An XDA writer put a stake in the ground last week: CGNAT does not have to block a self-hosted stack. Cloudflare Tunnels, WireGuard through a small VPS, and modern mesh VPNs like Tailscale all get around the “no inbound port” problem without buying a static IP from the ISP. From an Android phone, the client side of that decision is usually one app and a QR code.
We looked at eight Android apps that expose a home server to the outside world. Some run a mesh VPN. Some run a proper reverse tunnel to a cloud edge. Some are the phone-side client for an open-source hole-punch relay. The right pick depends on how much control you want and whether the server sits behind CGNAT.
What to look for in a remote-access app
- Works behind CGNAT. Any pick that assumes a public IP is out.
- No-account or self-hostable coordinator. If the coordinator disappears, the network should not.
- Split tunneling. Only route the self-hosted subnet through the tunnel, not the whole phone.
- Battery friendly. Always-on VPN drains phones; a good client is invisible.
- No-logs policy. The coordinator sees connections; a good vendor commits to not logging them.
- Wear OS or Android TV. Bonus points if the client works on the same devices you host apps on.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price | Rating |
|---|---|---|---|---|---|
| Tailscale | Easiest mesh VPN with WireGuard under the hood | Android, iOS, all desktops, TV | 100 devices personal | Free personal / $6/user/mo Team | 4.7 |
| WireGuard | Barebones VPN client with QR-code config | Android, iOS, all desktops | Yes | Free | 4.7 |
| ZeroTier One | Ethernet-style overlay with a web console | Android, iOS, all desktops, routers | 25 devices free | $5/mo Pro | 4.6 |
| Cloudflare Zero Trust (WARP) | Reverse tunnels through Cloudflare | Android, iOS, all desktops | 50 users personal | $7/user/mo Team | 4.5 |
| Netbird | Open-source Tailscale-style mesh, self-hostable | Android, iOS, all desktops | Yes | Free self-host / $8/user/mo Cloud | 4.5 |
| Twingate | Zero-trust access control instead of full VPN | Android, iOS, all desktops | 2 admins, 5 devices | $10/user/mo | 4.6 |
| OpenVPN Connect | Classic OpenVPN client for pfSense/OPNsense | Android, iOS, all desktops | Yes | Free | 4.4 |
| Pangolin | Self-hostable reverse-tunnel platform | Android via WireGuard | Yes | Free self-host | 4.5 |
The apps
1. Tailscale – Best overall mesh VPN client
Tailscale is what most self-hosters install first. It builds a WireGuard mesh between every device you sign in on, punches through CGNAT and NAT without configuration, and uses ephemeral DERP relays only when direct connections cannot form. The Android app is a switch, a login button, and a per-machine settings panel.
Where it falls short: Personal plan caps devices at 100 and admins at 3. The paid coordinator is not open source, though the client is.
Pricing: Free for personal use (up to 100 devices). Team from $6/user/mo.
Platforms: Android, iOS, Windows, macOS, Linux, Apple TV, Synology, TrueNAS, and more.
Download: Google Play, F-Droid, App Store
Bottom line: The pick if you want remote access to work in five minutes and never think about it again.
2. WireGuard – Best minimal VPN client
WireGuard is the protocol Tailscale wraps. The official Android client reads a QR code and connects. Run WireGuard on a VPS (a $3/mo Hetzner or Oracle Free Tier box) and point your home router at it and CGNAT is done for.
Where it falls short: No mesh. No coordinator. You handle the config, the keys, and the routing tables. On a phone alone, that is fine; adding five more devices gets tedious.
Pricing: Free, open source.
Platforms: Android, iOS, Windows, macOS, Linux, BSD.
Download: Google Play, F-Droid, App Store
Bottom line: The pick for the phone side of a hand-configured VPN.
3. ZeroTier One – Best Ethernet-style overlay
ZeroTier builds a virtual Ethernet across every device you join. That is a different mental model from Tailscale: instead of an SSH-style host list, you get a subnet where every device has a stable IP. The Android app runs quietly in the background and is invisible to the OS.
Where it falls short: Personal plan tops out at 25 devices per network. The controller is centrally hosted unless you self-host.
Pricing: Free for personal (25 devices). Pro from $5/mo.
Platforms: Android, iOS, Windows, macOS, Linux, routers.
Download: Google Play, App Store
Bottom line: The pick when the mental model is “same LAN everywhere,” not “hostname-based host list.”
4. Cloudflare Zero Trust (WARP) – Best if you already run Cloudflare Tunnel
Cloudflare Zero Trust with WARP is the phone client for a Cloudflare Tunnel setup. Run cloudflared tunnel on the home server to expose Jellyfin, Nextcloud, or Home Assistant through Cloudflare’s edge, then install WARP on the phone with the same Zero Trust team enrolment.
Where it falls short: The free 50-user tier is generous, but adding non-technical users needs the paid tier. Cloudflare sees the traffic.
Pricing: 50 users free (Zero Trust). Team from $7/user/mo.
Platforms: Android, iOS, Windows, macOS, Linux, ChromeOS.
Download: Google Play, App Store
Bottom line: The pick when the home server already lives behind a Cloudflare Tunnel.
5. Netbird – Best open-source Tailscale-style pick
Netbird is Tailscale for the people who want the coordinator to be open source. Client, control plane, and relay are all Go, all Apache 2.0, and all self-hostable. The managed cloud tier is optional. Setup on Android is the same login-plus-toggle as Tailscale.
Where it falls short: Fewer platforms than Tailscale. Ecosystem is younger.
Pricing: Free self-hosted. Cloud from $8/user/mo.
Platforms: Android, iOS, Windows, macOS, Linux.
Download: Google Play
Bottom line: The pick for self-hosters who want a fully open stack, coordinator included.
6. Twingate – Best for zero-trust rather than full VPN
Twingate exposes specific services rather than a whole network. Point Jellyfin, Home Assistant, and SSH at Twingate, and each service is reachable only for users the admin allows. From the phone, the client asks for auth per resource.
Where it falls short: Access model is more restrictive than a mesh VPN; that is by design. Overkill for a personal server.
Pricing: Free tier (2 admins, 5 devices). Business from $10/user/mo.
Platforms: Android, iOS, Windows, macOS, Linux.
Download: Google Play
Bottom line: The pick when the home server hosts services for a small team, not just yourself.
7. OpenVPN Connect – Best classic client for pfSense and OPNsense
OpenVPN Connect is the official client for classic OpenVPN setups. If the home router already runs pfSense, OPNsense, or a home lab OpenVPN server, this app slots in without adding another vendor.
Where it falls short: WireGuard is faster, uses less battery, and needs less setup. OpenVPN is legacy tech now.
Pricing: Free.
Platforms: Android, iOS, Windows, macOS, Linux.
Download: Google Play, App Store
Bottom line: The pick only when the network already speaks OpenVPN and switching is not on the table.
8. Pangolin (via WireGuard) – Best fully self-hosted reverse tunnel
Pangolin is a self-hostable reverse tunnel platform. It gives you Cloudflare-Tunnel-style ingress without Cloudflare. On the phone, it looks like a WireGuard config with an ID that Pangolin’s admin dashboard hands out.
Where it falls short: No first-party Android app. You install the WireGuard client and paste the Pangolin config.
Pricing: Free, open source.
Platforms: Android via WireGuard.
Download: WireGuard on Android + Pangolin server
Bottom line: The pick for people who like Cloudflare Tunnel’s design but want the ingress plane on their own hardware.
How to pick the right one
- If you have never done this: install Tailscale. Ten minutes to full remote access.
- If you want the same feel and open-source-only: Netbird.
- If you already use Cloudflare for DNS or the site: Cloudflare Zero Trust + WARP.
- If you like the “same LAN everywhere” model: ZeroTier One.
- If you already run OpenVPN: OpenVPN Connect.
- If you host services for a small team: Twingate.
- If a raw WireGuard config is what you want to manage: the WireGuard app.
FAQ
What is the easiest way to access a home server from Android behind CGNAT?
Tailscale. Install on the home server and the phone, sign in on both, and the phone reaches the server by hostname.
Do I need to open ports on my router for Tailscale?
No. Tailscale, ZeroTier, Netbird, and Cloudflare Tunnel all establish outbound connections and punch through NAT.
Which of these are open source?
WireGuard is fully open source. Tailscale, ZeroTier, and Netbird publish client and daemon source; Tailscale and ZeroTier keep the coordinator closed unless you self-host Netbird or Tailscale’s Headscale alternative.
Will these apps drain my phone battery?
Modern WireGuard-based clients (Tailscale, WireGuard, Netbird) are very light. OpenVPN Connect uses more power. Split tunneling helps in every case; only route the home subnet through the VPN.
Can I run more than one of these at once?
Only one Android VPN slot is available at a time. Pick one primary and use the phone’s Private DNS or Cloudflare 1.1.1.1 mode for DNS-only cases.
