Run your own Connect relay
Set up a LibrePortal Connect relay on a small public server, make join codes for your home servers, and what the relay can and can't see.
On this page
LibrePortal Connect lets a server at home be reached from anywhere, even when its router can't open a port. It works through a relay: a small program on a machine the internet can reach. This page is for the person who runs that machine, which might be you, or you for a few friends.
What a relay does#
Your home server connects out to the relay and keeps that connection open. When your phone or laptop connects to the relay with the normal WireGuard app, the relay passes the traffic down that connection to your server, and the answers back. Nothing on your home router changes.
Every home server shares one UDP port on the relay. The relay works out which server a device wants from the start of the WireGuard conversation, so it needs no accounts and no per-server setup beyond a join code.
What the relay can and can't see#
The relay carries WireGuard traffic that is already encrypted on the device and decrypted again only on your server. It never holds a key. So it can't read your pages, passwords or files, and it can't change them.
It does see that a server and its devices are talking, and roughly how much. It chooses not to remember that. It keeps no traffic log and writes down no one's IP address. What it does save is short: for each joined server, an id, two public keys, a port, the note you gave its code and the date it joined. It also keeps codes that haven't been used yet, and for 30 days which server each used code became. Live connections and speed limits are held in memory only.
What you need#
- A machine with a public IP address that runs LibrePortal. A cheap VPS is plenty.
- One UDP port open to the internet: 51900. The app opens it for you.
- A name for it is optional. Without one, servers use the relay's public IP.
Installing it#
- Install LibrePortal Connect from the App Center. Find it under the LibrePortal apps, or see its app page. There can be only one relay per server, because it needs that one fixed port.
- Set the Public Address, if you have a name. On the app's Config tab, Public Address is the name servers use, such as
connect.example.org. Point that name's DNS record at the machine first. Leave it empty to use the public IP. - Check the limits. On the same tab, Most Servers (100), Devices Per Server (64) and Speed Limit (Mbit/s) per server, each way (25; 0 means no limit). The speed limit stops one busy household swamping everyone else.
- Check it's running. On the Tools tab press Relay Status. It shows whether the relay is up and how many servers and devices are using it.
The management side of the relay stays private to the machine. Only the UDP port is open to the world.
Making a join code#
Each home server needs a one-time enrolment code, which is what lets it in.
On the app's Tools tab, run New Enrolment Code. Add a note saying whose server it is, such as "Sam's home server", and say how long it stays valid. It's 24 hours unless you choose otherwise. The code already carries this relay's address, so the person joining only pastes it.
Send the code privately. Anyone who has it before it's used can join a server. A code works once and for one server. Anyone guessing codes is slowed to five tries a minute from one address.
The other tools:
| Tool | What it does |
|---|---|
| Unused Codes and Cancel Code | See the codes not yet used, and make one stop working. |
| List Servers | Every server that has joined, whether it's connected now, and how many devices use it. |
| Pause Server and Resume Server | Keep a server joined but carry none of its traffic for a while, then carry it again. |
| Remove Server | Cut a server off at once. It needs a new code to come back. |
Joining a server with a code#
On the home server, which also runs LibrePortal, open Admin → Connect and follow the page. In short:
- Turn on the LibrePortal VPN first, because Connect carries it.
- Paste the code into Join a Connect server and press Join.
- Add your devices on the VPN page. Their configs now point at the relay. Devices added before you joined need Regenerate.
LibrePortal Connect has the whole walk-through, including what Leave and Forget this server do.
Advanced Do this from the command line
A server without LibrePortal can use a relay too, if it has WireGuard. It runs the small connect-agent program, which enrols with the code and then keeps the link open. Set each device's Endpoint to the relay's address and port, and its MTU to 1280, here and on the server's WireGuard. The relay adds a few bytes, and its own network may be under 1500. The details are in the LibrePortal Connect repository.
Without LibrePortal on the relay machine either, the relay also runs as a plain Docker container or binary. The same page covers it.
New to the command line? How to run LibrePortal commands →
Keeping it healthy#
- Backups. The relay's list of joined servers is part of LibrePortal's backups, so a restored relay doesn't make every server join again.
- Updates. The app updates only when you press Update. Servers using the relay notice a restart as a pause of a few seconds.
- One relay, many servers. It stores almost nothing and passes only encrypted traffic, so one small VPS can serve your own servers and a few friends'.
- A server that was rebuilt has new VPN keys, so it joins with a new code. Remove the old entry with Remove Server.
