Kemnir is a private relay for the things you run at home — a game server for friends, a home lab dashboard, a media library, a machine you need from the road. One small agent dials out. Nothing is ever exposed to the open internet, and your home IP never leaves your house.
Be first in line when the beta opens. No spam, ever.
What it's for
If it listens on a port on a machine you own, Kemnir can put a private address in front of it — without that machine ever accepting an inbound connection.
Host Minecraft or any other server on the PC you already own. Everyone joining types a normal address — no client, no mod, no “what's your IP” in the group chat. Java players don't even type a port.
Free tierDashboards, media servers, note apps, git remotes, that one service you built and never exposed because exposing it meant a firewall hole. Reach it from your phone without punching one.
Paid planGet at your desk machine, your NAS or your backups from a laptop somewhere else — over a relay you rent, not a port the whole internet can knock on.
Paid planShow a local app to a client, take a webhook on a dev box, run a service from a network that will never give you a static IP. Generic TCP, no cloud deploy required.
After launchThe problem
Reaching your own machine should take five minutes. Instead it takes an evening of router menus — and increasingly, it isn't possible at all.
Most mobile, satellite and a growing share of fibre connections share one public IP across hundreds of homes. There is no port to forward. No setting fixes it.
Dorms, family homes, shared houses, offices. The admin page is either locked or belongs to somebody who is not interested in your Jellyfin server.
Forwarding publishes your home address and leaves something listening on it around the clock. Kemnir has nothing to knock on — the connection only ever goes outward.
How it works
The agent dials out to the nearest Kemnir edge and holds the connection open. Traffic comes back down the same pipe — so nothing has to be open on your side.
A single binary on the machine you want to reach — with a proper Windows app, not just a terminal. Point it at a port that's already listening.
localhost:25565 → Kemnir
Kemnir issues a hostname on the spot. Minecraft Java players type it with no port number at all, on every plan including free.
yourserver.mc.kemnir.net
Optional. Point a domain you own at Kemnir and hand out that instead — for a game server, a dashboard, or anything else behind the agent.
home.yourdomain.com
Privacy
The privacy isn't a plan you upgrade to. It falls out of how the relay is built: traffic goes out from your machine, never in.
Whoever connects only ever sees our edge. There is no origin address to leak, look up, or map back to where you live — because the connection was never inbound to you.
Your router keeps every port shut. Scanners sweeping your ISP's range find nothing, because there is nothing there to find.
We keep the connection metadata needed to run the service and answer abuse reports — addresses, timestamps, byte counts. Not the contents. The retention window gets published before launch, and it will be short.
What we're building
Most of this list exists because we've been the person on the other end of a relay that didn't bother.
SRV records are handled in our own zone, so your address works without a port number. We're not gating something that costs us nothing.
Free tierBedrock clients ignore SRV, so a default port is the only way to skip typing one. That's a real, scarce resource — so it sits on a paid plan.
Paid planLatency is the number one complaint about relays. The agent measures and picks the closest edge instead of making you guess from a dropdown.
Whatever's behind the tunnel sees the visitor's actual IP, not ours. Bans, geo tools, access logs and anti-cheat keep working. Most tunnels get this wrong.
Verified with a TXT record, then rechecked on a schedule so an expired domain can't quietly become someone else's front door.
Paid planA game server, a dashboard and a file share can share the same install and the same machine, each with its own address.
Paid planPlenty of services in this space put “DDoS protection” on the homepage on day one. We're not going to, because right now we can't back it.
Here is what is structurally true from the first day: your home IP is never exposed, floods hit our network instead of your uplink, and traffic that isn't what the tunnel expects gets dropped before it reaches your machine. When the filtering work is finished and tested, we'll say more — and not a week earlier.
Coverage
Games are the launch target because a game relay can verify the first packet is a real handshake. Generic access follows once that's running under real load — on a paid plan, deliberately, so it doesn't become free infrastructure for whoever wants to abuse it.
The beta opens to the waitlist first. Leave an email and you'll hear from us when there's something real to try — not before.