# Private apps with Tailscale or WireGuard on blitz.cloud > Make an app private on blitz.cloud so only your own devices can open it, through your Tailscale tailnet or your WireGuard network. How to connect, and what changes. Web page: https://blitz.cloud/docs/private-networks/ Updated: 2026-10-15 A private app on blitz.cloud is off the public internet. It keeps its address, like `https://immich.lena.prod.page`, but only devices on your own network can open it: your Tailscale tailnet, a WireGuard network you already run, for example on your router, or a device added straight in the dashboard, with no router of your own needed. Connect a network on the Private network page in the dashboard, then switch an app to private in its Settings tab. The free plan connects one network with as many private apps as you like, Pro up to five. ## When a private app makes sense Some apps should never face the internet: a password manager only your family uses, a photo library, an admin panel, a database tool. Making them private takes them off the internet, so nobody else can reach them to guess a login or try an exploit against them. ## Connect Tailscale 1. Open Private network in the dashboard and click Connect Tailscale. Tailscale's sign-in page opens in a new tab. 2. Sign in with your Tailscale account. The card says Connected a moment later. 3. Install Tailscale on your phone or laptop and sign in with the same account, if you haven't already. There's nothing to create in Tailscale's console and nothing to paste. Your private apps share one device on your tailnet, `blitz-`, and `http://blitz-` lists them all. You can rename that device on the Private network page. The card also says when Tailscale will ask you to sign in again, and how to switch that off for this device. ## Connect WireGuard If you already run a WireGuard server or a router with WireGuard, such as a FRITZ!Box: 1. Add a new device (a "peer") on your router or VPN server and download its config. Use it only for blitz.cloud, because two devices can't share one config. 2. On Private network, click Upload config and choose the file. blitz.cloud joins your network as that device. The config holds a private key; it is stored encrypted and used only to join your network. A config whose router can't be reached from the internet is refused when you upload it, with the reason. That happens behind carrier-grade NAT, which many home connections use, and with IPv6-only connections. Once connected, open the address shown on the card from a device in your network. It lists all your private apps. ## Without a router of your own No VPN or router with WireGuard? blitz.cloud can run the WireGuard server for you. 1. On Private network, connect the WireGuard app card, then click Add a device. 2. Scan the QR code with the WireGuard app on your phone, or download the config file for a laptop. The key is shown once; we don't keep it, so save it now. 3. Open the WireGuard app's tunnel. Your private apps are reachable from that device straight away. Only your private apps' addresses go through the tunnel, so your phone's own internet connection does not. Removing a device disconnects it within a minute; removing the last one first names which private apps become unreachable, so nothing is cut off by surprise. ## Make an app private Open the app, go to Settings and switch it to private. What changes: - The app keeps its address, with HTTPS and without a port, but it only opens on devices in your network. Bookmarks and links you already have keep working there. From anywhere else it doesn't open. - The app no longer sleeps, so it answers straight away when you open it from your network. - On WireGuard the address works the same way where your router lets it. The app also gets a fixed port on the address blitz.cloud has in your network, and that way always works. Switching it back to public opens the address to everyone again. ## Disconnect a network Disconnecting asks what should happen to the apps that depend on the network: make them public again or pause them. Nothing is deleted. ## Reach devices on your network from your apps A private app works in one direction: your devices open your apps. The [infrastructure designer](https://blitz.cloud/infrastructure-designer/) adds the other one. An app such as Home Assistant can reach a device on your network, like a Hue Bridge, under a name you choose, and a device at home such as a NAS can get its own address, private by default. Devices on the network show up on the Designer page by themselves, and "Scan my network" finds the ones on your home network when you click it. For Home Assistant, [connect Home Assistant to devices at home](https://blitz.cloud/docs/home-assistant-home-devices/) goes through it step by step. ## Limits | | Free | Pro | |---|---|---| | Networks you can connect | 1 | Up to 5 | | Private apps per network | As many as you like | As many as you like | You need to confirm your email address before you can connect a network. An AI assistant connected over MCP can list your networks and make an app private or public, but connecting a network stays in the dashboard, because it needs a secret or a config file. See [connect an AI assistant](https://blitz.cloud/docs/ai-assistants/).