Reaching a home dev machine, no port forwarding

My main dev machine is a desktop at home. Fast CPU, all my projects cloned, all my toolchains installed. The problem was that none of that helped me once I left the house.

I tried the standard fixes over the years and disliked all of them for different reasons. Port forwarding: my ISP uses carrier-grade NAT, so I don't even have a public IP to forward to. Dynamic DNS: same problem. WireGuard: works, but every device I might connect from needs the config installed, and half the point of remote access is using devices I didn't plan for.

What I run now is an outbound tunnel plus a browser client. The desktop dials out; I connect to the meeting point from wherever I am. Zero router configuration, and it works behind CGNAT because from the network's point of view the desktop is just making a web request.

How outbound-only works

Port forwarding means your router accepts inbound connections and passes them to your machine. Everything between you and your desktop gets a say in whether that works: the router, the ISP, the network you're currently sitting on.

An outbound tunnel reverses the direction. The home machine opens a long-lived connection out to a relay, exactly like a browser opening a connection to a website. When you connect from elsewhere, the relay bridges the two. Nothing ever connects inward to your router, so there's nothing to configure and nothing listening. The design reasoning is in why the tunnel is outbound-only.

The side effect I care about most: it works from restrictive networks. Hotel wifi, captive portals, office guest networks that block everything except ports 80 and 443. All of those pass outbound HTTPS, because nothing would function otherwise, and this rides the same path.

Setup

On the home machine, inside the project you want to work on:

npx codemote-cli start

Needs Node 18+. macOS, Linux and Windows all work. It prints a one-line pairing code.

From anywhere else, open the connect page, paste the code, and you get the workspace: file tree, editor, terminals, git. If Claude Code is installed on the desktop, agent chat too.

Security questions I asked myself before running this

Making a home machine reachable from the internet deserves some suspicion, so here's how I thought it through.

There's no inbound listener. Before this, I briefly ran SSH exposed on a nonstandard port, and the auth log filled with break-in attempts within hours anyway. With an outbound tunnel there is no open port to find; scanning my home IP shows nothing.

Pairing requires the code the CLI prints, and that code only exists on the machine itself. Someone would need to already have access to the machine to get it.

The tunnel is encrypted, and the code never moves to anyone's servers. The browser is a remote control; files stay on the desktop. This matters to me because some of what's on that machine is client work I'm contractually not allowed to put on third-party infrastructure.

I'm not claiming this is bulletproof, nothing is. But compared to the alternatives I actually had (exposed SSH, or a VPN I'd have to maintain), the attack surface is smaller, not larger.

The boring part that actually breaks: sleep

The one thing that took me a few tries to get right has nothing to do with networking. If the machine sleeps, the tunnel drops, obviously. On the desktop I set "prevent sleep when display is off" and that was that. When I ran the host on a MacBook for a while, I used caffeinate and kept it on power; lid-closed behavior depends on settings and I never fully trusted it.

These days the host runs on a mini PC that idles around 10 watts. That's roughly one euro a month in electricity where I live, for a machine that's faster than any cloud instance I'd want to pay for.

When a VPN is still the right answer

If you need to reach a whole network (multiple machines, a NAS, a printer), use Tailscale or WireGuard; that's what they're for. My problem was narrower: one machine, and me somewhere else wanting an IDE on it. For that specific shape, a tunnel plus a browser is less setup, and it works from devices I'd never install a VPN on, like a computer at a client's office.

The experiment costs one command. Beta signup is on the homepage.