Remote access
Behind CGNAT, behind a firewall, on any connection. Install one agent, get a real HTTPS address, and decide who gets in.
We can't read your traffic.
We don't cap your uploads.
We don't break your apps.
Free tier · no credit card
The seal
jellyfin.you.example
one name, to pick your tunnel
2.4 GB moved this month
so the relay can be billed honestly
That's the complete list.
Your files, your requests, your headers, your media. Encrypted end to end, opened only by your own agent.
Not a policy we promise to keep — the shape of the system. We route on the hostname and forward the rest untouched.
The problem
None of that is your fault. It's what happens when the tool in the middle decrypts everything at its edge.
Not our words
Before anything was designed, 3,268 posts and 1,274 comments from r/selfhosted, r/homelab, r/jellyfin and r/PleX were collected and read. Everything here traces back to something in that pile.
“My apps — specifically Immich — can't use the tunnel properly. The max free upload size is 100 MB, so my videos aren't backing up.”
r/unRAID · removed the tunnel over it
“Cloudflare application OAuth is not compatible with basically all mobile apps. Bitwarden cannot sync the vault with this in place. Immich can't log in.”
r/selfhosted · 100 upvotes
“My parents especially — they're not going to open a VPN app and hit connect every time. Plus some devices like TVs can't really do a VPN.”
r/PleX · behind CGNAT since switching to fibre
Setting up
One command, or a container. It connects outbound, so nothing has to be opened on your router or firewall.
jellyfin on port 8096 becomes jellyfin.yourdomain.com, with a valid certificate issued automatically.
Public, a password, a guest link, or a per-device token. Everything starts private — opening it up is a deliberate choice.
# on the machine that already runs your services $ sheephold up jellyfin --port 8096 --guests ✓ tunnel established eu-west ✓ certificate issued jellyfin.you.example ✓ access guest links only ✓ ready https://jellyfin.you.example
Shown as it will work in the beta. Nothing is live yet — that's what the waitlist is for. (Yan, tan, tethera: how shepherds have counted sheep in the north of England for centuries.)
The gate
Authentication that covers a whole service breaks native apps — that's the failure everyone runs into. Rules match on path and method inside one service, so the web interface can sit behind a password while your TV client keeps working.
# jellyfin — the profile ships ready to apply default: password # everything is denied unless listed below except: GET /System/Info/Public # discovery GET /Items/*/Images/* # artwork on the TV
The difference
Most managed tunnels terminate TLS at their edge. That's how they add caching and filtering — and it's also why they cap uploads, restrict media in their terms, and choke on native apps. We route at the connection level, reading only the hostname needed to pick your tunnel.
| Typical managed tunnel | Sheephold | |
|---|---|---|
| Reads your traffic | Yes, at the edge | No |
| Upload limit | 100 MB per request | None |
| Media restrictions | Yes, in the terms | None — we store nothing |
| Native apps | Break under browser auth | Per-device tokens |
| Heavy usage | Throttled or pushed upmarket | Point your own exit server |
| Charges per user | Usually | Never — guests are unlimited |
Where bytes go
Same dashboard, same certificates, same rules. What changes is the road the traffic takes — and you don't configure any of it.
Nothing to install for them. Counts against your allowance.
A small client on devices you own, connecting directly. Free, always.
Your bandwidth, your rules, our dashboard. Never metered by us.
Some setups are heavy by nature — a library shared with ten people, a stack that moves terabytes. Instead of pretending otherwise, the third path exists: you keep the part that's genuinely annoying to run, we stop paying for bytes we can't afford. Nobody has to hide what they run.
Rates
Traffic that goes direct — between your own devices, or through your own exit server — never counts. Neither do guests, and neither does what you choose to run.
Solid is included at full speed. Dashes are still working, just slower — that's what happens past your allowance. No bar ever turns into a bill.
| Free | Local | Homelab | Media | Own exit | |
|---|---|---|---|---|---|
| Relay traffic | 25 GB | 25 GB | 300 GB | 1 TB | Your server |
| Region | EU / US | Your choice | Your choice | Your choice | — |
| Your own domain | — | 1 | 3 | 5 | 5 |
| Guests | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
| Direct traffic | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
Going over your allowance slows the relay down and offers a top-up. It never bills you by surprise. The free tier stays free.
Waitlist
One email when the beta opens, and nothing else. The questions are optional, and they decide what gets built first.
Questions
No. Your visitors install nothing — they open a URL. There's an optional client for your own devices, which connects you directly and takes that traffic off our relay entirely.
We see the hostname you chose and how many bytes moved. Not the content, not the URLs, not the files. TLS ends on your agent, inside your network.
Nothing breaks and nothing is against the rules — we don't cache, so there's no content restriction to work around. If your volume grows, the own-exit plan is cheaper for you than any allowance we could sell you.
Yes — that's the point of the access rules above. Everything is denied by default, exceptions are explicit and listed on the service page, and there's a box where you paste a URL to see exactly which rule it hits.
No — and that is true of every service with a valid certificate. Public certificate authorities publish every name they sign to Certificate Transparency logs, which anyone can search. Only the name is published: never the content, your network, or what runs there. Worth knowing when you name something, and worth remembering that a known address still gets nobody past your password or guest link.
No. You send a link, they open it. You can revoke that link on its own, without touching anyone else's access.
In what it does, it isn't — Pangolin is good, and if you enjoy running it, keep running it. The difference is that you operate nothing: certificates, DNS, identity and updates are handled. And if you'd rather keep the bandwidth on your own server, the own-exit plan gives you that, with the dashboard still on our side.
On a paid plan the address is your own domain, so it keeps working the moment you point it elsewhere. The agent is open source. Nothing about your setup is locked to a hostname we control.
One developer, in the open, after reading a year of the same five threads on r/selfhosted. The research is published — every claim here traces back to something someone actually ran into.