Avyn
Get Avyn

GUIDES

How to control your PC away from home with a VPN

Avyn works over the local network, but a phone that is already paired can also reach the PC from another network (mobile data, another home's Wi-Fi) when both are inside a VPN. This guide shows it with Tailscale, which is free for personal use and does not require opening ports on your router.

Updated

What changes and what does not

  • Pairing a new phone is always done on the local network, with the verification code and the approval on the PC. Over a VPN the PC refuses it and the app explains why.
  • Unlocking from the sign-in screen still works only on the local network.
  • Turning the PC on from the phone (Wake-on-LAN) does not cross the VPN: it works only on the local network.
  • The connection is just as secure: pinned certificate and shared key. The VPN adds no trust and removes none, and there is no Avyn server in the middle.

What you need

  • The phone already paired with the PC on your local network.
  • The latest version of the Avyn Remote app and of Avyn Agent.
  • A VPN that connects the PC and the phone to each other. Tailscale works for trying it out.

Step by step with Tailscale

  1. Protect the account: Tailscale signs you in with your Google or Microsoft account, and anyone who gets into it can add devices to your network. Turn on two-step verification there.
  2. On the PC, install Tailscale from tailscale.com/download and sign in. Note the IP address it gives the PC (something like 100.x.y.z): you can see it in the tray icon or with the command tailscale ip -4 in PowerShell.
  3. On the phone, install Tailscale from the Play Store and sign in with the same account. Leave it turned on.
  4. In Avyn, open the PC list, tap the shield icon of your PC, type the address the PC has in Tailscale and save. The shield is marked.
  5. Try it: turn Wi-Fi off, keep mobile data on and open Avyn. It should reconnect by itself.

When reconnecting, the app tries the address that worked last first and then the other, so it does not wait on the wrong one. Back home it keeps working with the VPN on; if you turn the VPN off, it uses the local network address.

If it does not connect

  • It keeps loading: Windows may be classing the VPN's network as Public, and Avyn Agent only accepts connections on Private networks. You can see the profile with Get-NetConnectionProfile in PowerShell and, if you trust that network, set it to Private with Set-NetConnectionProfile -InterfaceAlias "Tailscale" -NetworkCategory Private. With Tailscale it is usually not needed.
  • Quick test without Avyn: with the VPN on and Wi-Fi off, open https://PC-IP-ADDRESS:47821 in the phone's browser. A certificate warning means the path reaches the Agent; a timeout means something is blocking it.
  • It says a new PC can only be paired from its local network: that is expected. Pair at home, on Wi-Fi, then add the VPN address.
  • The PC is off or asleep: it cannot be turned on over a VPN, so it will not be found until you turn it on.

Other VPNs

The feature does not depend on a brand: you type the address the PC has inside the VPN. WireGuard, ZeroTier or your router's VPN work if they carry traffic to that address. One limit: if the VPN hands out addresses on a subnet the PC also has on a physical network card, the Agent takes it for the local network and would allow pairing there.

Frequently asked questions

Can I pair a new phone over a VPN?
No. A new phone is always paired on the local network, in front of the PC, by comparing the verification code. Once it is paired, you can add the VPN address.
Does Avyn see my traffic or need a server?
No. Avyn has no intermediate servers: traffic goes straight between your phone and your PC over your own VPN.
Can I unlock the PC from outside my home?
No. Unlocking from the sign-in screen works only on the local network, on purpose: it types the Windows password from a high-privilege service.

Keep reading