Remote access decides where your Burrow can be reached from. Out of the box it is reachable and every request is gated by who is asking. This section is where you narrow that, see whether the outside world can actually reach you, have your router open the way in, and choose whether to use RatelKey's relay.
Restrict to local network#
Turn this on and your Burrow refuses any request that did not come from its own network, before it even looks at who is asking. It suits a Burrow that lives on your own hardware and has no business answering from the internet.
The switch can only be moved from the local network. Viewed from anywhere else it reads as plain text with a note saying so. That cuts both ways on purpose: nobody can lock your Burrow down remotely, and nobody can lift a lockdown remotely either. A terminal session on the Burrow's own host counts as local, so a Burrow with no usable network address is still reachable that way.
Local address#
The address to use from the same network as the Burrow, host and port together. This is the address to hand to a machine sitting beside it. A VPN address, such as a Tailscale one, is never shown here. On a server with no local network, like a VPS, it is the server's own address.
On its own network, your Burrow answers both https:// and http:// on the same port. That lets a tunnel or reverse proxy on the same machine or network, like cloudflared, point at http://localhost:12010 with its certificate checks left on. From anywhere else, http:// takes you to https://.
Reachability#
While your Burrow is not locked down, it checks whether it can actually be reached from outside. The check goes out to RatelKey, which connects back to your Burrow's public address, so it tests the real path rather than reading a setting. The result shows as a status line, with a button at its end to run the check again.
Result | What it means |
|---|---|
Reachable from outside your network | The path works. The Public IP and Remote Address rows show where the Burrow answers. |
Not reachable from outside | Nothing answered. The message names the port that needs forwarding to this Burrow, which your router can do for you below. |
Can't verify from here | Your Burrow and RatelKey appear to share a network, so the check would not prove anything. |
Couldn't run the check | The round trip failed. Run it again once the Burrow has settled. |
Router port forwarding#
When the check doesn't find your Burrow reachable, the section offers Enable remote access with UPnP / NAT-PMP. Select it and your Burrow asks your router to forward its public port to it, then runs the check again. Most home routers answer one of the two; it is often a switch in the router's settings called UPnP or NAT-PMP.
Once your router agrees, a Router Forwarding row shows which of the two it used and the router's public address and port. Your Burrow keeps the forwarding renewed and asks for it again after a restart. To stop it, select the delete icon at the end of the row.
If your router can't do it, the message says why: it refused, the port already goes to another device, or it didn't answer either one. In those cases, forward the port by hand in your router's settings, to the local address above. If the forwarding stops working later, for example after the router restarts with UPnP turned off, the reason shows with a way to try again or turn it off.
Public port#
The last field in Reachability is the port to advertise to the outside world, between 1 and 65535. It is the port the check tests and the one your router forwards. Set it when your router forwards an external port to a different one on the Burrow, so the addresses your Burrow hands out match what actually works. Changing it while router forwarding is on moves the forwarding to the new port.
Like the lockdown, it can only be changed from the local network. It is separate from the port the Burrow listens on, which is fixed while it is running.
RatelKey relay fallback#
The relay is a free service RatelKey runs so a Burrow with no way in from the internet is still reachable. Your Burrow dials out to it and keeps the connection open, and the Relay Address row shows the hostname you answer on through it.
It is on by default. Turn it off and logins reach your Burrow directly or not at all. Unlike the lockdown, this switch works from anywhere, because turning it off only ever reduces where your Burrow can be reached.