Localtonet Now Supports VPN: Build a Private Mesh Network Between Any Devices in Minutes
Tunnels solve one problem: exposing a single service to the outside world. But what if you need two or more machines to talk to each other privately, as if they were sitting on the same LAN, no matter where they physically are? That is a different problem, and until now Localtonet users had to reach for a separate VPN product to solve it. Not anymore. VPN Manager is a new feature built directly into the Localtonet dashboard that lets you create a private mesh network, attach any number of clients using the Tokens you already have, bridge an entire local subnet into that mesh, and lock down exactly who can reach what with granular firewall rules. No separate account, no separate app, no extra installation, and no cost. VPN Manager is completely free to use on every Localtonet account.
Why a Tunnel Alone Was Never Enough
A tunnel is a one-way street with a public sign on it. It is perfect for exposing a web app, a game server, or an SSH port to the internet. It was never designed to let a laptop in one city talk privately to a server in another, or to let a group of machines share a single private network segment regardless of which router, ISP, or CGNAT configuration sits in front of each of them.
Traditional VPN software solves that problem but drags a separate learning curve behind it: key exchange, peer configuration files, static IP assignment, and a firewall layer you have to build yourself with iptables or a third-party tool. Most small teams and solo developers do not want to run a second piece of infrastructure just to let three or four machines see each other.
VPN Manager folds that entire workflow into the same dashboard where you already manage your tunnels.
What VPN Manager Actually Does
VPN Manager creates a private mesh network with its own subnet, for example
10.14.0.0/16. You attach devices to that network as clients, using the
same authentication Tokens you already generate for your Localtonet tunnels. Every
client that joins receives its own Virtual IP inside the mesh subnet, for example
10.11.0.3. From that point on, any client can reach any other client
through its Virtual IP as if they shared a physical switch, regardless of what
network each device is actually sitting behind.
Beyond simple client-to-client connectivity, VPN Manager can bridge an entire local subnet through a single client. If one of your VPN clients sits inside an office or home network, you can expose that whole LAN, printers, NAS devices, internal servers and all, to the rest of the mesh without installing anything on those other devices.
Every connection inside the mesh is governed by firewall rules you define yourself: allow or deny, by protocol, by port, and by target client. Nothing is open by default beyond what you explicitly configure.
192.168.100.0/24, into the mesh
through a single client acting as a gateway. Every device on that LAN becomes
reachable to the rest of the VPN without installing Localtonet on each one.
VPN Manager requires Localtonet Mobile app v10.0 or later and Desktop app v7.7 or later. It also requires administrative privileges on the machine running the Localtonet client, since creating virtual network interfaces is an OS-level operation. Update your app first if you are running an older version.
How to Create Your First VPN: Step-by-Step
Sign in to your Localtonet dashboard
Register a free account at localtonet.com if you don't have one yet, or log in to your existing dashboard.
Open VPN Manager and create a new VPN
Navigate to VPN Manager in the dashboard. Enter a VPN Name, for example
MyVpnServer, and choose a Server Relay Node close to where your
clients are located. Press Create.
Confirm your mesh subnet is active
Once created, your VPN appears in the list with an assigned subnet, for
example 10.18.0.0/16, and a status of Active.
This subnet is what all of your Virtual IPs will be assigned from.
Add clients using existing Tokens
Click Add Client on the VPN row. Select a Token Name that is
already installed and running on the device you want to add. Click
Add. The client appears with a status of Offline until the
Localtonet app on that device connects, at which point it flips to Online
and receives a Virtual IP such as 10.18.0.3.
Optionally bridge a client's local LAN
If a client sits on a local network you want the whole mesh to reach, open
LAN on that client's row and create a new LAN entry with the
local subnet (for example 192.168.100.0/24) and the client's
real gateway IP on that LAN. Every device on that subnet becomes reachable
to the rest of the VPN.
Set your firewall rules
Open Firewall on a client row, click Create Rule, and define the Action, Protocol, target client, and Ports. Save the rule and it takes effect immediately, no restart required.
A client stays Offline in the VPN Manager list until the Localtonet app on that device is running with the Token you selected. If a device shows Offline after you added it, check that the Localtonet app is open and connected on that machine before troubleshooting anything else.
Firewall Rules: How Access Control Actually Works
Every rule you create in VPN Manager is evaluated against three dimensions: the action, the protocol, and the target. Nothing in the mesh is reachable beyond what an explicit Allow rule permits, so it is worth understanding how the pieces combine before you open anything up.
🧱 Action: Allow or Deny
Every rule is either an Allow rule or a Deny rule. Rules are additive, so if you want a mesh where clients cannot see each other by default and you selectively open specific ports, build your rule set from Deny-by-default and add narrow Allow rules on top. If you want an open mesh with specific restrictions, do the opposite: start from a broad Allow and add Deny rules for anything sensitive.
🧱 Protocol Filtering
Rules can apply to All protocols, or be narrowed to TCP, UDP, or ICMP specifically. A rule scoped to ICMP only, for example, lets clients ping each other for connectivity testing without opening any actual service ports.
🧱 Port Specification
Ports can be left open entirely by toggling off the port restriction, or scoped
down three ways: a single port such as 22, a comma-separated list
such as 80, 443, 8080, or a range such as 1000-1500.
This lets you write a rule as narrow as "allow SSH only" or as broad as an entire
ephemeral port range for a specific application.
🧱 Target Scope
A rule can target All Clients in the mesh at once, or a single specific client. A common pattern is a broad rule allowing All Clients to reach each other over common ports, combined with a narrow rule that restricts one sensitive client, such as a database server, to a smaller set of ports or a single peer.
| Goal | Action | Protocol | Target | Ports |
|---|---|---|---|---|
| Let everyone reach a client over SSH | Allow | TCP | Specific client | 22 |
| Open a web app to the whole mesh | Allow | TCP | Specific client | 80, 443 |
| Full trust between all clients (testing) | Allow | All | All Clients | All Ports |
| Allow ping only for connectivity checks | Allow | ICMP | All Clients | N/A |
| Block a legacy service everywhere | Deny | TCP | All Clients | Single port |
LAN Bridging: Reach an Entire Network Through One Client
Not every device you want reachable can run the Localtonet app itself. A network printer, a NAS, or a legacy internal server has no way to install a client. LAN bridging solves this by letting one VPN client act as a gateway into its local network.
Once a client is bridged, you configure a Local Subnet in CIDR notation, for
example 192.168.100.0/24, and the client's real gateway address
on that network, for example 192.168.100.2. Localtonet routes
traffic between the VPN subnet and that bridged LAN automatically. Hosts on
the bridged LAN can optionally receive mapped virtual IPs so they appear as
first-class members of the mesh, addressable the same way as a client running
the app directly.
The practical result: three remote developers on a VPN mesh can all reach a file share, a printer, and an internal admin panel sitting inside an office network, without any of those office devices ever running Localtonet.
A Complete Example, Start to Finish
Here is what the whole workflow looks like assembled into one scenario.
Create the VPN
Create MyVpnServer on the ES-Madrid relay node.
Add two clients
Attach clients using Tokens vpn3 and vpn4.
Bridge one client's LAN
Bridge vpn3's local subnet 192.168.100.0/24.
Open the ports you need
Add a firewall rule allowing TCP 22, 80, and 443 for All Clients.
The result: vpn3 (10.11.0.3) and vpn4
(10.11.0.4) can reach each other and everything on the bridged
192.168.100.0/24 LAN, all through the mesh, all governed by the
rule you defined.
Monitoring and Managing an Active Mesh
The VPN Manager list view is built for day-to-day operations, not just initial setup. Every client row shows a live Online or Offline status so you know instantly whether a device is reachable before you try to connect to it. Clicking a Virtual IP copies it to your clipboard, ready to paste into an SSH command, an RDP client, or a browser address bar.
The Process column on each client row gives one-click access to that client's Firewall rules and LAN bridges, so adjusting access policy or adding a new bridged subnet does not require navigating away from the main VPN view. Rule and bridge changes take effect immediately, without restarting the tunnel or reconnecting clients.
There is no subscription tier, no per-client fee, and no usage charge for VPN Manager. It is available at no cost on every Localtonet account, alongside your account balance shown at the top of the dashboard for your other Localtonet services. Create as many meshes, clients, and firewall rules as you need without worrying about a bill.
What People Actually Build With VPN Manager
Localtonet VPN Manager vs. WireGuard vs. Tailscale vs. OpenVPN
| Feature | Raw WireGuard | OpenVPN | Tailscale | Localtonet VPN Manager |
|---|---|---|---|---|
| Setup time | Manual config files | Manual config, certs | Minutes | Minutes, same dashboard as tunnels |
| Works behind CGNAT | Needs a relay | Needs a public endpoint | ✔ | ✔ relay node handles it |
| Built-in firewall rules per client | ✗ (external tooling) | ✗ (external tooling) | ACLs (config file) | ✔ UI-based, Allow/Deny, port and protocol scoped |
| LAN subnet bridging without extra software | Manual routing setup | Manual routing setup | Subnet routers (config) | ✔ one field in the dashboard |
| Shares auth with existing infrastructure | N/A | N/A | Separate account | ✔ uses existing Localtonet Tokens |
| Same billing/dashboard as tunneling | N/A | N/A | ✗ | ✔ |
| Requires separate account | N/A | N/A | ✔ | ✗ |
| Price | Free (self-managed) | Free (self-managed) | Free tier limited, paid plans for teams | 100% free, included with every account |
The honest trade-off: raw WireGuard gives the most low-level control if you enjoy hand-writing config files, and Tailscale has a larger, more mature standalone ecosystem with device apps for nearly every platform. VPN Manager's advantage is integration: if you are already running Localtonet for tunnels, adding a private mesh network costs you no new account, no new billing relationship, and no new application to install.
🛠 Tips for Getting the Most Out of VPN Manager
db-primary or office-gateway is far
easier to reason about in a firewall rule list six months from now than a
generic device name.
Troubleshooting Common VPN Manager Issues
| Symptom | Likely cause | Fix |
|---|---|---|
| Client shows Offline | Localtonet app not running with the selected Token | Start the Localtonet app on that device with the correct Token active |
| Bridged LAN not reachable | Gateway IP doesn't match the client's real LAN address, or the CIDR is wrong | Verify the gateway is the client's actual local IP and the subnet mask matches, e.g. /24 |
| Specific port blocked | No Allow rule covers that protocol/port combination | Add or adjust a firewall rule for the exact protocol and port needed |
| Everything blocked between two clients | No rule permits traffic between them at all | Add a temporary Allow, All protocol, All Ports rule to confirm connectivity, then narrow it down |
Frequently Asked Questions
Do I need a separate account or app to use VPN Manager?
No. VPN Manager lives inside the same Localtonet dashboard you already use for tunnels, and clients connect through the same Localtonet app using Tokens you have already created. There is no separate signup, no separate billing, and no separate application to install.
What app version do I need to use VPN Manager?
Mobile v10.0 or later and Desktop v7.7 or later. Older versions of the Localtonet app will not expose the VPN client functionality, so update first if a device you want to add is running an older build.
Can I bridge a device that can't run the Localtonet app, like a printer or NAS?
Yes. That is exactly what LAN bridging is for. You bridge the local subnet that device lives on through a client that does run Localtonet, and the device becomes reachable to the rest of the mesh without ever installing anything on it directly.
Is traffic inside the VPN encrypted?
Yes. Traffic between VPN clients is routed through the Server Relay Node you select as an encrypted mesh connection, the same underlying secure connection model Localtonet uses for its tunnels.
How many clients can I add to one VPN?
The mesh subnet assigned to your VPN, such as a /16 range,
has room for tens of thousands of Virtual IPs, far beyond what a typical
team or home network needs. Practical limits depend on your account plan
rather than any hard technical ceiling in the subnet itself.
Do firewall rule changes require restarting the VPN?
No. Firewall rules and LAN bridges are evaluated live. Adding, editing, or deleting a rule takes effect immediately without restarting the VPN server or reconnecting any client.
What happens to a client's Virtual IP if it goes offline and reconnects?
The Virtual IP assigned to a client stays fixed for that client. When a device disconnects and later reconnects with the same Token, its status returns to Online and it keeps the same Virtual IP it had before, so firewall rules and any hardcoded addresses continue to work without changes.
Does VPN Manager cost anything to use?
No. VPN Manager is completely free on every Localtonet account. There is no subscription, no per-client charge, and no usage-based billing for creating a mesh, adding clients, bridging LANs, or configuring firewall rules.
Can I run multiple separate VPN meshes on one account?
Yes. Each VPN you create in VPN Manager gets its own name, subnet, and independent set of clients and firewall rules. You can run one mesh for a work team and a completely separate mesh for a personal lab, both managed from the same dashboard.
Ready to Build Your Own Private Mesh Network, Completely Free?
Update your Localtonet app to Desktop v7.7 or Mobile v10.0 or later, open VPN Manager in your dashboard, create a VPN, attach your first client with an existing Token, and set your firewall rules. Your private mesh network is live in minutes, at no cost.
Get Started Free →
