Your home network as an app.

From FRITZ!OS 7.50. Other routers: see below.

1. Open http://fritz.box in a browser and log in.
2. Go to Internet → Permit Access → VPN (WireGuard) → Add connection.
3. Choose Connect a single device, name it e.g. “HomeHyrax phone”, continue.
4. Confirm on the FRITZ!Box when asked (button on the box or phone).
5. A QR code appears – keep the page open.
6. In HomeHyrax: Tunnels → + Tunnel → Scan QR code. Alternatives: take a screenshot and choose QR code from image (screenshot), load the file via Choose file (.conf), or … or paste configuration.
7. Save. With Test connection you see right away whether the FRITZ!Box answers (on your home Wi-Fi the test may fail – that's normal).

• The FRITZ!Box uses its MyFRITZ! address (…myfritz.net). HomeHyrax resolves it on every connect – a changing IP is no problem.
• The FRITZ!Box puts 0.0.0.0/0 (everything through the tunnel) into the configuration. HomeHyrax ignores this on purpose: only the addresses of your tiles use the tunnel.

HomeHyrax reads the standard WireGuard configuration (wg-quick format). Any router or server that creates such a file or QR code for a device (“peer”, “client”) works.

The configuration for the phone looks like this (example values):

[Interface]
PrivateKey = <key of the phone>
Address = 192.168.178.201/24

[Peer]
PublicKey = <key of the router>
AllowedIPs = 192.168.178.0/24        # your home network
Endpoint = myhome.example.net:51820
PersistentKeepalive = 25

AllowedIPs matters: it must contain your home network. HomeHyrax only sends addresses in this range through the tunnel. The UDP port (here 51820) must be reachable from outside – most routers open it themselves when you set up the WireGuard server.

Tailscale runs inside HomeHyrax – you don't need the Tailscale app or a VPN switched on. You need a free account at tailscale.com (or your own Headscale server) and a device that runs permanently at home and can run Tailscale: Raspberry Pi, NAS (Synology, QNAP, Unraid), Linux PC, some routers (GL.iNet, OpenWrt). It becomes the subnet router and forwards the app's requests to the other devices.

a) Set up the subnet router (example network 192.168.178.0/24 – use yours)

Raspberry Pi / Linux

curl -fsSL https://tailscale.com/install.sh | sh
# allow forwarding (once)
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
# sign in and share the home network
sudo tailscale up --advertise-routes=192.168.178.0/24

The last command shows a link – open it and sign in with your Tailscale account.

Synology NAS (DSM 7): Package Center → install Tailscale, open, sign in. Then via SSH: sudo tailscale set --advertise-routes=192.168.178.0/24

Other devices: install Tailscale and enable “Subnet router” / --advertise-routes with your home network.

b) Approve the route

1. Open login.tailscale.com/admin/machines.
2. At the subnet router: ⋯ → Edit route settings and tick the route.
3. Recommended: same device ⋯ → Disable key expiry, so the router doesn't need a new sign-in after a few months.

c) Connect HomeHyrax

1. Tunnels → + Tunnel → Tailscale. Leave Own server (Headscale) empty for Tailscale.
2. Tap Connect. The browser opens the Tailscale sign-in – use the same account as for the subnet router, then return to the app.
3. The card shows Connected and the shared home network. No home network yet? Step b) is missing.

With an auth key (Tailscale admin → Settings → Keys) you can skip the browser sign-in, e.g. for a family phone. When sharing via QR code, HomeHyrax never passes the auth key on.

Mobile routers are almost never reachable from outside – take Tailscale.

• Larger Teltonika models (RUTX, RUTM, TRB1/TRB5) offer Tailscale as a package (System → Package Manager, then Services → VPN → Tailscale; see Teltonika wiki “Tailscale Configuration Example”).
• Small models like the RUT200 don't have enough memory: connect a Raspberry Pi Zero 2 W by Wi-Fi or LAN and set it up as subnet router as above.
• Give the camper its own address range (e.g. 192.168.50.0/24), different from home – otherwise the same addresses get mixed up.

1. Home → + New → Website.
2. Name and Home network address: IP or name, optional port – e.g. 192.168.178.1, 192.168.178.20:8123 or https://nas.local:5001.
3. VPN: Smart and choose the tunnel.
4. Tap the icon preview to Choose icon (icons + color) or take an Image from phone.
5. Optional: Require unlock (fingerprint/face/PIN). Under Advanced: Full screen, Keep screen on, Desktop site.
6. Save or straight Add to home screen.

Long-press a tile and drag it to reorder. Routers and NAS often use a self-signed certificate: HomeHyrax asks once and then remembers exactly this certificate.

1. + New → Switch → device Shelly.
2. On your home Wi-Fi: Find Shelly on home network – HomeHyrax lists all Shellys with name, generation and whether a password is set. Away or not found: Set up manually with the Shelly IP and generation.
3. Choose the Channel (0 = first output) and the Action: Pulse – e.g. garage door (briefly on, then off automatically, duration in seconds), Turn on, Turn off or Toggle.
4. If the Shelly has a password: enter it – it's stored encrypted and only sent when the Shelly asks (Gen1 Basic, Gen2 Digest SHA-256).
5. VPN Smart, choose the tunnel, save.

Tapping the tile asks for your fingerprint (can be switched off), sends the command and shows the real state: Switched on / Switched off. With a pulse, it checks again afterwards and warns if the relay is still on. Other devices: Custom URL – HomeHyrax calls exactly this address.

1. In the camera's app, enable the local RTSP stream and copy the link. Eufy: Settings → NAS (RTSP), recording set to “always” – with “on motion” the camera answers “stream not found”.
2. HomeHyrax: + New → Camera → paste the link under RTSP address. User and password are split off automatically into Camera user / Camera password.
3. VPN Smart, choose the tunnel, save.

1. On your phone: ⋮ → Share HomeHyrax, choose entries and tunnels → Show QR code or Send as file (with images).
2. On the other phone: install HomeHyrax → ⋮ → Import HomeHyrax → scan the code or Open received file.
3. A preview shows what is new or updated. Existing entries keep their connection and passwords.

• Mobile data → tunnel right away.
• On Wi-Fi the app briefly knocks on the address directly (max. 0.8 s). Answer → you're home, the page loads directly and the app remembers this Wi-Fi.
• Other Wi-Fi (hotel, office) → tunnel right away without knocking. If the tunnel fails there, it tries the direct route after all (e.g. new router at home).
• Loading directly fails → it switches to the tunnel by itself.
• The Wi-Fi is recognized by address range, router address and domain – not by its name, so HomeHyrax needs no location permission.