NAS interface
Reach Synology, QNAP or Unraid on the go – with HTTPS and optionally only for your team.
Expose Host · kh-tunnel
Services from home. No port forwarding.
With Expose Host, the kh-tunnel client connects your device to the CDN from the inside. That way you make your NAS, Home Assistant, web server or Minecraft server reachable – even behind DS-Lite and CGNAT, protected against DDoS attacks, while your home address stays hidden.
- Free plan, forever
- no credit card required
- set up in minutes
- Raspberry Pi, Docker, NAS
- Linux
- and macOS
- Windows
- and DS-Lite are no problem
- CGNAT
- until changes apply
- 30 sec
Setup
One command. Three questions.
Many connections can’t be reached from outside – port forwarding doesn’t help then. With a device in the CDN, your network builds the connection outward itself.
- 1
Add the device
Choose a name and system: Linux and Raspberry Pi, Docker and NAS (Synology, Unraid, QNAP), Windows or macOS.
- 2
Run the command
Run the command shown on the device – the portal shows live when the client has connected to the edges.
- 3
Publish a service
What should be reachable (website, Minecraft, another program), where does it run and under which address – done.
Linux / Raspberry Pi
$ curl -fsSL https://portal.kernhosting.com/device/install.sh \
| sudo sh -s -- KH-XXXX-XXXX
# sets up a systemd service and connects
# outbound to all edges
Comparison
Port forwarding is a thing of the past. Expose Host instead of open ports.
Port forwarding vs. Expose Host
| Port forwarding on the router | Expose Host (kh-tunnel) | |
|---|---|---|
| Behind DS-Lite / CGNAT | Doesn’t work | ✓ Works |
| Open port on the router | Yes | ✓ No – outbound connection |
| Home address | Publicly visible | ✓ Hidden behind the edges |
| DDoS and bot protection | None | ✓ Via the CDN |
| HTTPS certificate | Set up yourself | ✓ Automatic |
| Team-only access | Build it yourself | ✓ Access protection with one click |
| Failover | – | ✓ Multiple devices as a pool |
What for?
Your home network. Safely reachable.
Home Assistant
Your smart home from anywhere – the client runs on a Raspberry Pi or NAS in the same network.
Your own web server
A website or web app from your computer at home – with the CDN’s caching, WAF and DDoS protection.
Minecraft server
Players connect via the edges; your home connection stays hidden from attacks.
SSH to your Raspberry Pi
A terminal right in the browser – no open port, no VPN.
Remote desktop to your Windows PC
Time-limited access for remote desktop or VNC – only for your IP address and for at most 8 hours.
What you can publish
Websites, Minecraft, ports. With everything the CDN offers.
Websites
NAS interface, Home Assistant or your own web server – with HTTPS certificate, caching, WAF, bot protection and statistics.
Minecraft servers
The server at home gets the same protection as any game server in the CDN – without an open port on your router.
Open ports
TCP or UDP on a port between 30000 and 39999 on all edges – for everything else.
Remote access
SSH in the browser. Remote desktop for a limited time.
Reach a device’s console or desktop – without an open port and without a VPN. Signing in to the portal decides who gets in.
SSH in the browser
A terminal right in the portal. Credentials go encrypted to your device – the portal doesn’t store them.
Remote desktop, VNC & more
Time-limited access for your own programs: only for your current IP address and for at most 8 hours.
Logged
Every session is logged – who, when, which device. Only team members with write access can open one.
Secure & robust
Connected to every edge. If one fails, it keeps running.
Connected to all edges
The client connects to every edge over an encrypted connection. If one fails, the others keep running.
Multiple devices as a pool
Two Raspberry Pis on different connections – the CDN removes a device as soon as it loses its connection.
Access protection
Optionally only for your team: whoever isn’t signed in never gets as far as your device.
Status at a glance
Every service shows the path edges → tunnel → target. Red marks where it’s stuck.
Offline alert
If a device is offline for more than 3 minutes, you get a notification – listing the affected websites and game servers.
Updates itself
The client downloads new versions from the portal, verifies the signature and restarts.
What is Expose Host?
The service for publishing servers from home through the CDN. The kh-tunnel client connects to the edges from the inside – without port forwarding and without a static IP. In the portal you’ll find it under “Geräte” (devices).
Is my home connection protected against DDoS?
Yes. Visitors and players only see the CDN edges, your home address stays hidden, and no port is open on your router. Attacks land on the edges, not on you.
Do I need a static IP or port forwarding?
No. The client builds the connection from the inside – even behind DS-Lite, fiber and mobile connections without their own IPv4 address.
Which systems are supported?
Linux and Raspberry Pi, Docker (e.g. Synology, Unraid, QNAP, Portainer), Windows and macOS.
Which ports need to be open?
Outbound only: port 7443 (TCP) to the edges and HTTPS to the portal. Nothing needs to be opened inbound.
What shouldn’t I publish?
Services without their own login – cameras or router interfaces, for example. Whatever you publish is reachable on the internet; for admin interfaces there’s access protection.
Does Home Assistant work?
Yes. The client runs on another device in your network, such as a Raspberry Pi or NAS, with Home Assistant’s address as the target. For the app, add its addresses as allowed addresses or use Home Assistant’s own login.
Get started
Protected in minutes. Start for free.
Free plan, forever · no credit card required · set up in minutes