To VPN into your home network is to carry your home internet in your pocket: from a hotel or a café your phone behaves as if it were on the living-room Wi-Fi, so the NAS, the cameras, the printer and the desktop are reachable without exposing any of them to the internet. It is the opposite of a consumer VPN service, which takes your traffic away from home to a shared exit elsewhere; here the exit is your own router. The setup is one evening if your router or NAS supports WireGuard, and the main obstacle is not the software but whether your ISP gives you a reachable address.
Below: the three places the server can live, the address problem and its fixes, the mesh alternative for when nothing else works, and the short list of mistakes that turn "my private network" into "everyone's network".
Why do this at all
Reaching files on the NAS without syncing them to a third-party cloud. Watching your own cameras without the manufacturer's cloud in the middle. Using the home printer or the desktop's remote screen from the road. Routing all your traffic through home when you are on a network you distrust, so the café sees one encrypted connection and your home ISP sees the same browsing it always sees. And having your own exit IP in your own country, which some services prefer over shared addresses; that trade-off is in VPN vs VPS.
Where the server lives
The router. Best option when the firmware supports WireGuard: it is always on, it sits at the network edge, and nothing else needs to run. Many current consumer routers and most open firmware do. Whether to put the tunnel on the router or on each device, and what it costs the router's CPU, is in VPN on router vs device.
The NAS. Most NAS systems ship a VPN server package. Fine if the NAS is always on, and it usually is. One port forward on the router points at it.
A small box. A single-board computer or an old laptop running WireGuard. Cheapest, most flexible, one more thing to keep updated.
In all three cases the server needs a public key for each client, and each client needs the server's key and address. How the keys and configs look is in How to set up WireGuard; the WireGuard config generator produces client files you can scan as a QR code.
The address problem
For your phone to reach home, home needs an address the internet can reach. Three cases:
Public IP that changes. The common one. Use dynamic DNS: the router updates a hostname whenever the address changes, and clients connect to the hostname. Most routers have it built in.
Public IP that never changes. Rare and easy: use it directly.
No public IP at all. Increasingly common: the ISP puts you behind carrier-grade NAT and shares one address among many customers, or gives you IPv6 only. Incoming connections cannot reach you. Fixes: ask the ISP for a public address, sometimes a paid option; use IPv6 if both ends have it; or flip the direction with a mesh tool or a tiny rented box that both ends connect out to.
The last case is exactly where mesh tools earn their keep: your devices punch out to a coordination service and find each other, no incoming port needed. The trade-offs, including who sees your network's map, are in WireGuard vs Tailscale.
The one port you open
Only the WireGuard port, forwarded from the router to whatever runs the server, and nothing else. WireGuard does not respond to packets that are not signed by a known key, so the port is silent to scanners. Do not forward the NAS's web interface, the camera's port, or remote desktop "just in case"; that is the pattern behind most home-network break-ins, and it is precisely what the tunnel exists to avoid.
Full tunnel or split
Clients can send everything through home, or only traffic destined for the home network. Full tunnel: the café sees one encrypted connection, your home ISP sees your usual browsing, and your public IP is your home one; slower, since everything makes the round trip. Split: only home addresses go through the tunnel, the rest goes out locally; faster, but the café network sees your ordinary browsing. On an untrusted network, full tunnel; on a trusted one, split. What split tunneling does and where it leaks is in What is split tunneling.
Mistakes that expose the house
- Forwarding ports other than the tunnel's.
- Leaving the router's remote administration on.
- One shared key for all devices, so a lost phone means re-keying everything; give each device its own key and revoke it alone.
- Never updating the router or NAS firmware.
- Putting the tunnel on a NAS that also runs a dozen exposed apps.
- Skipping a kill switch on the phone when the whole point was to hide traffic from the café; what it does is in What is a VPN kill switch.
Checking it works
From mobile data, not from the home Wi-Fi: connect, open the NAS by its private address, then open What Is My IP. In full-tunnel mode it should show your home ISP; in split mode, the carrier. Try again from a café: that is the network the setup was for.
What this does not replace
Your home ISP still sees everything your home sees, now including your browsing from the road. Nobody is in a crowd: your exit IP is yours alone. And a home tunnel gives you no other countries. For privacy from the ISP and for a shared exit elsewhere, a privacy service is the other tool, and the two coexist on one phone with no conflict, as long as only one is active at a time.
404 VPN is that other tool: a privacy service with VLESS and WireGuard, DNS inside the tunnel and a kill switch, taking your traffic to a shared exit in another country rather than back home. Many people run both: home tunnel for the NAS, service for everything else. Start on the home page.