fn-knockOne secure gateway for your HomeLab

Put your NAS, photo library, download stack, and self-hosted apps behind one gateway. Authenticate first, then connect—directly over a public IP or through FRP and Cloudflare Tunnel when you are behind CGNAT.

Start deploying

I have a public IP

I am behind CGNAT

One gateway, many self-hosted services

Route separate subdomains to your NAS and apps while managing sign-in, TLS, and access policies in one place.

Authenticate before reaching the service

Use TOTP, passkeys, passwords, or an external IdP, with sessions, IP allowlists, WAF rules, and request logs.

Fits your hardware and network topology

Deploy on fnOS, Docker, OpenWrt, Linux, Synology DSM, or Windows, with optional FRP and Cloudflare Tunnel connectivity.

First-time setup

Bring one service online in this order. Verify the complete path before onboarding the rest of your stack:

Choose fnOS, Docker, OpenWrt, Linux, Synology DSM, or Windows and complete the installation.
Match the access pattern to your home network: route subdomains over a public IP, or use FRP / Cloudflare Tunnel for NAT traversal.
Configure authentication. Keep a recoverable TOTP authenticator, then add a passkey or external identity provider if needed.
Onboard one test service, configure a TLS certificate, and verify the entire sign-in flow over a mobile connection.
Once the path is stable, use service discovery to onboard more services and export an application backup.

Do not leave a route that bypasses the gateway

fn-knock can protect only traffic that passes through it. If your router, container platform, or cloud firewall still exposes the NAS admin UI or an application's original port, those requests bypass fn-knock authentication, WAF rules, and request logging.

Continue from your current setup

Not installed yet or unsure which package to use: start with deployment and access patterns.
A public IPv4 or IPv6 address is available: point your domain at fn-knock and follow public-IP subdomain routing.
Behind CGNAT or inbound traffic is blocked: use FRP or Cloudflare Tunnel and follow the NAT traversal guide.
A client must connect on the application's original port: first verify that the platform supports direct original-port access.
Sign-in, TLS, or reverse proxying is not working: use the FAQ and troubleshooting guide.
Planning an upgrade, migration, or reinstall: read backup, restore, and data cleanup first.