Menu

Reach your home services from your phone. No open ports.

Keena connects your phone to the services on your home network — your NAS, your dashboards, your smart home — through an end-to-end encrypted WireGuard tunnel. Your router stays closed. Your keys stay on your phone.

Get started free How it works

Free for 2 devices, 1 connector and 5 services. No password. No email.

Keena app Connection tab: Connected, Direct, with a byte counter and two services, hello.homelab.keena and nas.home.keena, each with an Open button.
Connect, and see whether the path is direct or relayed.

How it works

A small connector runs next to your services. Your phone runs the Keena app. Keena brings them together — and then gets out of the way.

How Keena connects your phone to your service Your home network Direct · WireGuard, end-to-end encrypted Relay · still end-to-end encrypted outbound only Your phoneKeena app Keena controllerintroduces, never carries traffic Encrypted relayonly if direct fails RouterNo open ports ConnectorDocker container Your servicenas.home.keena How Keena connects your phone to your service Your home network Direct · WireGuard, end-to-end encrypted Relay · still end-to-end encrypted outbound only Your phoneKeena app Keena controllerintroduces, never carries traffic Encrypted relayonly if direct fails RouterNo open ports ConnectorDocker container Your servicenas.home.keena
  1. Your phone and your connector each connect out to Keena. Keena introduces them. Your router stays closed.
  2. They connect directly, peer to peer, over WireGuard. Only your phone and your connector can read the traffic.
  3. If a network blocks the direct path, an encrypted relay carries the packets. The relay cannot read them.

Set up in three steps

  1. Install the Keena app

    Get the Android app. It creates your keys on your phone. They never leave it.

    Download

  2. Run one command on your server

    Add a connector at keena.network, approve it on your phone, and paste one Docker command on any Linux machine at home.

    docker run -d --name keena-homelab … ghcr.io/ehanoc/keena-connector

    Example. The Connectors page gives you the full command.

  3. Open your service

    Tap Connect in the app, then open nas.home.keena in your phone's browser.

Why Keena

No open ports

The connector only makes outbound connections. Nothing on your router changes, and it works behind CGNAT.

Your keys, on your phone

One recovery phrase creates your identity. The website never holds your keys.

Approve every change

Adding a connector or a service needs your fingerprint on your phone.

Direct when possible

Your phone and your connector talk peer to peer. A relay helps only when a network blocks the direct path, and it sees encrypted data only.

Only what you share

Your phone reaches the services you add, not your whole home network.

Sign in with a passkey

Sign in to keena.network with your fingerprint through the Keena app. No password to leak.

See it in action

Keena app Connection tab: Connected, Direct, with a byte counter and two services, hello.homelab.keena and nas.home.keena, each with an Open button.
Connect, and see whether the path is direct or relayed.
Keena app asking: Add resource nas.home.keena on connector homelab? with Approve and Cancel buttons.
Every change is approved on your phone.
keena.network Connectors page: connector homelab, Online, with the services hello.homelab.keena and nas.home.keena.
Manage connectors and services at keena.network.

For small teams

Today Keena is for one person: you, your phone and your home network. Team features are next.

  • Invite people to your network Coming
  • Choose who can reach which service Coming
  • More devices and connectors (paid plans) Coming
  • Desktop apps for Linux, macOS and Windows Coming
  • iPhone app Coming

Pricing

Free

$0

  • 1 user
  • 2 devices
  • 1 connector
  • 5 services
  • Direct and relay connections
Get started free

Premium

Coming soon

More devices, connectors and services.

Questions

Do I need to open ports on my router?

No. The connector and your phone both connect out. Nothing listens on your home's public address.

What do I need at home?

Any Linux machine with Docker (amd64 or arm64), for example a NAS, a mini PC or a Raspberry Pi 4. Debian and Fedora packages are available too.

Which phones work?

Android today. The iPhone app is coming.

Can Keena see my traffic?

No. Your traffic is encrypted end to end between your phone and your connector. The Keena controller only learns which device connects to which connector, and when. A relay, when used, carries encrypted packets only.

What if I lose my phone?

Restore your identity on a new phone from your recovery phrase or from the encrypted backup file the app can make.

What does it cost?

The free plan covers 2 devices, 1 connector and 5 services. Paid plans are coming.