Private ports on your other machines
The staging database, the admin page on the home server, the dev server on your desktop. Private access brings one port to the machine you are on, for you alone.
$ pb access machine studio --port 5432 --listen 127.0.0.1:5432$ psql -h 127.0.0.1 -p 5432 app- 1
Port 5432 on studio is now port 5432 on this laptop, until you stop the command.
- 2
Any TCP client. It thinks the database is local.
Reach a port by name
For web services there is nothing to run. Every machine has a name that works only on your own machines, with HTTPS your browser accepts.
| You type | You reach |
|---|---|
https://3000.studio.ppr.boats | Port 3000 on studio over HTTPS and WebSocket, with a certificate your browser trusts |
https://studio.ppr.boats:3000 | The same service, with the port after the name |
https://studio.ppr.boats | A page listing the ports studio is serving to you |
| studio's own 127.100.x.y address, any port | Raw TCP of any kind: a database, Redis, a game server |
End-to-end encryption
Encrypted between the two machines: direct when it can be, through a relay that cannot read it when not.
Direct
Two machines that can reach each other talk peer to peer. This is the usual case, and it never counts against your plan.
Relayed
When a network blocks the direct path, a relay passes the same encrypted bytes along. It has no key to read them.
- Encrypted between your machines. Nothing in the middle can read it.
Direct: laptop to studio, end-to-end encrypted. Relayed: laptop to relay to studio, still end-to-end encrypted.
Names and certificates
Give a port a name you will remember. The name grants nothing by itself; it only works while you are allowed to reach that port.
When something is slow, pb ping tells you whether the two machines found a direct path. pb relay list shows
the relays you can use; the console's Network page adds their latency.
$ pb config local-access alias set studio grafana 3000$ pb resolve studio$ pb ping studio
sample 1: path=direct connect=18.42ms
sample 2: path=direct connect=11.07ms
sample 3: path=direct connect=10.88ms
sample 4: path=direct connect=11.31ms
summary: sent=4 received=4 loss=0.0% connect min/avg/max=10.88/12.92/18.42ms- 1
Now
https://grafana.studio.ppr.boatsopens port 3000. - 2
Shows the local address this computer uses for studio, and which ports are open to you.
- 3
Direct or relayed, and how long a connection takes.
Questions
Is Paperboat a VPN?
No. It does not give your devices a network interface, route subnets or act as an exit node. It forwards TCP ports between machines that run pb. If you need a full private network, including phones, Tailscale or NetBird is the better tool.
Does it change my DNS, hosts file or VPN settings?
No. The ppr.boats names resolve to a loopback address on your own computer, where pb listens. Nothing on the network changes, so it does not fight with a VPN you already run.
Which ports can I reach?
On your own machines, the ports your user is listening on from 1024 upward are found automatically. Port 80, and ports of other users or of Docker, need to be allowed explicitly. Ports below 1024 are reached by address, not by name.
Can teammates reach ports on my machine?
Only if the team has private access turned on, which is off by default, and a rule grants them that machine and those ports. Removing the rule cuts connections that are open.
Does UDP work?
No. Private access carries TCP, which covers HTTP, databases and most developer tools.
How do I reach a service behind a reverse proxy such as Coolify?
Set the app's domain to a name like jellyfin.homelab.ppr.boats. pb sends the request to the proxy on port 80 with that host name, and the proxy picks the app. pb config local-access proxy set changes the port.
Related
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex