Checking sign-in…

PME

How it works

What you already have at home

Most homes already run a small private network behind a router. On that LAN you might have a NAS with family photos, a printer, security cameras, a Plex or Jellyfin server, Home Assistant on a Raspberry Pi, or a PC you leave on for backups. When you are on home Wi‑Fi, those devices just work.

The gap appears when you leave the house — or when someone else needs access: a partner at work, a parent in another city, a friend you want to share a folder with. They are not on your LAN, and your router does not magically expose one device without opening the whole network or fiddling with port forwards.

PME Edge architecture — lan At home — your LAN Useful devices — usually only reachable while you are on Wi‑Fi. WAN / Internet Home router 192.168.1.1 NAS 192.168.1.50 Printer 192.168.1.20 Cameras 192.168.1.30 Media server 192.168.1.40 PC / server 192.168.1.10 Home Assistant 192.168.1.60 whole subnet 192.168.1.0/24 You at home → works fine Family or friends away → no path in

PME Edge on your LAN

PME Edge is one program you run on an always-on Mac, PC, or Linux box at home. It includes a WireGuard VPN server and a local console where you sign in, register with PME Server, and create invitations.

For each invite you choose Allowed IPs — only the NAS at 192.168.1.50/32, a printer, or a whole subnet. PME Edge routes VPN traffic to exactly those targets. Your files and app data stay on the LAN; Edge is the controlled gateway you operate.

PME Edge architecture — edge At home — your LAN Same network — now with a gateway you control. WAN / Internet WireGuard tunnel from away Home router 192.168.1.1 encrypted tunnel through router → Edge PME Edge one always-on Mac / PC / Linux on your LAN WireGuard VPN tunnel ends here PME agent UI · invites · register routes VPN traffic → Allowed IPs you choose NAS 192.168.1.50 Printer 192.168.1.20 Home Assistant 192.168.1.60 or subnet .1.0/24 Tunnel arrives at Edge — files stay on the LAN Next: PME Server coordinates accounts & invites

PME Server — accounts and invites

PME Server on the web handles account sign-up, binding an invite to an email address, and (with Mesh Pro) billing. PME Edge connects outbound to the server over a secure WebSocket — no inbound firewall hole for management traffic.

Invitees use the PME Server to open your invite link, sign in or create a PME account, and receive a WireGuard profile (QR code or file). The server coordinates; it does not store your NAS contents or proxy your app traffic.

PME Edge architecture — web At home Your LAN — data stays here PME Edge creates invites · routes Allowed IPs outbound only → NAS …devices not uploaded to PME secure WSS On the web — PME Server Coordinates — never stores LAN payloads PME Server accounts · invite links · billing What an invitee does here 1. Open invite link 2. Sign in / create account 3. Get WireGuard QR or file PME Server binds the invite to a person — your NAS content never leaves home through this path

PME Relay

PME Relay gives remote invitees a public WireGuard endpoint that they can dial from anywhere. Locally, from within your LAN, PME Edge connects to the same relay to send and receive traffic over the WireGuard tunnel. This makes it so your router does not need a UDP port forward for remote sharing.

The relay forwards already-encrypted WireGuard packets between the invitee and your Edge. It cannot read your traffic. Once the tunnel is up, packets flow through the relay hop and land on PME Edge, which routes them to exactly the Allowed IPs you set on the invite.

PME Edge architecture — relay Why remote access needs a relay Home routers often block inbound UDP — so the invitee cannot dial your WireGuard port directly Invitee phone / laptop WireGuard app WireGuard PME Relay public WireGuard endpoint encrypted packets only outbound PME Edge at home on your LAN NAS … Allowed IPs only What to remember • Invitee connects to PME Relay — not your home IP • Relay forwards encrypted WireGuard packets only — it cannot read your traffic • Edge reaches the relay outbound — no UDP port forward on your router

The full picture

The point is a single path: an encrypted WireGuard tunnel from someone remote — you away from home, or a person you invited — flowing down into your LAN and landing on the resource you chose to share. A NAS at 192.168.1.50, a printer, Home Assistant, or any Allowed IP you set on the invite.

PME Edge terminates the tunnel at home and forwards only to those IPs. PME Server (accounts, invites, and PME Relay when needed) provides the public WireGuard hop when the remote side cannot reach your home address directly. Day-to-day access to your files and apps stays inside the tunnel.

PME Edge architecture — full Tunnel in — straight to what you shared Remote phone or laptop · WireGuard on PME Server accounts · invites · WireGuard Relay public hop when remote cannot reach home IP At home — your LAN Home router PME Edge WireGuard tunnel ends here · routes Allowed IPs NAS 192.168.1.50 — your LAN resource Your files reach the LAN resource through the tunnel — not the web app

Requirements