Remote Access

The dashboard is built for your local network. To reach it while you are away, put the board on a private network that you already trust. This page shows four common ways to do that. All four work without opening or forwarding a port to the board.

Exaviz supports reaching the dashboard over your local network, Tailscale and WireGuard. ZeroTier and Cloudflare Tunnel are third-party options that Exaviz does not officially support; they are described here for convenience, and their own documentation is the reference.

Before You Start

• Change the default password. The dashboard makes you do this at first login. See Getting Started.
• Have shell access to the board. Each option installs a small piece of software on the board itself, so you need SSH or a keyboard and monitor.
• ZeroTier and Cloudflare Tunnel are third-party options that Exaviz does not officially support. The supported paths are your local network, Tailscale and WireGuard.
• The software below is not made by Exaviz. Each option needs an account or a server of your own with that provider. Exaviz receives no keys, accounts or traffic from any of them.

The board runs a Debian-based system (Debian, Raspberry Pi OS or Ubuntu) on 64-bit Arm. Use each provider’s instructions for the same system and 64-bit Arm.

The Remote Access Card

The dashboard has a Remote Access card that shows, for this board:

• Tailscale - whether it is installed and connected, the board’s tailnet address and name, when its key expires, and an Open over Tailscale link. If Tailscale is not installed, an Install Tailscale button installs it after you confirm. The install only adds the software; you still sign in with sudo tailscale up (see below). If an install fails, the card shows the step it stopped at, and the system journal on the board has the full output.
• WireGuard - each WireGuard interface on the board, whether it is up, the time of its last handshake, and an Open over WireGuard link. If there is no interface, the card says so; one appears once you create it with wg-quick or netplan.

The card only reads the board’s state. It never signs in to Tailscale and never shows an account, a peer, or a key. It does not cover ZeroTier or Cloudflare Tunnel.

Which Option to Choose

Tailscale, WireGuard and ZeroTier connect your phone or laptop to the board as if they were on the same network. Cloudflare Tunnel publishes the dashboard at a web address and relies on Cloudflare Access to keep strangers out.

Tailscale

1. Install Tailscale on the board, either with Install Tailscale on the Remote Access card or with Tailscale’s Linux install guide.

2. Connect the board to your tailnet:

   sudo tailscale up
   

   Open the login link it prints and approve the board.

3. Find the board’s Tailscale address:

   tailscale ip -4
   

4. In the Tailscale admin console, disable key expiry for the board. Keys expire after 180 days by default, and an expired board drops off your tailnet until someone logs in on it locally.

5. Install Tailscale on your phone or laptop and sign in to the same account.

6. Browse to https://<tailscale-address>.

If MagicDNS is on in your tailnet, you can also use the board’s machine name in place of the address.

WireGuard

WireGuard needs one side of the connection to have a UDP port that the other side can reach. Put that side on your firewall (many business firewalls include a WireGuard server) or on a server you control. The board connects out to it, so nothing is forwarded to the board.

1. Install the WireGuard tools and create a key pair on the board:

   sudo apt install wireguard-tools
   sudo sh -c 'umask 077; wg genkey > /etc/wireguard/board.key'
   sudo cat /etc/wireguard/board.key | wg pubkey
   

   The last command prints the board’s public key. Add it as a peer on your WireGuard server with AllowedIPs = 10.8.0.2/32, the board’s address on the VPN subnet. The server must forward traffic between its peers (on a Linux server, net.ipv4.ip_forward=1), or your phone gets a handshake but the dashboard never loads.

2. Create /etc/wireguard/wg0.conf with owner-only permissions, then open it in an editor:

   sudo install -m 600 /dev/null /etc/wireguard/wg0.conf
   sudo nano /etc/wireguard/wg0.conf
   

   Enter this, with your own keys and addresses:

   [Interface]
   PrivateKey = <contents of /etc/wireguard/board.key>
   Address = 10.8.0.2/32
   
   [Peer]
   PublicKey = <your server's public key>
   Endpoint = <your server's address>:51820
   AllowedIPs = 10.8.0.0/24
   PersistentKeepalive = 25
   

   AllowedIPs lists only the VPN subnet, so the board’s own internet traffic is not sent through the tunnel. PersistentKeepalive keeps the connection open from the board’s side.

3. Start the tunnel and have it come back after a reboot:

   sudo systemctl enable --now wg-quick@wg0
   sudo wg show
   

   A recent “latest handshake” line in wg show means the tunnel is up.

4. Connect your phone or laptop to the same WireGuard server and browse to https://10.8.0.2.

Use your own subnet in place of 10.8.0.0/24. On Cruiser, avoid 10.100.0.0/16, which the PoE ports use.

ZeroTier

ZeroTier is a third-party service that Exaviz does not officially support.

1. Create a network in ZeroTier Central and note its network ID.

2. Install ZeroTier on the board using ZeroTier’s download page (Linux instructions).

3. Join the network:

   sudo zerotier-cli join <network-id>
   

4. In ZeroTier Central, authorize the board. Keep the network set to Private so that every new device needs your approval.

5. Find the board’s ZeroTier address:

   sudo zerotier-cli listnetworks
   

6. Install ZeroTier on your phone or laptop, join the same network, authorize it, and browse to https://<zerotier-address>.

Cloudflare Tunnel

Cloudflare Tunnel is a third-party service that Exaviz does not officially support.

Cloudflare Tunnel makes an outbound connection from the board to Cloudflare and serves the dashboard at a hostname on your domain. Unlike the other three options, that hostname can be reached from the internet. Set up Cloudflare Access first, before the hostname exists.

1. In the Cloudflare dashboard, go to Networking > Tunnels and create a tunnel. Cloudflare shows the command to install cloudflared on the board. Choose the option that matches your system (Debian or Ubuntu) and 64-bit Arm.
2. Create a Cloudflare Access application for the hostname you will use (for example board.example.com), with a policy that allows only your own email address or identity provider group.
3. Add that public hostname to the tunnel with:
   • Service URL: https://localhost:443
   • Disable TLS certificate verification: on. The board uses a self-signed certificate by default, so cloudflared must not reject it.
4. Open https://board.example.com in a private browser window. You should see the Cloudflare Access sign-in page before the dashboard login. If you see the dashboard login straight away, remove the hostname from the tunnel and fix the Access application first.

Three things change when you use a tunnel:

• Cloudflare sees the traffic. Cloudflare decrypts the connection at its edge, so it can see what passes between your browser and the dashboard, including your dashboard password. With the other three options, your browser’s HTTPS connection runs all the way to the board.
• Audit log addresses. Every request reaches the dashboard from cloudflared on the board itself, so the audit log records the loopback address (such as 127.0.0.1) for remote logins.
• Login rate limit. The login rate limit counts attempts per address, so all tunnel users share one limit. Cloudflare Access is what keeps strangers from reaching the login page at all.

Certificate Warnings

Over Tailscale, WireGuard and ZeroTier, your browser shows the same self-signed certificate warning it shows on your local network. To replace it, see Security and TLS.

Fleet View

Fleet discovery uses mDNS, which only reaches boards on the same local network. Remote access gives you each board’s own dashboard. See Fleet Management for how discovery works.

Troubleshooting

• The page does not load. Check that the VPN is connected on both ends: tailscale status, sudo wg show or sudo zerotier-cli listnetworks on the board. Then make sure you are using the board’s VPN address, not its local IP.
• The board’s .local name does not resolve. mDNS names do not cross a VPN. Use the VPN address, or your provider’s DNS name if it has one.
• Cloudflare shows a 502 error. Check that the Service URL is https://localhost:443 and that Disable TLS certificate verification is on.

Last modified October 18, 2026