Your Homelab Behind CGNAT — Now Reachable for Free

You run a server at home. Your ISP put you behind CGNAT. You can't open a port. Tailscale works but you'd rather not route everything through someone else's mesh. Here's a free hosted relay that solves it in one curl command.

If you run anything at home — a media server, a Nextcloud, a Home Assistant, a build box, a Discord bot — you've probably hit CGNAT. Your ISP doesn't give you a public IPv4 address. You can't forward a port. You can't reach your own machine from outside your house.

The standard answers all have a cost:

• Tailscale / WireGuard mesh — works, but now every device you own is on someone else's overlay network, and the free tier caps at 100 devices.
• A VPS with a reverse tunnel — you're paying €4-6/month for a box whose only job is to forward traffic, and you're maintaining SSH tunnels or a WireGuard config that breaks when the VPS reboots.
• Cloudflare Tunnel — free, but it's HTTP-only. You can't run arbitrary commands through it, and it doesn't help with non-HTTP services.
• DynDNS + port forwarding — doesn't work on CGNAT. There's no port to forward.

There's a simpler option, and as of today it has a free hosted tier.

The relay model: your server connects out, you connect to it

rcmd is a relay-based remote execution tool. Instead of you connecting to your server, your server connects out to a relay — and you connect to the same relay from your laptop, your phone, or your AI agent. The relay routes between you.

This is the same model SSH bastion hosts use, with two differences:

1. No inbound ports on your server. The daemon dials out. It works behind CGNAT, behind a double-NAT, behind a corporate firewall, behind anything that allows outbound HTTPS. Which is everything.

2. No SSH keys. Each server has a token. You have a token. The relay authenticates both sides and routes commands. No key management, no authorized_keys files, no sshd_config tuning.

The free hosted tier

rcmd now has three plans:

• Free (hosted) — 3 servers on the relay at rcmd.intrane.fr, no credit card. This is new.
• Pro (€5/mo) — unlimited servers, plus cron scheduling, port forwarding, team access, and webhooks.
• Self-hosted (free, OSS) — run your own relay, unlimited everything, MIT licensed.

The free tier is the one that matters for homelabbers. Three servers covers most home setups — a NAS, a Home Assistant, a build box. No VPS to rent, no tunnel to maintain, no mesh to join. Your machines connect out; you reach them from anywhere.

Set it up in 60 seconds

On your home server (the one behind CGNAT):

curl -sSL https://rcmd.intrane.fr/install.sh | sh
rcmd signup --free --email you@example.com
rcmd set-relay --url wss://rcmd.intrane.fr --name homeserver
rcmd daemon start -daemon

On your laptop, anywhere in the world:

rcmd login <your-token>
rcmd exec --target homeserver --cmd "uptime"

That's it. Your home server is now reachable from anywhere, no port forwarding, no VPN, no CGNAT workaround. The daemon connected out to the relay; your laptop connected to the same relay; the relay routed the command.

Copy a file to it:

rcmd cp --target homeserver --src ./config.yaml --dst /etc/app/config.yaml

Run a command on all your home servers at once:

rcmd exec --targets nas,homeassistant,buildbox --cmd "df -h" --format json

Why not just self-host the relay?

You can — the self-hosted relay is free and MIT licensed, with unlimited targets and all features unlocked. But self-hosting the relay means you need a machine with a public IP to run it on — which, if you're behind CGNAT, is exactly the problem you're trying to solve. You'd need a VPS for the relay, and now you're back to paying for a VPS.

The free hosted tier breaks that loop. I run the relay on a VPS. You use it for free. Your home servers connect out to it. You reach them from anywhere. No VPS for you, no CGNAT problem, no credit card.

If you outgrow 3 servers — you add a fourth home machine, or you want cron scheduling for backups, or you want to share access with a teammate — Pro is €5/month and removes the limit. That's the upgrade trigger, and it's the only one: you hit the server cap, or you want the team features.

What the relay can and can't see

A fair question: if all my traffic goes through your relay, what can you see?

Commands and output pass through the relay, but they're not stored — the relay routes frames in memory and drops them when delivered. The relay authenticates both sides with tokens; it doesn't have your SSH keys because there are no SSH keys. If that's still too much trust, self-host the relay and keep everything on your own infrastructure.

Who this is for

Homelabbers behind CGNAT who want to reach their machines without a VPN mesh or a VPS tunnel. Three servers, free, done.

People who manage 2-3 VPSes and are tired of maintaining SSH config, key rotation, and bastion setup. One binary per machine, one token, no keys.

AI agent builders who need their agent to run commands on remote machines without handing it SSH keys. Every command returns structured JSON — stdout, stderr, exit code, duration — no parsing, no token waste. I wrote about that separately.

Try it

If you have a home server you can't reach from outside:

curl -sSL https://rcmd.intrane.fr/install.sh | sh
rcmd signup --free --email you@example.com

Three servers, no credit card, no VPS, no CGNAT workaround. rcmd.intrane.fr

Previously in this series: Stop Giving AI Agents Your SSH Keys — the security argument for the relay model. remotecmd parallel streams, faster than scp — the file transfer benchmark that made the relay faster than direct SCP over high-RTT links.