Remote access without port forwarding
Port forwarding asks you to publish a hole in someone's router and hope nobody else finds it. There is a calmer way: let the device make the connection, and reach it by name.
What a forwarded port actually costs
- The service is exposed to the whole internet, and scanners find it within hours.
- It needs a static address or dynamic DNS, and both drift.
- Someone has to own a router change on a network you may not control.
- It cannot work at all where the address is shared, which is most mobile and many home connections.
Three steps, no router change
Give the device an identity
Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
Let the agent dial out
Download a preconfigured agent or mint an enrollment token, run one installer, and the device connects itself.
Use the hostname
Many devices share one address, demultiplexed by hostname — no port-per-device sprawl.
The router keeps every inbound port closed. The only connection is the one the device opened, and it is authenticated in both directions.
What people ask before they try it
Does this work on a network I do not administer?
That is the normal case. Most outbound HTTPS is already allowed, so the agent needs no new rule. Nothing has to be opened towards the device.
Is this the same as dynamic DNS?
No. Dynamic DNS only keeps a name pointing at a changing address, and still needs an inbound path. Here the device holds the connection open, so the address it happens to have does not matter.
What about a device sharing one address with others?
It still works. See remote access behind CGNAT for that case in detail.
Can I reach more than one device this way?
One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route.
Worked examples
The same model, written up for the three things people ask about most: PLCs behind firewalls, a Raspberry Pi at home, and an ESP32 project. Weighing it against what you run now? See Tollan vs a VPN.
Close the port, keep the access
Free tier, no card required.