Quick Start

Get started in a few minutes — here's the universal first step, then pick what you want to do.

Add a device

Connect your devices privately

Expose a local service to the internet

Bridge a private network into the mesh

Route internet traffic through another device

Back up your phone to your own storage

How It Works

HostAnywhere has four features that work independently or together:

• Public Services — expose any local port to the internet via a *.hostanywhere.io subdomain. No router config, no static IP needed.
• Private Mesh Network — all your devices (and your team's devices) get a private IP and can reach each other directly, from anywhere, as if they were on the same LAN.
• Internet Gateway — route a laptop's outbound internet traffic through your home or office connection, like a personal VPN you fully own.
• Storage Server & Backups — back up your phones (Photos, Contacts, Calendars, more) to one of your own devices, end-to-end encrypted before upload.

The agent handles all of them. Install it once on a device and it manages public services, the private mesh network connection, and (optionally) a storage server for backups.

Add a Device

Install the agent on any device to connect it to your private mesh network and expose local services.

Windows

macOS

Linux

curl -fsSL https://hostanywhere.io/install.sh | sh

hostanywhere login

iOS

Android

Expose a Service

Expose a Service creates a public URL for something running on your local machine — a dev server, a self-hosted app, a webhook receiver, a media server — without opening ports on your router or having a public IP. The agent on your machine opens an outbound connection to the HostAnywhere relay; visitors hit the relay over HTTPS at your chosen subdomain (e.g. https://myapp.hostanywhere.io), and the relay forwards the request through that tunnel to your local port.

Typical use cases:

• Sharing a dev preview with a teammate or client without deploying anywhere.
• Receiving webhooks during development.
• Sharing a self-hosted app with family or friends without setting up a VPN for them.
• Letting a phone reach a local app on a desktop when off the same Wi-Fi.
• Quick demos that need a real public URL.

Why it works:

• The agent only makes outbound connections, so there's nothing to configure on your router — works behind NAT and CGNAT.
• HTTPS is built in. Every subdomain lands on *.hostanywhere.io with a valid TLS certificate, no configuration needed.
• Multiple services per machine — one tunnel per service.

How to expose a service

From the dashboard, click + Expose a Service and fill in:

• Subdomain — the public URL prefix, e.g. myapp → https://myapp.hostanywhere.io
• Local address — where the traffic should go on your machine, e.g. localhost:3000

Private Network

Every device running the agent is assigned a private IP address and can reach any other device on your network directly — no VPN setup, no configuration required.

• Devices get a stable private IP in the 100.64.x.x range.
• Any port on any device is accessible from other devices on the same network.
• Works even if devices are behind different routers, carriers, or on different continents.
• When you invite teammates, their devices automatically join the same private network.

Finding your private IP

Your device's private IP appears in the dashboard under Devices — click a device card to see it. It's also shown in the Windows tray or macOS menu bar icon.

VPN Gateway

A VPN Gateway lets one device act as a bridge between your mesh and a private network the mesh can't reach directly — your home LAN, an office network, or a datacenter subnet. Any mesh peer can then reach resources on those networks (printers, NAS, servers, cameras, management interfaces) without running the HostAnywhere agent on each one.

This is useful when:

• You have legacy devices (printers, IoT, IPMI/iDRAC consoles) that can't run an agent.
• You want one device to tunnel your mesh into a corporate LAN.
• You're bridging a datacenter subnet or VPC range into the mesh.

How it works

Designate any device as a VPN Gateway and tell it which private CIDRs it can route to (e.g. 192.168.1.0/24, up to 10 subnets per gateway). Other mesh peers learn those routes automatically and forward traffic for those ranges through the gateway. Peer-to-peer traffic between mesh devices continues to flow directly as before.

Enable a VPN Gateway

Other mesh peers pick up the new routes within seconds and can start reaching addresses in those ranges.

Multiple gateways

You can designate more than one device as a VPN Gateway — useful for bridging your mesh into multiple private networks (home, office, datacenter) at once. Each gateway advertises its own subnet list independently.

Internet Gateway

An Internet Gateway routes a device's entire outbound internet traffic (0.0.0.0/0) through another mesh peer — like a personal VPN that terminates on hardware you fully own. Where VPN Gateway gives mesh peers access to a private LAN, Internet Gateway routes a peer's web/app traffic out through another peer.

This is useful when:

• You're on hotel or coffee-shop Wi-Fi and want every packet to leave from your home connection instead.
• A region- or geo-blocked service should see you as connecting from a device in another region.
• You want an end-to-end-encrypted hop for all internet traffic from a laptop you don't fully trust the local network of.

How it works

Designate up to three devices on your mesh as gateways, ranked by priority: Primary, Secondary, and Tertiary. The agent on the gateway side enables IP forwarding and installs a NAT rule so mesh traffic exits through the gateway's WAN interface. On the client side, the agent installs a default route pointing at the chosen gateway. Failover is automatic — if the Primary goes offline, peers fall back to Secondary within seconds, then Tertiary if needed. Peer-to-peer traffic between mesh devices continues to flow directly as before.

Enable an Internet Gateway

Multiple gateways & failover

The 3-slot priority system gives you redundancy without per-peer routing choices. The mesh always uses the highest-priority gateway that's currently online. A common pattern: Primary = your always-on home server, Secondary = your work device, Tertiary = a cloud VPS. If your home internet drops, traffic falls through automatically.

Storage Server, Backups & Library

HostAnywhere lets you back up your phones to your own hardware. Three pieces:

• Storage Server — a small encrypted-blob store the desktop agent runs on a Mac, Linux, or Windows device you own.
• Backups — the iOS and Android apps push selected categories (Photos, Contacts, Calendars, etc.) to your storage server.
• Library — a tab in the mobile app to browse and restore everything you've backed up, from any of your signed-in devices.

Every file is encrypted on your phone before it leaves the device. HostAnywhere's servers never hold your data.

Storage Server

A storage server runs as a background process inside the desktop agent. It listens on TCP port 36129 inside your private mesh, serves a self-signed TLS certificate (its SHA-256 fingerprint is pinned by the phones), and accepts encrypted blob uploads from your phones.

Enable a storage server

Where backups are stored on disk

You can override the path under Advanced. Useful when you want backups on a specific external drive, a separate NAS volume, or a non-default partition.

Multiple storage servers

You can run storage servers on more than one device. Phones automatically pick the one with the lowest latency on each sync (mesh first, internet fallback). Each server keeps an independent copy of the data uploaded to it — handy if you want a primary at home plus a backup on a different drive or in a different location.

Backups (iOS & Android)

The mobile app's Backups tab is where each phone picks what to back up. Categories are off by default; you opt in per category, and each toggle prompts for the OS permission it needs the first time you enable it.

What can be backed up

Enable a backup category

End-to-end encryption

Every file is encrypted on the phone before it's uploaded. AES-256-GCM with convergent encryption: the data-encryption key for a given file is derived from its own SHA-256 hash, then wrapped with a master key that exists only on your phones. Master keys are generated locally on first sync — escrowed via iCloud Keychain on iOS, stored in Android Keystore-backed encrypted preferences on Android. HostAnywhere has no copy and can't decrypt anything.

On iOS, encryption is always on (no toggle). On Android, encryption defaults to on with a Settings toggle for parity with iOS conventions.

Cellular vs Wi-Fi

By default backups only run on Wi-Fi to avoid surprise data usage. A "Back up over cellular" toggle in Settings flips that.

Library

The Library tab in the mobile app lists everything you've backed up, grouped by category, across all your storage servers. Each item shows its category, size, and the date it was backed up.

Restore from another device

Plan Limits

Limits apply to the whole network. The owner's plan determines the limits — members don't need their own paid plan.

See the Pricing page for annual pricing and the Enterprise contact form.

Inviting Members

Open the Users section in the dashboard and click Invite User. You can invite someone two ways:

• Copy link — share a one-time invite link via any channel (Slack, email, etc.).
• Send email — enter their email address and HostAnywhere sends the invite for you.

Invite links are single-use and expire after 7 days. When the recipient opens the link and signs in, they are automatically added to your network.

Roles

Members can see all devices on the network in the dashboard but can only edit or delete their own. Other members' devices are shown as read-only.

Removing Members

In the Users section, click the remove button next to any member. Only the owner can do this.

When a member is removed, their devices immediately disappear from the shared device list and they lose access to the private network. Their own account and any public services they created are not affected.

FAQ

Do I need to open any ports on my router?

No. The agent connects outbound — no router configuration, port forwarding, or firewall changes needed.

Can I expose multiple services from one machine?

Yes. A single agent handles every service you add to that device — you don't need to run multiple agents. Create each service in the dashboard (one subdomain → one local port); the agent picks them up on its next config poll (within ~10 s) and runs all of them concurrently.

Can I be in multiple networks?

Not currently. Each account belongs to one network at a time.

My invited user joined but I don't see their devices.

They need to install the agent and connect at least one device. Once they do, it appears in all team members' dashboards automatically.

Does the agent need admin / root access?

Admin access is needed when first setting up the private network interface — the Windows installer handles this automatically. For the macOS .pkg, the installer takes care of it. On Linux, the agent needs sudo or CAP_NET_ADMIN to create the network interface. Regular tunnel traffic does not need elevated privileges.

Is traffic secure?

Yes. Public services use HTTPS end-to-end. Private mesh traffic is encrypted between devices — the relay never sees the content.

What happens when I hit a plan limit?

The action that would exceed the limit (adding a device, inviting a user, creating a public service) is blocked with a clear message. Nothing existing is removed. Upgrade your plan to continue.

How is my backup encrypted?

Each file is encrypted on your phone before it's uploaded, using AES-256-GCM with convergent encryption. The data-encryption key is derived from the file's own SHA-256 hash, then wrapped with a master key that lives only on your phones (escrowed via iCloud Keychain on iOS, Android Keystore on Android). HostAnywhere has no copy of the master key and can't decrypt anything. See Storage Server & Backups for more.

Can I run multiple storage servers?

Yes. Run the storage server on as many devices as you like — phones automatically pick the one with the lowest latency on each sync. The storage servers also replicate to each other automatically in the background: a blob uploaded to one server propagates to the others within a few minutes via the mesh. You get geographic + drive redundancy for free — a primary at home, a second copy on a NAS, a third on a friend's machine — all stay in sync without manual intervention.

Can HostAnywhere see my internet traffic when I use Internet Gateway?

No. All traffic flows agent-to-agent over WireGuard, encrypted end-to-end. HostAnywhere's servers see only mesh metadata — which peers are online, peer counts, and so on — never the contents of the tunnels themselves.

What if my storage server is offline when a phone tries to back up?

The phone retries periodically. Nothing is ever uploaded to HostAnywhere as a fallback — your data only goes to storage servers you own. When the server comes back online, the queued items sync automatically. If you have multiple storage servers, the phone tries the others first before queuing.