Remote Access Without Port Forwarding (2024)

VPN client software is installed on the SecuritySpy Mac and on all devices you want to use for remote access. All devices on the VPN can communicate freely with each other, via their VPN IP addresses, just as though they were on the same physical local network. Devices are not accessible outside the VPN.

1. On the Mac running SecuritySpy, sign into Tailscale using a Google, Microsoft or GitHub account, and follow the instructions to download and install their app from the Mac App Store.

2. Open the app, agree to the required permissions that you will be asked for, and log in.

3. During the setup process you will be asked if Tailscale should start automatically – assuming you want SecuritySpy to be accessible at all times, select this option.

4. You should see a Tailscale menu in the top-right of your Mac’s menu bar – it looks like this:This menu shows the VPN IP address that has been assigned to your Mac, for example:

5. On any device from which you wish to access SecuritySpy, install Tailscale, log in using the same account, and you will be able to access SecuritySpy using the Mac’s VPN IP address as shown in menu above, along with the HTTP port that SecuritySpy is using. In this example, the URL for access would be http://100.125.35.86:8000

1. Head to ZeroTier and sign up for an account, or log in with an existing Google, GitHub or Microsoft account.

2. Click the Create A Network button, and a VPN network will be created for you – make a note of the Network ID that will be displayed. You can choose a custom name if you like.

3. On the SecuritySpy Mac, and on all other devices you want to connect to your VPN, download and open the ZeroTier app. You will see its menu in the top-right of your Mac’s menu bar – it looks like this:

This menu has the following options:

Select the Join New Network option, and enter the Network ID that you obtained from step 2. You should then see the network displayed in the menu (called SecuritySpy in the above example). Repeat this on all devices.

4. In the Networks section of the ZeroTier web portal, click on the network to edit it, and scroll down to the Members area. You should see a list of devices that you have connected, but they will not yet be authorised. Enable the checkboxes next to each device to authorise them:

5. You will see here that each device has been assigned an IP address on the VPN. This address is also displayed in the ZeroTier menu under Network > Managed Addresses. This is the address that you will use in clients in order to access your SecuritySpy server. In the above example, the SecuritySpy Mac has the VPN IP address 172.29.211.179, so other VPN clients can access SecuritySpy at the URL http://172.29.211.179:8000

Client software on the SecuritySpy Mac makes an outgoing connection to the proxy server. The proxy server accepts incoming connections from any device on the Internet, which are relayed to the SecuritySpy Mac.

1. Setup is as easy as opening a Terminal window and executing the following two commands in turn – the first downloads the pagekite script, and the second starts the tunnel (choose a name that is meaningful to you, rather than yourname):

curl -O https://pagekite.net/pk/pagekite.py
python3 pagekite.py 8000 yourname.pagekite.me

When you start the tunnel for the first time, follow the account creation and setup prompts – this only has to be done once. Your SecuritySpy server will then be accessible at the secure URL https://yourname.pagekite.me

2. To have the tunnel start automatically when the Mac boots up:

• Open TextEdit and create a new document
• Under the Format menu, select the Make Plain Text option
• Copy into the document the second command from above (the one that starts python3…)
• Save this to your Documents folder using the file name pagekite.command
• Open a Terminal window and execute the following command to make this file executable:

chmod +x ~/Documents/pagekite.command

• Go to System Preferences > Users & Groups > Login Items, click the padlock item to unlock the settings, and drag the pagekite.command file into the list of login items.

3. Note that the Terminal window that is running pagekite must be left open for the tunnel to be operational.

1. Head to Packetriot and create an account using an email address and password (don’t login via an existing Google account, as this makes configuration a bit more difficult).

2. From the Download pages, under the Manual Downloads section, download the macOS package. This downloads a folder that contains two important files: a pktriot executable, and a pktriot.plist file that can be used to start Packetriot automatically at system reboot.

3. Right-click on the pktriot executable, select the Open option, and click the Open button. This authorises the executable to be allowed to run, and only needs to be done once.

3. In a new Terminal window, enter the following commands in turn, each followed by the return key:

cd ~/Downloads/pktriot-0.14.1 (or whatever the path is to the pktriot folder you just downloaded – your version number may be different)

mv pktriot.plist /Library/LaunchAgents (do this only if you want Packetriot to start automatically upon Mac reboot)

mv pktriot /usr/local/bin (this moves the pktriot executable to the right place)

cd /usr/local/bin (this sets the directory in Terminal in preparation for running the below commands)

sudo mkdir -m 777 /etc/pktriot (this creates a folder for the Packetriot settings file – you will be asked for your macOS user password)

./pktriot configure

This takes you through some configuration options, including login details, region, and configuration file location, for which you should choose the path starting /etc (option 1).

4. For paid accounts, under Subdomains in the control panel, you can reserve and assign a subdomain to your tunnel – for example yourname.pktriot.net. Otherwise, for free accounts, check the Tunnels page to see what domain has been automatically assigned to your tunnel.

5. The following commands configures and starts the tunnel on your Mac (make sure to substitute in the correct domain for your tunnel, which is your custom subdomain if you have reserved one):

./pktriot tunnel http add --domain yourname.pktriot.net --destination localhost --http 8000 --letsencrypt

./pktriot start

You should see some output in the Terminal that indicates that the tunnel has started, like this:

This indicates that your SecuritySpy server is now available to the Internet at the URL https://yourname.pktriot.net

6. Since you started the tunnel here manually, it will only persist while this Terminal window is open. If you copied the pktriot.plist file to the /Library/LaunchAgents folder as described above, simply reboot your Mac and the tunnel will start automatically without requiring to be run in a Terminal window.

7. Other useful commands that will help when changing tunnel names or debugging are as follows:

./pktriot info (shows information about the current configuration)

./pktriot check (checks for setup problems and prints and short report)

./pktriot tunnel http rm --domain yourname.pktriot.net (removes a tunnel)

1. Register a domain name of your choosing via any registrar (we can recommend namecheap.com in the US and names.co.uk in the UK).

2. Sign up for a Cloudflare account – when asked, choose the free option.

3. Follow Cloudflare’s instructions to add your domain to your Cloudflare account. By default, Cloudflare will copy the domain’s existing DNS configuration, so make sure to remove any records that you don’t need, as these may conflict with the tunnel you are about to create.

This also involves setting the nameservers (DNS servers) on your domain to Cloudflare’s servers, which is done via the control panel provided by your domain name registrar. You may have to wait 24 hours after this step for the new nameserver setting to take effect on your domain.

4. Open the Cloudflare Zero Trust Dashboard. In the menu on the left, select Access > Tunnels, and create and name a new tunnel. Once created, you will see a section called Install and run a connector, which contains some commands that you will need to copy and paste into a Terminal window on your Mac.

Installation will take a few minutes, during which time you will be asked for your Mac password in the Terminal window and in some windows that pop up during the install process. Once installed, the connector should show up at the bottom of the page in the web browser. Here’s what this window should look like if everything went well:

5. Click the Next button, and you will then be asked for some options, as follows:

• Domain – select the domain that you added to your Cloudflare account in the step above.
• Subdomain – you can choose any subdomain you like as the endpoint of the tunnel (e.g. cameras.example.com), of you can leave this blank to have the domain itself point to SecuritySpy (e.g. example.com). In either case, Cloudflare will automatically add the relevant DNS entries to your domain, but it can only do so if there aren’t any existing entries that conflict – if you get a warning here, edit the DNS configuration for your domain in Cloudflare to remove conflicting entries.
• Path – leave blank
• Type – HTTP
• URL – localhost:8000

6. Your SecuritySpy system should now be accessible via the address you set up in the above panel, which in this example is https://cameras.bensoftware.com