Remote Access for Self-Hosted Services (Without a VPN)

You run services at home — Home Assistant, Plex, Nextcloud, Grafana, Pi-hole. They work perfectly on your local network. But the moment you leave your house, you're cut off.

The traditional solutions all have trade-offs:

• VPN (WireGuard, Tailscale) — Routes all your traffic, requires setup on every client device, overkill for checking a dashboard
• Reverse proxy + dynamic DNS — Requires a public IP (CGNAT breaks this), needs cert management, exposes your home IP
• Cloudflare Tunnel — Good option, but requires a Cloudflare account, custom domain, and YAML config files

Localport gives you a public URL for any local service with one command. No config files, no DNS, no exposed ports.

Quick setup

Any HTTP service

# Home Assistant (port 8123)
localport tunnel --token YOUR_TOKEN --local localhost:8123

# Jellyfin (port 8096)
localport tunnel --token YOUR_TOKEN --local localhost:8096

# Nextcloud (port 8080)
localport tunnel --token YOUR_TOKEN --local localhost:8080

# Grafana (port 3000)
localport tunnel --token YOUR_TOKEN --local localhost:3000

You get a public HTTPS URL. Open it on your phone from anywhere.

SSH access

localport tunnel --token YOUR_TOKEN --local localhost:22 --protocol tcp

SSH into your home machine from a coffee shop:

ssh [email protected] -p 47266

Running as a system service

Set it up once, and it runs on boot with automatic reconnection:

sudo tee /etc/systemd/system/localport.service << 'EOF'
[Unit]
Description=Localport Tunnel
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/localport tunnel --token YOUR_TOKEN --local localhost:8123
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now localport

Multiple services

Create a separate tunnel for each service you want to expose:

# home-assistant.service
ExecStart=/usr/local/bin/localport tunnel --token TOKEN_1 --local localhost:8123

# jellyfin.service
ExecStart=/usr/local/bin/localport tunnel --token TOKEN_2 --local localhost:8096

Or use mesh tunnels to run multiple services under one token, each with its own URL.

Security considerations

• No inbound ports — Localport connects outbound. Your firewall stays shut.
• No home IP exposed — Traffic routes through Localport's infrastructure. Your IP doesn't appear in DNS.
• HTTPS by default — Valid TLS certificates on every tunnel.
• Token rotation — Rotate tokens from the dashboard without touching your server.
• IP whitelisting (Pro) — Restrict access to your office IP or phone's carrier range.

Localport vs alternatives

When a VPN is better

If you need your entire home network accessible — routing traffic to multiple devices, file shares, printer access — a VPN is the right tool. Localport is for exposing specific services with minimal setup.

For most homelab users who just want to check their Home Assistant dashboard from the office or share a Plex link with a friend, Localport is the faster path.