VPN access
Hiras is a local-network gateway — by default, only devices on the same Wi-Fi can reach it. If you want to call it from somewhere else, the answer is a VPN that puts your remote device on the same private network as the phone. Hiras is built to work with one you already run — it does not install, configure, or manage any VPN itself.
Detect-and-list, not managed
If you’re already running a private network — Tailscale, WireGuard, ZeroTier, or similar — Hiras detects the VPN interface on the phone and lists its address as a second reachable endpoint, labelled Private Network, alongside the usual Local Network address. Each has its own Copy button and QR code, so pointing a remote client at the gateway is the same one-step setup as on the LAN.
That’s the whole feature: detect the interface, surface the address. Hiras never sets a VPN up for you, and it is deliberately generic — endpoints are labelled by category, never by product name. This is best-effort, with no compatibility guarantee. You own the VPN; Hiras just tells you the address to use.
Why it works
Hiras treats these address ranges as private, and will serve requests that arrive on them:
- RFC 1918 —
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 - RFC 6598 (carrier-grade NAT) —
100.64.0.0/10 - Link-local —
169.254.0.0/16
Tailscale and similar overlays hand out addresses in the 100.64.0.0/10 range, which is why a
peer on your tailnet can connect. Note that a CGNAT-range address is only advertised as reachable
when it sits on a recognised VPN interface — an ordinary cellular link carrying a 100.x address is
never listed as an endpoint.
What it is not
- Not a cloud relay. Traffic never routes through any server Hiras operates — the VPN is yours, end to end.
- Not public exposure. The gateway is never put on the open internet; the local-network guard still rejects any non-private address.
- Not a setup guide. Configuring Tailscale, WireGuard, or ZeroTier is out of scope — follow your VPN’s own documentation, then let Hiras surface the address.
Next
- Security — the network guard that makes this safe.
- Configuration — what else you can change.