Watch your cameras from anywhere — without opening a port or trusting a cloud

A self-hosted NVR is wonderful at home. But the first question everyone asks is: how do I check my cameras when I am not on the network?

There are usually two bad answers. The first is port forwarding — exposing your NVR's web interface to the open internet so you can reach it from outside. That turns your camera system into a target every scanner on the planet will eventually find. The second is the cloud — let a company relay your video through their servers, which is exactly the arrangement a self-hosted system exists to avoid.

Calyston takes a third path.

Remote access over a private mesh, not the open internet

Instead of building its own cloud relay, Calyston works with Tailscale — a mesh VPN built on WireGuard. You install it on your Calyston box and on your phone or laptop, and the two join the same private network (a "tailnet"). From then on, your devices can talk to each other directly, with end-to-end encryption, no matter where they are.

What that buys you:

• No ports to forward. Nothing about your NVR is exposed to the public internet. There is no open door to find.
• No cloud in the middle of your video. The connection is a direct, encrypted tunnel between your devices. Your footage is not stored on, or readable by, anyone else's servers — the same guarantee you get on your LAN, extended to wherever you are.
• A real certificate, no warnings. On your tailnet you reach Calyston by a proper hostname over HTTPS — none of the self-signed-certificate clicking you get on a bare LAN address.

This is the difference that matters versus a cloud camera. With Ring or Nest, "remote viewing" means your video lives on their infrastructure so they can show it to you. With Calyston and Tailscale, remote viewing is a private line to the box on your shelf. Nobody else is in the path.

It is also the difference versus the "easy remote access" some other NVRs bundle in. Those usually route your video through the vendor's own relay servers, so your privacy comes down to trusting a promise that they don't look at or log what passes through. A private mesh removes the promise entirely: there is no relay to trust, because the vendor — us included — is simply never in the path.

How it works in Calyston

Calyston is read-only about your tunnel. It never installs, starts, stops, or reconfigures Tailscale — it simply notices when a tunnel is up and shows you the address to use. You stay in control of the VPN; Calyston just makes it convenient.

The setup is short:

1. Install Tailscale on your Calyston server and bring it online:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Follow the login link to add the machine to your tailnet.

2. Install Tailscale on your phone or laptop and sign in to the same account.

3. Open Calyston. The remote-access card now lights up with your remote URL. Tap it from anywhere you are signed in to your tailnet, and you are looking at your cameras — securely, over the encrypted tunnel.

That is the whole thing. No firewall surgery, no dynamic-DNS service, no exposing your recorder to strangers.

A note on tiers

Remote access is a Pro feature. Community (the free tier) runs entirely on your local network, which is the right default — it keeps the free product genuinely useful and genuinely private out of the box. When you want to reach your cameras from the road, Pro turns it on, and the heavy lifting is handled by a tunnel you own.

You are not locked in

Because Calyston only observes the tunnel rather than managing it, you are free to run things your way. Prefer to run your own coordination server instead of Tailscale's hosted one? A self-hosted control plane (Headscale) speaks the same protocol, and broader provider support is on the roadmap. The principle does not change: the path to your video is yours, encrypted end to end, with no third party in the middle.

Your cameras, your hardware, your footage — now reachable from anywhere, on your terms.

Get Calyston Community free →