Publishing services

How publishing works

A service on a device of your private network — a home site, a NAS's web page, a game server — can be reached from the whole internet, even though the device has no public IP. mesh-net runs a proxy for the network: it joins the network by itself as a device named rp-…, receives the requests on our server and forwards them through the mesh to the device you choose.

• HTTP/S goes through a subdomain of yours, like https://nas.myhome.mesh-net.space; the TLS certificate is ours, issued automatically.
• TCP and UDP go through a public port of our server, assigned automatically.

The section is on the network page under Reverse-proxy. The rp-… device in the device table is managed by mesh-net; with visual access rules, the dashboard also adds automatic rules so that the proxy reaches its targets.

What you need

• The Paid plan.
• A free reverse-proxy slot for the network.
• At least one device in the network — it becomes the target.
• For HTTP/S, a free subdomain on Domains: a name of yours that isn't the address of a network or of another published service.

Slots

• One slot covers one private network; inside it, publish as many services as you like.
• Slots are bought on My networks, in the Reverse-proxy row: Get more next to Slots opens Reverse-proxy slots, where +1 slot costs 199 ₽ a month or 1990 ₽ a year. You can't have more slots than private networks.
• All slots share one end date, shown in that row; each purchase adds a slot and moves that date by the paid period.
• Renew early with Renew for a month or Renew for a year next to Renew all slots (N): all slots at once, for the slot price times their number; the period is added to the current end date.
• The Publishing tab of the network page shows how many networks use reverse-proxy out of your slots, like Slots 1/2, with Get more next to it. With no free slot, a link to buy one is shown instead of Add route.
• When the add-on ends, you have no slots any more, and the published services of all networks are removed. A slot can be bought again at any time. See When add-ons end.

HTTP/S on a subdomain

1. On the Publishing tab press Add route and in the form pick HTTP or HTTPS — what the service itself speaks (see below).
2. Pick the subdomain in — subdomain (for HTTP/S) —.
3. Enter the target IP (the field suggests the network's devices) and the port the service listens on.
4. Press Add. The route appears in the table, and the subdomain opens over HTTPS within a few seconds; the first request may wait a moment while the certificate is issued.

TCP and UDP on a public port

1. Pick TCP or UDP — the subdomain isn't needed.
2. Enter the target IP and port and press Add.
3. The table shows the public address: the name (or the IP) of the server the network runs on and the port assigned to the route (from 20000–20100). Clients connect there.

Some internet providers block UDP on high ports; if a UDP service isn't reachable from some networks, that's the likely cause.

Targets

• The mesh IP of a device of the network — the list in the field suggests them.
• A host in a subnet approved on a subnet router, like 192.168.1.20: the proxy reaches it through the router. Below the form, the page lists the approved subnets it can reach.

If the target device's mesh address changes, its routes move to the new address by themselves.

Delete a route

Delete in the route's row, after a confirmation. The service stops being reachable at once; when the network has no routes left, its proxy is removed — the container and its rp-… device leave the network — and the slot is free for another network. Publishing again starts a new proxy. Adding and removing routes is recorded in the network's notifications, unless you turned the Reverse-proxy events off.

If the service doesn't answer

• The target device must be online, and the service must listen on the address you entered — not only on 127.0.0.1. Listening on all addresses (0.0.0.0) is the simplest.
• The device's own firewall must let the connection in: it comes from the proxy's 100.x address.
• With custom HuJSON the proxy needs your policy to allow it to reach the target; visual rules do this automatically.
• HTTP vs HTTPS: if the page shows an error from the proxy, check that the kind matches what the service speaks.
• A target in a subnet needs the route to be approved on its router.