Remote Access to Your 3D Printer: Klipper & OctoPrint Without a Public IP

Remote access to a 3D printer means watching the webcam, checking temperatures, and controlling prints through Fluidd, Mainsail, or OctoPrint from anywhere with an internet connection. This guide covers the approaches that actually work when your ISP hides you behind CGNAT: from the free peer-to-peer ZeroTier network to a fully private tunnel on a cheap VPS with HTTPS and a password.

It's written for Klipper machines — DIY builds on a Raspberry Pi as well as factory printers like QIDI or rooted Creality K-series — and for OctoPrint too. The scheme is always the same: the web interface runs on the printer's host computer, and our job is to reach it from outside safely.

Why Direct Access Fails: CGNAT and Shared IPs

Most home ISPs put you behind CGNAT: due to the IPv4 shortage, dozens of subscribers share one public address. Incoming connections never reach your router, so classic port forwarding simply can't work. A dedicated static IP is sold separately — in Russia it's roughly 150–250 ₽ a month depending on the ISP — but it doesn't solve the real problem: exposing the printer's web interface without protection is a terrible idea, and we'll show why below.

Tailscale, the usual answer in English-language guides, is no longer an option for Russian users: since September 2023 its package repository returns HTTP 451 "Unavailable For Legal Reasons" to Russian addresses, and since October 2, 2024 the login itself is blocked: issue #13648 — "control plane is no longer accessible from within Russia" — is still open.

That leaves three working paths: a hosted service (Obico, OctoEverywhere, the Russian EZH-Print), a peer-to-peer network between your own devices (ZeroTier), or a tunnel to your own server (frp or SSH on a rented VPS). Let's go through all three — with prices and honest trade-offs.

Comparing the Options: Price, Effort, Features

Our pick if you want control and predictability is the frp tunnel on your own VPS: no service-imposed traffic caps, the webcam just works, the URL is yours, and the only bill is the server itself. The step-by-step setup is below. If you'd rather skip the terminal entirely, start with ZeroTier or Obico Free.

What You'll Need

• A Klipper printer with Mainsail or Fluidd (or OctoPrint) and SSH access to its host — a Raspberry Pi, Orange Pi, or the built-in board
• A VPS with a public IP — the cheapest 1 GB RAM plan is enough, frp is extremely light
• A domain or subdomain for HTTPS — optional, but it gets you a proper certificate and a browser password prompt
• Half an hour to an hour and basic terminal skills
• For the ZeroTier route — just an account at zerotier.com and the phone app
• For self-hosted Obico — a server with 4 GB RAM (covered in a companion article, linked below)

We use AdminVPS — data centers in Russia, payable with Russian cards. The sweet spot for this guide is the Promo plan: 429 ₽/mo for 1 core at 3.6 GHz, 2 GB RAM, and 30 GB NVMe with free weekly backups. With promo code ph-60 the first month comes to about 172 ₽ (60% off, monthly billing, one-time use; the code doesn't apply to Lite plans). A bare frp tunnel would run fine on Lite at 299 ₽, but Promo's 2 GB RAM leaves headroom for the future; the self-hosted Obico server from the companion article will need Micro with 4 GB RAM (799 ₽).

The frp Tunnel: Your Server, Your Rules

frp (fast reverse proxy) is an open-source project with 108k GitHub stars; the current release v0.70.1 shipped in July 2026. The idea is simple: the frpc client on the printer's host opens an outbound connection to the frps server on your VPS and keeps it alive. Incoming requests hit the VPS and ride down that tunnel — so CGNAT at home doesn't matter at all. The frpc↔frps channel is encrypted: TLS has been on by default since v0.50.0.

Step 1. Install frps on the VPS

Generate the token with openssl rand -hex 32 and keep it identical on both ends. Without a token, any stranger's frpc client that finds your port 7000 with a scanner can register its own tunnels on your server. proxyBindAddr = "127.0.0.1" hides port 8080 from the internet: until step 3 the printer UI is only reachable from the VPS itself — exactly what we want.

Step 2. Install frpc on the Printer Host

localPort = 80 is where the host's nginx serves Fluidd or Mainsail (the default on MainsailOS and FluiddPi). If your UI lives on another port, adjust it. To verify: run systemctl status frpc on the printer, then on the VPS run curl -I http://127.0.0.1:8080 — you should get back the HTTP headers with a 200 status.

Step 3. HTTPS and a Password: Caddy on Top

The interface goes public only behind a reverse proxy with a password and encryption. We'll use Caddy: it issues and renews Let's Encrypt certificates by itself, no certbot involved. Beforehand, point an A record (say, printer.example.com) at your VPS IP and open ports 80, 443, and 7000 in the firewall.

Note the directive is spelled basic_auth since Caddy 2.8 — older tutorials show the legacy basicauth. The browser asks for the login once and remembers it; Mobileraker takes the same credentials in its connection settings.

SSH Tunnel: Minimal Installation

If you'd rather not install frp, a reverse SSH tunnel does the same job with one command — and there's nothing to install on the VPS at all. From the printer host, forward its port 80 to port 8080 on the server:

By default sshd binds the forwarded port to the server's 127.0.0.1 only (the GatewayPorts no setting) — which is perfect for our Caddy setup: the port stays hidden from the outside while Caddy from step 3 proxies to it with a password. To survive connection drops, install autossh and wrap it in a service:

When to pick SSH over frp: a single tunnel and minimal setup. frp wins once you need several services — the web UI, a separate camera stream, the Moonraker API — each is just another [[proxies]] section in frpc.toml instead of another systemd service.

ZeroTier: a Peer-to-Peer Network of Your Own Devices

ZeroTier joins your devices — the printer host, your phone, your laptop — into one virtual network, as if they were in the same room: each gets an internal IP where Mainsail opens as usual. The free plan covers 10 devices and 1 network (it used to be 25 devices — the cap was cut). A detailed Russian walkthrough with an Elegoo Neptune 3 Pro behind CGNAT is on 3DToday — 16.6k views since February 2024.

Caveats: network management lives in the zerotier.com cloud, while traffic between devices flows directly (P2P). When a direct connection can't punch through NAT, ZeroTier falls back to its relay servers — and those are exactly what Russian users have been complaining about since late 2025; on some mobile carriers (Megafon, Yota) the service is flaky. Bottom line: a great free option for personal use, but there's no public URL and stability depends on your carrier.

Obico: Monitoring with AI Failure Detection

Obico is a tunnel to your Mainsail/Fluidd/OctoPrint plus a mobile app and a neural network that catches spaghetti and pauses the print on its own. The free cloud plan: 1 printer, 10 AI hours, and 300 MB of tunnel traffic per month — enough to peek from work, not enough to keep the webcam open all day. AI Premium ($6.99/mo billed yearly) can't be paid with a Russian card — billing runs on Stripe. The self-hosted edition, however, is completely free with no caps — you can run it on the same VPS (4 GB RAM required, no GPU needed): the full walkthrough is in "Your Own 3D Printing Server: Obico and Manyfold on a VPS".

Similar services: OctoEverywhere — free for up to 3 printers with unlimited remote access and Gadget AI monitoring, paid Supporter from $4.99/mo (also Stripe, so Russian cards won't work); it supports OctoPrint, Klipper, Mainsail, Fluidd, and even Elegoo OS. And the Russian EZH-Print — web access to Klipper/Moonraker printers with Telegram and VK notifications: currently a free 60-day beta with post-beta pricing not yet announced; the first review on 3DToday is cautiously positive.

Security: Why You Can't Just Open a Port

Back in 2018, SANS ISC researchers found 3,759 OctoPrint instances on Shodan sitting on the open internet with no password at all. The OctoPrint developers say it outright: putting OctoPrint onto the public internet is a terrible idea, and the Mainsail docs ask you not to open Mainsail/Moonraker ports to the world. The reason is blunt: an exposed Moonraker means arbitrary G-code (including heating the hotend and bed to their limits), swapped print files, edits to printer.cfg temperature limits, host shutdown, and a live view of your webcam.

Know your defaults, too: on stock MainsailOS, Moonraker listens on all interfaces (0.0.0.0:7125) and trusts every private subnet — any guest on your Wi-Fi gets the full API with no password. So the password on the tunnel (basic_auth from step 3) is mandatory, and it's worth enabling authorization in moonraker.conf:

Tips and Common Mistakes

• Make the frp token long: openssl rand -hex 32 — and never leave auth.token empty
• Open only 80, 443, and 7000 in the VPS firewall — port 8080 stays internal, Caddy serves it
• Create the domain's A record before starting Caddy — Let's Encrypt won't issue a certificate without it
• localPort in frpc.toml must match the web UI port on the host: it's 80 on MainsailOS and FluiddPi
• When something breaks, read the logs: journalctl -u frpc -f on the printer and journalctl -u frps -f on the VPS
• frp channel encryption is on by default (since v0.50.0) — nothing extra to configure

Control from Your Phone

For Klipper there's Mobileraker — an actively maintained iOS/Android app (latest release May 2026): temperatures, axes, macros, webcam, emergency stop. On your home network it talks to Moonraker directly; from outside, point it at your tunnel: enter the https address from step 3 plus the basic_auth login in its connection settings. Push notifications are handled by the Mobileraker Companion component. Obico and OctoEverywhere ship their own apps, and OctoApp covers OctoPrint.

FAQ

Sources

• frp — official repository and config examples
• frp docs: running via systemd
• Mainsail: remote access FAQ
• Moonraker: [authorization] documentation
• OctoPrint: a guide to safe remote access
• SANS ISC: exposed OctoPrint instances report
• 3DToday: ZeroTier remote access for a Klipper printer
• 3DToday: first tests of EZH-Print
• juev.org: migrating to frp + Caddy
• Tailscale issue #13648: unavailability from Russia