Reach your home lab from anywhere
No port forwarding, no dynamic DNS. Install Paperboat on the server and your laptop, and it is one name away.
$ pb ssh homelab# browser: https://jellyfin.homelab.ppr.boats- 1
From a café, a hotel, your phone's hotspot. No port forwarded on the router at home.
- 2
A service on the home server, by name, with HTTPS your browser trusts. Only your machines can open it.
Common home lab tasks
Each of these is one line, and none of them changes your router, your DNS or your firewall.
| You want to | You type | Worth knowing |
|---|---|---|
| SSH in from outside | pb ssh homelab | Works behind NAT and carrier-grade NAT. Your router's admin page stays closed. |
| Open a web UI | https://<port>.homelab.ppr.boats | Grafana, Home Assistant, the router's own page. Private to your machines. |
| Reach apps behind a reverse proxy | https://<app>.homelab.ppr.boats | Works with Coolify's default proxy and others. No public certificates to manage. |
| Use a database or other TCP service | pb access machine homelab --port 5432 | The port appears on your laptop for as long as the command runs. |
| Copy a backup off the box | pb rsync -a homelab:/srv/backups/ ./backups/ | Plain rsync, through the same private path. |
| Leave a job running | pb connect homelab | A terminal that is still there next weekend. |
Publish one service
For the one thing that should be public, a tunnel gives it a permanent HTTPS address and keeps the machine hidden.
It comes back by itself after a power cut, and a new home IP changes nothing.
$ pb tunnel create blog --port 8080 --wait
Created tunnel blog (tunnel_7c2m9xqa)
https://amber-quiet-harbor-5120.pprbt.app -> http://127.0.0.1:8080
Status: ready$ pb domain add home.example.com
$ pb tunnel route list blog
$ pb tunnel domain add blog blog.home.example.com --route <route>- 1
The one thing you do want public.
- 2
On your own domain, on the Free plan too: add the domain, find the tunnel's route, point a name at it.
What it does not do
Paperboat is not a network. It will not put your TV, your phone or a whole subnet behind one address, act as an exit node, or carry UDP for a game server.
It connects the computers you install it on, port by port. If you want every device at home on one private network, Tailscale, ZeroTier or NetBird is the right tool. Paperboat leaves DNS, routes and VPN settings alone, so it can run on the same machines.
Questions
Does this work behind CGNAT, without a public IP?
Yes. Both machines connect outward, so nothing needs to be reachable from the internet. If the two networks will not allow a direct connection, traffic goes through a relay, still encrypted end to end.
Is the free plan enough for a home lab?
Usually. Free has every feature and 100 machines. The 5 GB a month applies only to relayed traffic and to public tunnels; direct traffic between your machines is unlimited. If you publish something busy, Pro is $8 a month for 100 GB, or you can run the relay and tunnel server on a small VPS and count nothing.
Can I reach my home lab from my phone?
A terminal, yes, through the web console in the phone's browser. Private names and ports, no: those need pb on the device, and there is no mobile app. If phone access to services matters most to you, Tailscale is the better fit.
Can my family use a service I host without installing anything?
Publish it with a tunnel and they open a normal HTTPS link. That link is public, so put a login in the app itself.
Is it safe to stream media through it?
It works, but mind the path. Between your own machines on a direct connection it costs nothing. Through a public tunnel, every byte is edge bandwidth, and video adds up fast.
Which machines can I install it on?
Linux and Windows on x86-64 and ARM64, and macOS on Apple Silicon.
Related
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex