ENPLDEPT
Flash
All docs
Remote access

Remote access to your home network without VPN or port forwarding — SSH, Home Assistant, LAN panels

The node keeps one outgoing connection open. Your phone reaches your home network through it — SSH, Home Assistant, router pages — from anywhere, even behind carrier-grade NAT, without exposing anything to the internet.

ssh · sensmos-6cecfc · via node

What you get

  • SSH terminal to any machine in your LAN, from the app. The SSH session is encrypted end-to-end inside the app — the node is a dumb pipe and never sees your keystrokes.
  • Home Assistant panel — your HA dashboard through the tunnel, tiles you can edit, without Nabu Casa and without opening HA to the internet. See Home Assistant.
  • LAN pages — router, printer, Pi-hole, NAS: any lightweight HTTP page at a private address.

In the network today, HA panels are the most used tunnel target, followed by LAN pages, then SSH.

How it works

  1. The node holds an outgoing WebSocket to the backend (it needs one anyway to be part of the network).
  2. Your phone asks the backend to open a tunnel to ip:port on the node's LAN. The request carries a proof computed from a pairing key that only your phone and the node know.
  3. The node verifies the proof locally, connects to the LAN target and relays bytes. The backend forwards frames; it cannot read an SSH session and cannot open a tunnel on its own.

Because the node initiates the connection, there is no port forwarding, no public IP, no dynamic DNS — and it works on LTE routers and behind CGNAT.

Switch it on

  1. In the app, open the node → Settings → Remote access while your phone is on the same Wi-Fi as the node.
  2. Tap Pair. The app writes a secret key onto the node. This is the only step that must happen at home.
  3. Add the integrations you want on the node card: Terminal, HA panel, LAN panel.

Removing the pairing key on the node (Settings → Remote access → disable) closes every live session and makes the tunnel unopenable until you pair again.

Limits, honestly

  • Traffic is chunked over the WebSocket — fine for terminals and dashboards, not for streaming or large downloads.
  • Heavy web apps that need WebSockets of their own (some UniFi, Grafana live views) may not work through the LAN panel proxy; the HA panel has its own path and works.
  • Private addresses only. This is a hard rule in the firmware, not a setting.

Price

Tunnel (SSH / HA panel / LAN pages)0.5 GALU per day of use — first tunnel of the day is charged, the rest of the day is free
Idle days0
Empty balanceNothing is blocked. You will simply see the day's fee in the wallet as an expense.

Fees flow back into the network's reward pool — see Wallet & fees.

Questions, straight answers

Do I need a public IP or to open ports on my router?

No. The node makes an outgoing WebSocket connection to the Sensmos backend; the tunnel rides on that. It works behind CGNAT, double NAT and mobile LTE routers.

Is this a VPN?

No, and it does not try to be. It is an admin channel for terminals and dashboards — SSH and HTTP pages. It is not built for video streams or bulk transfers.

Can Sensmos (the server) get into my LAN?

No. Opening a tunnel requires a key that only your phone writes onto the node, over your own Wi-Fi. The server never has it and cannot fabricate a request.

What can the tunnel reach?

Only private addresses (RFC1918, CGNAT range, loopback). The firmware refuses anything that would leave your LAN.

What does it cost?

A flat 0.5 GALU on a day you use it — one fee covers every tunnel that day (SSH, HA panel, LAN pages). Nothing is blocked if your balance is empty.

Last updated: 2026-09-03