Games, home lab, remote access, privacy, and the ones we can't answer yet. Kemnir is in development — where the honest answer is “we don't know yet”, that's what it says.
No. Games are where we're starting, because a game relay can check that the first packet is a genuine handshake and drop everything else — which is the cheapest abuse filter there is, and it's what makes a free tier possible.
Anything else that listens on a port works the same way: a home lab dashboard, a media server, a NAS, a remote desktop, a dev box taking a webhook. That side arrives after launch and sits on a paid plan, for the same abuse reason in reverse — a general-purpose tunnel forwards whatever you point at it, so it can't be free and unattended.
No. That's the whole point of the design. Only the machine you're reaching runs the Kemnir agent. Everyone else types a normal address — into the game, into a browser, into whatever client they'd normally use.
This is what separates a relay from a mesh VPN. Tools like Tailscale or Hamachi need every single participant to install and configure software. Kemnir needs one person to.
Traffic takes an extra hop through our edge, so it adds some. We're not going to put a number on the homepage before we've measured it properly across regions — a made-up figure would get found out in the first week.
What we can say about the design: the agent picks the nearest edge automatically rather than making you guess, and both halves of the trip are over networks built for it rather than a home uplink.
Not as a claim we'll make today. What's true from day one is structural: players only ever see our edge, so there's no home IP to attack, and volume arrives at our network instead of your router.
Calling that “DDoS protection” would set an expectation we can't yet meet against application-layer attacks. When the filtering work behind that claim is done and tested, we'll say so plainly.
Yes — Kemnir supports the PROXY protocol, so whatever is behind the tunnel receives the visitor's actual address rather than ours. Minecraft bans, geo tooling, anti-cheat and ordinary access logs keep working normally.
You'll need to turn the matching setting on in your server software, and we'll document exactly where for each platform.
On Minecraft Java, no — not even on the free tier. We publish an SRV record in
our own zone, so yourserver.mc.kemnir.net is the whole address.
Bedrock is different: those clients ignore SRV entirely, so skipping the port requires holding a default port on a real IP. That's what the Default Port plan is.
Minecraft tunnels live under mc.kemnir.net, so you pick the front
part and the result reads like a normal server address —
yourserver.mc.kemnir.net. Nothing about it announces that a relay
is involved.
Tunnel hostnames sit on kemnir.net rather than on
kemnir.com on purpose: the brand domain and the domain strangers
connect to are kept completely separate, so an abuse report or a blocklist
entry against one can never take the other down with it.
Yes, on the paid plans. You add a TXT record to prove you own it, and then hand out an address that's entirely yours.
We re-check that record on a schedule rather than once. Domains expire and get resold, and we're not going to keep routing traffic for a hostname that changed hands last month.
Enough to run the service and respond to abuse — connection metadata such as addresses, timestamps and byte counts. We do not inspect or store the contents of your traffic.
The exact retention window will be published in the privacy policy before launch, and we intend to keep it short. A tunnel service that won't tell you what it keeps isn't worth using.
Minecraft Java and Bedrock at launch. Valheim, Terraria, Palworld and Rust are next in line. Generic TCP — dashboards, self-hosted apps, remote desktop, file shares — follows on a paid plan.
The sequencing is deliberate rather than a limitation of the relay itself. We'd rather turn the general case on once the edge has been under real load than discover its failure modes with your home network attached to it.
A commercial VPN hides your traffic on the way out. Kemnir does the opposite direction: it gives things on your network a way in that doesn't involve opening a port or publishing where you live.
Compared to a mesh VPN like Tailscale or ZeroTier, the difference is who has to install something. Mesh means everyone does. A relay means one machine does, and everyone else just uses an address.
No. It exists because portless Java genuinely costs us nothing to provide — not as a countdown to a paywall. There's a bandwidth cap and a one-tunnel limit, and those are stated up front rather than discovered later.
No date yet. The relay has engineering gates to clear first, and if it can't hit the latency bar we've set for ourselves, we would rather not ship it than ship something that ruins game night.
The waitlist gets told either way, and gets access first if it clears.
Join the waitlist — replies to the first email come straight to us, and early questions shape what gets built.