Checking sign-in…

PME

Getting Started

Follow these seven steps in order. Each panel tells you exactly what to do — on your LAN, on PME Server, or both.

1 — Discover

Where: this site

Before you install anything, understand the pieces: PME Edge runs on an always-on machine on your home LAN; PME Server on the web handles accounts and invites; invitees connect with a normal WireGuard app.

PME Edge architecture — lan At home — your LAN Useful devices — usually only reachable while you are on Wi‑Fi. WAN / Internet Home router 192.168.1.1 NAS 192.168.1.50 Printer 192.168.1.20 Cameras 192.168.1.30 Media server 192.168.1.40 PC / server 192.168.1.10 Home Assistant 192.168.1.60 whole subnet 192.168.1.0/24 You at home → works fine Family or friends away → no path in

Do this:

  1. Skim How it works for the full path (Edge → Server → Relay → invitee)
  2. Confirm your host meets Requirements (always-on LAN machine)
  3. Optional: check Pricing if you care about Mesh Pro / relay later

2 — PME account

Where: PME Server (web)

Create your account on PME Server. Accounts and invite links live here — not on your home machine. You will use the same email and password when you register Edge in step 4.

Do this:

  1. Open PME Server and create an account (or sign in if you already have one)
  2. Optional: open the Setup wizard after sign-in — it tracks register → relay → invite progress from your account

Create PME account

3 — Install PME Edge

Where: always-on machine on your home LAN

Download and run PME Edge on the Mac, Linux box, or mini PC that stays powered on your LAN. Edge includes the WireGuard VPN server and the local console where you create invites.

PME Edge architecture — edge At home — your LAN Same network — now with a gateway you control. WAN / Internet WireGuard tunnel from away Home router 192.168.1.1 encrypted tunnel through router → Edge PME Edge one always-on Mac / PC / Linux on your LAN WireGuard VPN tunnel ends here PME agent UI · invites · register routes VPN traffic → Allowed IPs you choose NAS 192.168.1.50 Printer 192.168.1.20 Home Assistant 192.168.1.60 or subnet .1.0/24 Tunnel arrives at Edge — files stay on the LAN Next: PME Server coordinates accounts & invites

Do this:

  1. Get the binary for your OS from ws-edge releases (or follow the full walkthrough on Download)
  2. Install OS deps first — macOS (Homebrew wireguard-tools, dnsmasq, sudoers) or Ubuntu (wireguard, dnsmasq, nftables)
  3. Start Edge with relay enabled: 
    PME_RELAY_ENABLED=true edge run
  4. Open the local UI: http://127.0.0.1:9191

Stuck? See troubleshooting — install.

4 — Register with PME

Where: Edge UI on your LAN → PME Server

Link this Edge node to your PME account. Edge connects outbound over a secure WebSocket — you do not open an inbound firewall port for management.

PME Edge architecture — web At home Your LAN — data stays here PME Edge creates invites · routes Allowed IPs outbound only → NAS …devices not uploaded to PME secure WSS On the web — PME Server Coordinates — never stores LAN payloads PME Server accounts · invite links · billing What an invitee does here 1. Open invite link 2. Sign in / create account 3. Get WireGuard QR or file PME Server binds the invite to a person — your NAS content never leaves home through this path

Do this:

  1. In the Edge UI at http://127.0.0.1:9191, sign in with the same email/password as PME Server
  2. Tap Register with PME Server
  3. Confirm the control stream is connected — Edge logs, the Edge dashboard, or the PME Setup wizard

Stuck? See troubleshooting — register.

5 — PME Relay (remote access)

Where: Edge + PME Relay

Many home routers block inbound UDP, so invitees on cellular cannot dial your WireGuard port directly. PME Relay gives them a public endpoint; Edge reaches that relay outbound. No UDP port forward on your router.

PME Edge architecture — relay Why remote access needs a relay Home routers often block inbound UDP — so the invitee cannot dial your WireGuard port directly Invitee phone / laptop WireGuard app WireGuard PME Relay public WireGuard endpoint encrypted packets only outbound PME Edge at home on your LAN NAS … Allowed IPs only What to remember • Invitee connects to PME Relay — not your home IP • Relay forwards encrypted WireGuard packets only — it cannot read your traffic • Edge reaches the relay outbound — no UDP port forward on your router

Do this:

  1. Start (or restart) Edge with PME_RELAY_ENABLED=true — env var, or /etc/default/edge on systemd
  2. In the Edge dashboard, confirm relay connected
  3. After you create an invite (next step), test from cellular or another network — not home Wi‑Fi

New accounts include a 30-day relay trial; keep remote access afterward with Mesh Pro. Stuck? See troubleshooting — PME Relay.

6 — First invitation

Where: Edge UI → send link → invitee on PME Server

Create a VPN invite and choose Allowed IPs — only those routes are reachable over the tunnel. Example: a NAS at 192.168.1.50/32, a printer, or your home subnet.

Do this:

  1. In the Edge UI → Invitations → create a VPN invite
  2. Set Allowed IPs to the LAN devices or subnets you want to share
  3. Copy the invite link and send it (email, chat, etc.)
  4. Ask the invitee to open the link on PME Server, sign in or create an account, and complete WireGuard setup

Stuck? See troubleshooting — invite.

7 — Invitee success

Where: invitee’s phone or laptop

Success means the invitee has VPN on and can reach only what you allowed — for example the NAS web UI or a shared folder — while the rest of your LAN stays private.

PME Edge architecture — full Tunnel in — straight to what you shared Remote phone or laptop · WireGuard on PME Server accounts · invites · WireGuard Relay public hop when remote cannot reach home IP At home — your LAN Home router PME Edge WireGuard tunnel ends here · routes Allowed IPs NAS 192.168.1.50 — your LAN resource Your files reach the LAN resource through the tunnel — not the web app

Ask your invitee to:

  1. Open the invite link and create or sign in to their PME account
  2. Complete WireGuard setup (scan the QR or import the config file)
  3. Turn the VPN on in the WireGuard app
  4. Open the shared service (hostname or IP you gave them) over the tunnel

If something fails, start with Troubleshooting or walk through How it works again.