Documentation

Reach your Raspberry Pi from anywhere

A Raspberry Pi rarely lives within arm's reach: it sits in a cupboard, at the bottom of the garden, at a relative's house, sometimes behind a 4G dongle. And the day you need to SSH into it from outside, the trouble starts — port forwarding, dynamic IP, CGNAT. With VIGIL-MESH, the Pi joins your private network through a single outbound connection: it becomes reachable by name, from anywhere, with nothing to open on the router — including behind a mobile connection. And for troubleshooting, an SSH terminal opens right in the browser, from the console.

What people do with a remote Raspberry Pi

The Raspberry Pi is the machine for projects that run on their own, far from your desk — exactly the ones where reliable remote access changes everything.

Home automation

A Pi that runs the house — Home Assistant listens on port 8123 by default — can be checked from outside through the machine's name, without ever exposing the interface to the Internet.

Measurement and sensors

Weather station, temperature probe, energy meter: you read the data and tweak the scripts over SSH, without travelling to the site.

Camera

A Pi with a camera watches over a room or a garden shed. The stream stays private: only a member of the network, allowed by the ACLs, can reach it.

Personal server

File sharing, ad blocking, a small test site: the Pi serves the whole household, and you administer it from wherever you are.

The Pi at a relative's house

The great classic: a Pi installed at a relative's place, to be fixed without walking anyone through router settings over the phone. Once it is a member of the mesh, you reach it as if it sat on your desk.

The classic methods and their limits

The traditional way to reach a Pi outside the local network is to open the house from the inside: forward a router port to port 22 on the Pi, then compensate for the side effects. Every step adds its own fragility.

Port forwarding

Opening a port to SSH means exposing a service to the whole Internet: publicly reachable SSH ports are scanned around the clock by bots trying passwords. The Pi becomes a target before it becomes a tool.

The dynamic IP address

The router's public address changes over time. You then need a dynamic DNS service and an update client on the Pi — one more moving part, which breaks your access the moment it misbehaves.

4G/5G and CGNAT

On a mobile connection, the public address is shared between many subscribers (CGNAT): there is no port to open, because the NAT belongs to the carrier. A Pi behind a 4G dongle is simply unreachable through port forwarding.

The mesh approach: the Pi comes to you, through an outbound connection

VIGIL-MESH turns the problem around: instead of making the Pi reachable from the Internet, the Pi itself joins your private network through an outbound connection — a single flow on 443 UDP, the same port as the modern web. Nothing to open on the router, nothing to configure at the relative's house, nothing to ask the mobile carrier.

Reachable by name — MagicDNS gives the Pi a short, stable name, resolved locally by every member of the network: you connect to the name, never again to an address that changes.
A stable address — the Pi keeps the same address on the mesh (the 100.64.0.0/10 space), whatever physical network it sits on.
Connected immediately, direct as soon as possible — traffic first goes through a blind relay, then migrates without interruption to the direct path once NAT traversal succeeds.
Encrypted end to end — sessions are QUIC/TLS 1.3 connections between the nodes; the relay holds no keys and never sees the content.
Under ACL control — nothing is allowed by default: you decide who, within the network, may reach the Pi and on which services.

SSH from the browser: troubleshoot with nothing to install

This is the argument that changes a troubleshooter's life: the Administration tab of the console opens an SSH terminal on the Pi, right in the browser. The machine you are working from — a borrowed computer, a relative's PC — needs no client at all: the browser itself becomes an ephemeral node of the mesh, and a classic SSH client runs inside the page.

Zero client on the troubleshooting machine: a browser and your account are enough; the browser node disappears with the tab.
Your credentials never transit through our servers: they are consumed by the SSH client running in your browser and sent to the Pi only.
On the Pi, a standard sshd is enough: the SSH server shipped by the distribution, reachable only through its overlay address, under ACL control.

Setting it up, step by step

1
Create an account and a workspaceThe workspace gathers your machines and networks. It is free for personal use.
2
Install the client on the PiInstall the arm64 .deb package of the Linux client, then enable the systemd service. Also install the client on the machines you will access the Pi from — unless you go through the console in the browser, which requires nothing.
3
Enroll the PiFrom the console, Networks page → Machines → “Add a machine”, generate a single-use key. For a headless Pi, a pre-authorized key enrolls the machine without any interaction.
4
VerifyThe Pi receives its stable address and its MagicDNS name; a ping to its mesh address confirms the path is open.
5
Connect by nameOpen an SSH session to the Pi's name from any member of the network, or from the terminal in the console's Administration tab — as if the Pi were on your local network.

Frequently asked questions

How do I install the client on a Raspberry Pi with no screen or keyboard (headless)?

SSH into the Pi from the local network, install the arm64 .deb package and enable the systemd service, then enroll the machine with a pre-authorized key: it joins the workspace without any interaction, including from a provisioning script.

What happens when the router's IP address changes?

Nothing to do. The Pi maintains an outbound connection and keeps its stable address on the mesh along with its MagicDNS name: you always connect to the same name, with no dynamic DNS service or update client to maintain.

Does it work if the Pi is behind a 4G dongle or CGNAT?

Yes. The client only makes outbound connections on 443 UDP, which CGNAT lets through. The Pi connects immediately through the relay, then goes direct if NAT traversal succeeds; if both ends sit behind symmetric CGNAT, traffic stays relayed — encrypted end to end — and the connection works.

Is the client heavy on a Raspberry Pi?

The client runs in the background as a systemd service and maintains a single outbound connection; it listens on no inbound port. It is designed to stay up permanently on a small machine — we do not publish consumption figures, and we would rather not invent any.

Can I connect several Raspberry Pis?

Yes. Each Pi enrolls as a machine of the network, with its own stable address and its own MagicDNS name, and the ACLs decide who may reach what. Personal use is free, with unlimited direct traffic and a quota on relayed traffic.