Reach anything at home — without opening your home
Vome forwards the things that can never run a VPN app — cameras, desktops, printers, PLC controllers — out through one outbound, encrypted link. This board walks the path hop by hop, then puts it honestly next to mesh VPNs like Tailscale and NetBird: where they're the better tool, where we are, and why plenty of homes run both.
One outbound link, two kinds of traffic
Your Home Assistant dials out to the Vome relay and keeps that line open. Everything rides it — no port-forwarding, nothing at home listens to the internet. Pick a scenario, then click any hop to see its job and, just as important, what it can see.
The dots are your data in flight. Click any box on the board — the card below explains its job in the chosen scenario.
Click a hop
Each box above is a real machine or process. Pick a scenario, then click a box to see what it does — and what it can see.
Two different shapes: forwarding services vs. joining a network
Tailscale and NetBird build a network: every device runs a WireGuard agent and joins a private mesh. Vome forwards services: nothing on your LAN changes, and each route grants exactly one destination. Neither shape is "better" — they answer different questions.
Vome — service forwarding
agents on LAN devices: none · access granted: per route
- Nothing installed on the camera, NAS or TV — Home Assistant reaches them over the LAN they already sit on.
- A guest gets one route — or a token that expires in an hour — never your network.
- Web things need only a browser; Remote Desktop needs one small command, no admin rights.
Tailscale / NetBird — mesh VPN
agents: every member device · access: network-level, then ACLs
- WireGuard peer-to-peer where the network allows — LAN-class speed, end-to-end encrypted.
- Every member device runs an agent with a privileged network driver — nothing agentless can join.
- Members see the whole network, every port of every peer, unless ACLs narrow it down.
- NetBird's pitch over Tailscale: the entire control plane is open-source and self-hostable; Tailscale's coordinator is proprietary.
The honest print
Mesh VPNs are end-to-end encrypted — their relays cannot read your traffic. Vome's relay bridges two encrypted legs, so in principle it can see tunnelled bytes; in practice Remote Desktop, SSH and HTTPS encrypt themselves end-to-end anyway, but a plaintext protocol would be visible to the relay you're trusting. Vome traffic also always takes the relay hop — fine for cameras, dashboards and desktops; slower than a direct WireGuard path for moving big files.
Side by side — and when to use which
The overlap is exactly one case: you, reaching your own machines, from a device you control. There a mesh VPN is the stronger tool. Everywhere else they answer different questions.
| Question | Vome | Tailscale | NetBird |
|---|---|---|---|
| What you get | Specific services, forwarded | A private network your devices join | |
| Install on home devices | None — HA reaches them | Agent per device | Agent per device |
| Install on the visiting device | Browser only · small CLI for TCP, no admin rights | Agent + network driver | Agent + network driver |
| Hand a guest one service | A URL, or a token that expires | Invite to the tailnet + ACLs | Invite + groups/ACLs |
| Whole-LAN, any-port access | No — per-route by design | Yes | Yes |
| Speed | Always relayed | Peer-to-peer when possible | Peer-to-peer when possible |
| End-to-end encryption | Per-hop TLS; inner protocol's own crypto rides through | Always | Always |
| Self-host the control plane | Relay endpoint is repointable | Proprietary (Headscale, unofficial) | Fully open-source |
| Home Assistant story | Native — one panel, plus CHAP failover | Community add-on | Do-it-yourself |
Reach for a mesh VPN when…
- It's your device on both ends and you can install agents.
- You want everything — SSH anywhere, printing, site-to-site.
- You're moving big files and want peer-to-peer speed.
Reach for Vome when…
- The thing at home can't run a VPN app — a camera stream, a printer, a heat-pump or PLC controller with a web page.
- The far end is a browser or a locked-down machine — a work laptop, a relative's PC — where nothing privileged can be installed.
- You're handing access to someone who isn't you: one service, time-boxed, without adding their device to your network.
Running both
- Plenty of homes do: a mesh VPN for the owner's own admin access, Vome for everything that can't join a mesh — and everyone who shouldn't.
- Remote Desktop over Vome doubles as the emergency path from machines where no VPN is allowed.
Prefer it in words?
The how-it-works boards show the same relay next to the other access paths and the CHAP failover playground, the security page covers the token, audit and no-open-ports model these tunnels inherit, and the guides walk the set-up step by step.
The honest summary: a mesh VPN is a power tool for your own devices; Vome is the front door for everything and everyone else. Most homes that need one eventually want both.