Device Interconnect: No Public IP, No Port Mapping Hassles, Securely Directly Connect Your Devices Anywhere

Have you ever encountered this situation:

You have Claude Code running a task on your office development machine, and when you step out and want to check in via your phone or home computer—only to find you can't connect at all. That machine has no public IP, hidden behind a router; opening port mappings feels insecure and requires fiddling with the router; using frp, Peanut Shell, or similar intranet penetration tools means complex configuration and renting a server.

Device Interconnect is designed to solve this: In the PandaNpc desktop client, click "Enable Device Interconnect," and this device joins your own private encrypted virtual network. From then on, all your devices have a fixed private IP (e.g., 100.64.0.2), and no matter where they are or whether they have a public IP, they can directly connect to each other as if they were on the same local network.

1. Why You Need Device Interconnect

• 🏠 Access your home/office machines from outside: Your phone or laptop is on an external network, while your home development machine is on an intranet. You want to connect back to use Claude Code, SSH, or check internal services—Device Interconnect makes them mutually reachable.
• 🔌 Say goodbye to port mapping and public exposure: No need to open ports on your router or expose services to the public—zero attack surface.
• 🧩 No server, no complex configuration: Unlike frp, you don't need to rent a server with a public IP or write forwarding rules. Just click to enable, and you have a fixed private IP.
• 🔒 Encrypted at every hop: Traffic between devices is end-to-end encrypted; no one in between can see the content.

2. How It Works

Device Interconnect is built on a self-hosted WireGuard virtual network (the same technology as Tailscale):

• Each device, upon joining, is assigned a stable private IP (100.64.x.x range) by the control plane. This IP follows the device and doesn't change with the network environment.
• Devices prioritize direct connections: NAT traversal establishes peer-to-peer encrypted tunnels between two machines, with data never passing through any third party.
• In rare cases where NAT traversal fails (e.g., symmetric NAT), it automatically falls back to a relay to ensure connectivity at all times.
• End-to-end encryption via WireGuard throughout; the control plane only coordinates "who can connect to whom" and cannot see your data.

In a nutshell: You get a private network that belongs only to you, is encrypted, and is reachable anytime, anywhere.

3. How to Enable: One Click in the Desktop Client

On a machine with the PandaNpc desktop client (Windows / macOS / Linux), enabling it takes just one step:

Open the client → Settings → Connected Devices → Click "Enable Connected Devices."

Once you click, the client does everything automatically: downloads and installs the background networking component, registers this machine with your account, and joins the network. The first time you enable it, it will request system administrator authorization (needed to install the background network service). After that, it's fully automatic and usually completes within seconds.

After successfully joining, the status card will show Joined, along with this machine's private IP—click to copy and use it to connect from other devices:

Tips:

• Auto-pairing after login: When the client starts for the first time, the component is silently installed in the background. After logging in, pairing and joining happen automatically. In most cases, you don't even need to manually click the toggle.
• Remove anytime you want: On the same page, click "Remove Connected Devices" to stop the networking service on this machine (the installation remains; re-enabling is instant—no need to re-download).

4. Managing All Your Devices

After joining, below the settings page (or via a browser at pandanpc.com/devices) you'll find your device management panel. Both show the same content:

Here you can:

• 🟢 View online status: A green dot means the device is online—see at a glance which ones are available.
• 📋 Copy private IP: Click the 100.64.x.x IP of any device to copy it, then use it directly for SSH or accessing services.
• 💻 Identify system type: Icons for Windows / macOS / Linux make it clear.
• ✏️ Rename devices: Give devices recognizable names like "Office Windows PC" or "Home Server."
• 🗑️ Revoke devices: If you no longer need a device, revoke it with one click—it disconnects immediately and cannot rejoin.

5. Servers and Headless Devices: Unattended Joining with Auth Keys

For machines without a GUI—such as a home NAS, cloud server, or development container—use Auth Keys to join the network.

In the device management page, under the Auth Keys section, click "New key" to generate a key:

When generating, you can configure:

• Reusable: One key for multiple machines; if unchecked, it's a one-time key that becomes invalid after first use.
• Expires in: Leave blank for permanent validity, or set it to expire after a certain number of days.
• Description: Note which machine this key is for.

⚠️ The key plaintext is shown only once during generation—make sure to copy it immediately.

Then install the networking component on the target machine and join using the key:

macOS / Linux:

curl -fsSL https://cos.pandanpc.com/pandapaw/install.sh | sh
pandanet up --authkey=pnkey-xxxxxxxx

Windows (PowerShell):

iwr -useb https://cos.pandanpc.com/pandapaw/install.ps1 | iex
pandanet up --authkey=pnkey-xxxxxxxx

To set it up as a persistent service that starts on boot (recommended for servers): write the key into the auth_key field of pandanetd.yaml, then run pandanet install. It will automatically join on boot, and you won't need to manage it afterward.

Alternatively, without a key: simply run pandanet up. It will print an authorization link. Open it in a browser, log in to your PandaNpc account, and click "Approve"—the device will join the network.

6. Configuration Options

All Device Interconnect-related settings are centralized in Settings → Connected Devices:

7. Typical Use Cases

With a fixed private IP, you can:

• Remotely access Claude Code on your device: Connect to a running session on your development machine from another device to continue controlling it—the machine keeps working even when you're away.
• SSH from anywhere: ssh user@100.64.0.2, regardless of whether the machine is at the office or home.
• Access internal services: Web services, databases, or NAS running on a machine can be accessed directly via the private IP, without exposing them to the public internet.
• Combine with remote desktop control: After enabling "Allow Remote Control of This Machine," your AI sessions can remotely operate that machine's desktop.

8. Security Notes

• End-to-end encryption: Traffic between devices is encrypted with WireGuard; the control plane cannot see the content.
• Zero public exposure: No public ports are opened; services are only reachable within your private network.
• Connect only to your own devices: The network is isolated per account. Auth keys belong to your account; other people's devices cannot enter your network. When approving a device via browser, you're prompted to verify the device name.
• Revocable at any time: Any device or key can be revoked with one click on the management page, taking effect immediately.
• Coexists with existing tools: Having Tailscale or similar tools installed on the same machine is fine—they won't interfere with each other.

Summary

Device Interconnect simplifies the headache of "accessing your own machines from outside" into a single click in the client: no public IP, no port mapping hassles, no need to rent a relay server—you get an end-to-end encrypted, always-reachable private network. Desktop devices can enable it with one click; servers can join unattended using auth keys; all devices are managed in one unified page. Combined with remote access to Claude Code and remote desktop control, your development machine truly becomes a "work anywhere, connect back anytime" tool.