Match each Raspberry Pi workload to the right remote-access method
Remote terminal sessions, local web dashboards, UDP applications, shared folders, and private LAN access are different networking problems. Localtonet lets a Raspberry Pi establish an outbound connection to a relay server, so a compatible local service can be reached without inbound router port forwarding, firewall changes, VPN setup, or a public IP address. This guide explains how to select the appropriate tunnel family while preserving application authentication, least privilege, and sensible service hardening.
Why Raspberry Pi remote access requires protocol selection
A Raspberry Pi can perform many roles: development server, home automation controller, monitoring node, file appliance, test environment, or gateway to other devices on a local network. Although all of these scenarios are often described as “remote access,” they do not use the same traffic model. A browser-based dashboard expects HTTP or HTTPS behavior. SSH is a raw TCP service. Some discovery, telemetry, streaming, and real-time applications use UDP. File access can require a browser interface, SFTP client, or mounted network drive. Access to several private devices may call for an actual private network rather than an individually published service.
The first design decision should therefore be the workload, not the remote-access tool. Publishing an HTTP application through a raw TCP endpoint can omit useful web-specific behavior, while trying to carry a non-HTTP protocol through an HTTP tunnel is the wrong abstraction. Likewise, exposing several unrelated ports one at a time is not the same as connecting authorized devices through a private mesh network.
Localtonet addresses these use cases through separate tunnel and proxy families. Its client application runs on the Raspberry Pi, or on another device that can reach the Pi, and establishes an outbound connection to a Localtonet relay server. A running tunnel receives a public URL or a public host and port, depending on the tunnel type. Because the connection starts from inside the local network, the workflow does not require an inbound router rule or a public IP address. This can also be useful when the Raspberry Pi is behind carrier-grade NAT, provided that the device can make the required outbound connection.
Creating a Localtonet tunnel only saves its configuration. The tunnel must be started with the Start button, and it remains available only while the selected client or device is connected and the tunnel is running. It can later be stopped or deleted.
Choose the tunnel by workload
Raspberry Pi remote-access options compared
| Localtonet option | Best fit on a Raspberry Pi | Target and public access model | Important security responsibility |
|---|---|---|---|
| HTTP/s tunnel | Web dashboards, local development sites, HTTP APIs, and browser interfaces | Points to a reachable local IP address and port, then provides a public HTTPS address | Keep the application’s login, authorization, session handling, and sensitive routes protected |
| TCP tunnel | SSH and other raw TCP services | Points to a reachable local IP address and TCP port, then provides a public host and port | Use strong service-level authentication and disable unnecessary accounts or capabilities |
| UDP tunnel | Applications whose protocol explicitly requires UDP | Forwards UDP traffic to a local IP address and port | Confirm that the application safely handles untrusted network traffic before exposure |
| Combined UDP/TCP tunnel | A service that genuinely needs both UDP and TCP | Supports both transport protocols for the relevant local service | Protect and maintain every protocol path, not only the one used most often |
| File Server | Publishing a Raspberry Pi folder through a browser, SFTP workflow, or WebDAV mount | Targets a local folder path instead of an IP address and service port | Share only the required directory and grant only the file permissions users need |
| VPN Manager | Private mesh connectivity and controlled access across local LANs | Creates private network connectivity with granular firewall rules | Design firewall rules around least privilege and avoid granting unnecessary network reachability |
Publishing a Raspberry Pi web application
An HTTP/s tunnel is the natural choice when a service is already available through a browser or HTTP client. Examples include a development application bound to the Raspberry Pi, a local administration dashboard, or an API used during integration testing. HTTP tunnels point to a local IP address and port that the Localtonet client device can reach.
HTTP tunnels can use Random Sub Domain, Custom Sub Domain, or Custom Domain as the Process Type. Each serves the same content through a public HTTPS address. Availability can vary by plan or current dashboard options, and exact custom-domain DNS instructions should be checked against current Localtonet documentation rather than assumed.
A public HTTPS address does not remove the need for application security. If a dashboard was designed under the assumption that only trusted devices could reach it, inspect its authentication and authorization model before publishing it. Remove default credentials, protect administrative functions, validate input, update dependencies, and avoid exposing development diagnostics that reveal secrets or internal state.
Using a TCP tunnel for Raspberry Pi SSH
SSH is a TCP service, so it belongs behind a TCP tunnel rather than an HTTP tunnel. The TCP configuration forwards connections from the assigned public host and port to the SSH service’s local IP address and port. Localtonet provides the path to the service, while SSH continues to perform the actual user authentication and session security expected from the SSH server.
Before starting the tunnel, harden the SSH service itself. Prefer strong key-based authentication where appropriate, remove unused user accounts, keep the operating system and SSH server updated, and limit account privileges. Do not place a device token, private key, password, or public endpoint containing sensitive information in source code, screenshots, support tickets, or public documentation.
A TCP tunnel makes the configured service reachable through a public host and port. It does not make weak SSH credentials safe, bypass legitimate network policies, or decide which operating-system actions a signed-in user may perform. Harden the SSH server and apply least privilege before enabling remote reachability.
Handling UDP and mixed-protocol services
UDP should be selected only when the application protocol requires it. Unlike TCP, UDP does not establish the same connection-oriented session, so application behavior, identity checks, replay handling, and error recovery depend heavily on the protocol being forwarded. Verify what the Raspberry Pi service actually uses rather than choosing UDP because it appears lightweight.
Some applications depend on both TCP and UDP. Localtonet documents a combined UDP/TCP tunnel category for this situation. Use it when the application specification or observed behavior confirms that both transports are necessary. If only one protocol is required, exposing the unused transport creates needless reachability and increases the service surface that must be maintained.
Publishing Raspberry Pi folders with File Server
File Server is designed for a folder path, not for a conventional service listening on an IP address and port. This distinction makes it suitable when the real objective is to retrieve logs, exchange project artifacts, manage documents, or provide controlled access to media stored on the Raspberry Pi.
The Default File Server sub-type provides a browser-based file manager without requiring the remote user to install a client. It supports upload, download, rename, move, copy, delete, folder creation, search, preview, tagging, archiving, and sharing. Permissions include global Upload, Download, Delete, Create Folder, Move, and Share flags, plus per-path overrides where the most specific path wins. Permission changes apply without restarting the tunnel.
SFTP is intended for standard SFTP clients and automation workflows, including tools such as FileZilla, WinSCP, and rsync. WebDAV is intended for mounting a folder as a native operating-system network drive, such as through File Explorer on Windows or Finder on macOS. The supplied product information does not establish whether every Default web manager capability, including its folder encryption, Immich-compatible backup, and Smart Collections, also applies to SFTP and WebDAV. Check the current product interface and documentation before depending on those features across sub-types.
Select the narrowest folder that supports the task. Avoid sharing operating-system directories, credential stores, private keys, configuration files containing secrets, or broad home directories when a dedicated transfer folder is sufficient. Combine a restricted path with the minimum required file permissions.
When Raspberry Pi access should use VPN Manager
A tunnel publishes a particular application, port, or folder. VPN Manager addresses a different problem: private mesh connectivity with granular firewall rules and the ability to bridge local LANs. It is the appropriate category when authorized systems need private network communication rather than a single public service endpoint.
For example, a maintenance workstation may need controlled access to several internal services reachable through the Raspberry Pi, or two locations may need selected private resources to communicate. In that case, designing narrow VPN Manager firewall rules can be more coherent than publishing every internal service separately. Standard Localtonet HTTP, TCP, UDP, and File Server configurations should not be described as VPN functionality. Only VPN Manager is the actual VPN feature.
How to configure Raspberry Pi access with Localtonet
Install and run the Localtonet client
Install the Localtonet application on the Raspberry Pi, or on another device that can reach the Pi service over the local network. Keep the client running whenever the tunnel needs to remain available.
Authenticate or select the device
Use the device-specific authentication token associated with the client that will run the tunnel. Treat this token as a secret. Do not guess, publish, or embed it in examples.
Select an available relay server
Choose a server or region from the values currently offered in the Localtonet dashboard. Available server codes and regions should be obtained from the current product rather than copied from an old guide.
Create the configuration that matches the workload
Choose HTTP/s for a web application, TCP for SSH or another raw TCP service, UDP or combined UDP/TCP when required by the protocol, File Server for a folder path, or VPN Manager for private mesh networking. For port-based tunnels, enter the local IP address and port reachable from the client device.
Start the tunnel and test the assigned endpoint
Use the Start button to run the saved tunnel. Connect through the assigned public URL or public host and port, then verify both expected access and expected denial behavior using a non-administrative account where possible.
Stop or delete access when it is no longer needed
Stop a temporary tunnel after maintenance, testing, support, or file transfer is complete. Delete obsolete configurations so old access paths do not remain available for accidental reuse.
Tunnels can be managed from the Localtonet dashboard or REST API. The dashboard remains the safer reference for values that can change, such as available servers, regions, and plan-dependent options. Do not assume that every protocol, option, region, or capability is included in every subscription plan.
A practical security checklist
Secure Raspberry Pi access is a combination of transport selection, service hardening, identity controls, operating-system maintenance, and tunnel lifecycle management. Begin by exposing only the workload required for the task. If a browser dashboard is enough, do not also expose SSH. If a dedicated transfer directory is enough, do not publish the complete home directory. If private connectivity is required, use granular VPN Manager firewall rules instead of broad network access.
Keep the Raspberry Pi updated and remove software that is no longer used. Protect web applications with authentication and role checks. Harden SSH independently of the tunnel. Review file permissions before starting File Server. Test from an external network so that the result reflects the public access path, and verify that unauthorized requests fail safely. Finally, stop tunnels when the operational need ends. A shorter exposure window does not replace authentication, but it reduces unnecessary availability.
A Localtonet endpoint is available only while the selected client device is connected and the tunnel is running. Plan for power, network connectivity, and application availability if the Raspberry Pi provides a service that must remain reachable.
Frequently asked questions
Can I access a Raspberry Pi without router port forwarding?
Yes. The Localtonet client establishes an outbound connection from the Raspberry Pi, or from a device that can reach it, to a Localtonet relay server. This avoids inbound router port forwarding, firewall changes, VPN setup, and the requirement for a public IP address.
Which Localtonet tunnel should I use for Raspberry Pi SSH?
Use a TCP tunnel because SSH is a raw TCP service rather than an HTTP application. Point it to the Raspberry Pi address and SSH port reachable from the Localtonet client, and keep SSH authentication and account privileges hardened.
Can I expose a Raspberry Pi web dashboard through HTTPS?
An HTTP/s tunnel can publish a local HTTP application at a public HTTPS address. HTTP and File Server tunnels support Random Sub Domain, Custom Sub Domain, or Custom Domain process types, subject to current product and plan availability. The application should still enforce its own authentication and authorization.
Does Localtonet work when the Raspberry Pi is behind CGNAT?
The outbound tunnel model does not require the Raspberry Pi to have a public IP address, so it is suitable for networks where inbound connectivity is unavailable, including common CGNAT situations. The Pi must still be able to connect outbound to the Localtonet service.
Is a TCP or HTTP tunnel the same as a VPN?
No. Standard HTTP, TCP, UDP, combined UDP/TCP, and File Server tunnels publish a specific service or folder. VPN Manager is Localtonet’s actual private mesh VPN feature and includes granular firewall rules for private network access.
Can Localtonet publish files stored on a Raspberry Pi?
Yes. File Server publishes a selected local folder path. Choose Default for a browser-based file manager, SFTP for compatible clients and automation, or WebDAV for a native network-drive workflow. Share the narrowest practical directory and restrict file permissions according to user needs.
Connect your Raspberry Pi with the right Localtonet workflow
Select the tunnel that matches your application, keep authentication at the service layer, and run remote access only for as long as it is needed.
Get Started Free →
