### A tunnel does not make an unpatched service safe

Publishing an old admin panel hands the internet a login form. The flag `--httpauth user:pass` puts basic auth at the edge in front of a tunnel, which stops casual scanners, but there is no OAuth, no IP allowlisting and no request replay.

## Related reading

[Why an outbound connection works when an inbound one does not The mechanism underneath all of this.](https://tunnels.io/learn/what-is-a-reverse-tunnel) [Port forwarding and the alternatives, compared Four approaches, with the trade-off of each.](https://tunnels.io/learn/how-to-expose-localhost) [Keeping one hostname across restarts Why a name that changes breaks everything that stored it.](https://tunnels.io/learn/what-is-a-reserved-subdomain) [tunnels.io vs Cloudflare Tunnel The other tool homelab threads recommend.](https://tunnels.io/compare/cloudflare-tunnel)

Neighbouring use cases: [IoT and remote devices](https://tunnels.io/use-cases/iot), [Minecraft servers](https://tunnels.io/use-cases/minecraft-server) and [SSH into a machine at home](https://tunnels.io/use-cases/ssh). More background in [Learn](https://tunnels.io/learn).

## Questions

### Can I access a home server if my ISP puts me behind CGNAT?

Yes. The client on your box makes an outbound connection, which carrier-grade NAT permits like any other, and inbound requests return down it to your service. You never need a public address of your own, and you never open a port on the router.

### Do I still need dynamic DNS?

No. The hostname belongs to us, whether it is a reserved subdomain on tunnels.host from Pro upwards or your own domain pointed at us with a CNAME from Gold upwards. There is no address of yours left for an updater to track.

### Will the tunnel come back on its own after a power cut?

Yes, if the client runs as a systemd unit that starts at boot with Restart=on-failure. It also reconnects by itself when the network drops, backing off exponentially with jitter. On a reserved subdomain or a custom domain it returns on the same address; on the free plan the random name changes.

### Can I run WireGuard through the tunnel?

No. We carry HTTPS and raw TCP only, and WireGuard is UDP. Use a VPN or a mesh network for a private overlay between machines you own, and a tunnel for the services you want published outside it.

### What does a stable address for a home server cost?

Professional is $4 a month or $40 a year, with three reserved subdomains, 128 GB a month, and five tunnels of which four may be HTTPS and exactly one raw TCP. Gold at $10 a month or $96 a year adds your own domain through a CNAME. The free plan cannot hold a name between restarts.

## Put the box online without touching the router.

Install the client on the machine that is already on, run one command, and check it from your phone on mobile data. The free plan proves it works before you reserve a name.

[Get started →](https://tunnels.io/get-started) [Compare plans](https://tunnels.io/pricing)