Your server, from anywhere

How it works, in one picture

The 28JoursBox server runs on a PC in your home. At home, everyone reaches it over Wi-Fi or a cable. As soon as you leave (rehearsal, commute, phone on 4G), you need a path from the Internet to that PC. There are two paths, and you can use both:

Members' PCs choose on their own, in this order: local network, then direct access, then Tailscale. Nobody has to change anything when going from home to 4G.

Which option should you choose?

Tailscale step by step

Tailscale is a free service that creates an encrypted tunnel between your server PC and the Internet. The server PC opens this tunnel to the outside itself: that's why the router needs no setup at all. Only the server PC installs Tailscale; members' phones and PCs install nothing.

Before you start

• Be on the server PC, with 28JoursBox running (icon next to the clock).
• Have a Google, Microsoft, Apple or GitHub account to sign in to Tailscale (the Tailscale account is created with it, for free, in one click).
• Be able to accept a Windows "administrator" prompt.

The steps

1. Click the 28JoursBox icon next to the clock › État du serveur… (Server status…) (on a server PC that also syncs files: the panel's ⚙ gear › État du serveur…), row Accès extérieur (Outside access) › Régler… (Set up…). The Accès depuis l'extérieur (4G) (Access from outside (4G)) window opens.
2. Click Installer Tailscale (Install Tailscale). The Tailscale download page opens in the browser: download the Windows version, install it (next, next…), then sign in when Tailscale asks (choose Google, Microsoft…). A Tailscale icon then appears next to the clock as well.
3. Go back to the 28JoursBox window and click J'ai installé Tailscale, vérifier (I've installed Tailscale, check). If Tailscale wasn't signed in yet, finish signing in, then click Vérifier à nouveau (Check again).
4. Click Activer l'accès extérieur (Turn on outside access). The first time, a Tailscale page opens and asks you to allow Funnel (the feature that makes the server reachable from the Internet): accept, then come back.
5. Windows asks for administrator permission: accept.
6. The message "Accès extérieur activé : https://<pc>.<nom>.ts.net" (Outside access turned on) appears. This is the server's address from outside. The members' invitation link now uses it automatically.

Check that it works

1. On a phone, turn off Wi-Fi (to really be on 4G).
2. Open the address https://<pc>.<nom>.ts.net in the browser: the 28JoursBox sign-in page should appear.
3. Phones that have already installed the app: nothing to do, they use this address when away from home.

After that, it runs on its own

The server PC checks the publication every 5 minutes and restores it if needed (after a restart, a router outage…). If you rename the machine in Tailscale, the address changes: a Nouvelle adresse du serveur (New server address) notification appears on the server PC; click it to apply it. The server PC must stay on (and not asleep) to be reachable, as for everything else.

Direct access step by step

With direct access, there's no more relay: the member's phone or PC talks directly to your router, which passes it on to the server PC. It's as fast as your Internet connection. For that you need three things, set up only once:

1. An Internet address that doesn't change: your router sometimes changes its public address. A free name from DuckDNS (e.g. mongroupe.duckdns.org) follows these changes on its own; 28JoursBox updates it for you.
2. A fixed address for the server PC inside the home: otherwise, after a restart, the router may give it another address and the forwarding would lead nowhere.
3. A port forward on the router: "everything that arrives from the Internet on port 8443, send it to the server PC." Without it, the router blocks the traffic (that's its default job).

The HTTPS certificate (the padlock in the browser) is then obtained and renewed automatically by 28JoursBox, for free, from Let's Encrypt. No other port is needed (no need to open port 80).

Step 0: is my router compatible?

Direct access requires your router to have its own public IPv4 address. That's the case for most fiber and DSL routers in France, but not always:

• 4G / 5G routers (Orange Flybox, SFR Box 4G/5G, Bouygues 4G/5G Box, Free 4G/5G…): the address is almost always shared among many customers. Direct access won't work: stick with Tailscale.
• Shared IP on fiber or DSL: the four providers more and more often assign an IPv4 address shared among several customers. It can be changed to a dedicated address: self-service at Free ("IP fixe V4 full-stack"), as an add-on at Bouygues, through customer service at SFR, RED and Orange. The details are in each router-by-router section.
• Local or small providers: ask about "port forwarding" and "shared IP" (or "CG-NAT").

Step 1: reserve a DuckDNS name (free)

1. Go to www.duckdns.org and sign in with one of the buttons offered (Google or GitHub, for example). No account or password to create.
2. At the top of the page, find the token line: a long string of letters and numbers. That's your token; copy it and keep it for later. Don't share it: it lets anyone change your name (you can regenerate it from the DuckDNS account page).
3. In the sub domain field, type the name you want (letters, numbers and hyphens, e.g. mongroupe), then click add domain. If the name is already taken, try another one.
4. Your address will be mongroupe.duckdns.org. No need to fill in the "current ip" column: 28JoursBox takes care of it.

Step 2: give the server PC a fixed address

Inside the home, each device gets an address like 192.168.1.xx from the router. By default it can change. You ask the router to always give the same one to the server PC: this is the "static DHCP lease" (or "fixed IP address", "DHCP reservation", depending on the router). It's the safest method: nothing to touch in Windows.

First, identify the server PC. On the server PC: Settings › Network & internet › Ethernet (or Wi-Fi › your network's name). Write down:

• the IPv4 address (e.g. 192.168.1.20);
• the physical address (MAC) (e.g. 3C-52-82-AB-CD-EF), sometimes requested by the router;
• the PC name (Settings › System › About), which helps you find it in the router's device list.

Faster for the tech-savvy: press the Windows key, type cmd, then ipconfig /all.

Next, in the router's interface, add a static lease for this PC (the exact path for each router is given below: Orange, SFR, Bouygues, Free). Always set up the static lease before the port forward. Then restart the server PC and check that it has the chosen address.

Step 3: forward port 8443 to the server PC

In the router's interface, look for "NAT/PAT," "port forwarding" or "port management," and create a rule with this information:

443 instead of 8443? If your router lets you forward port 443, the address will be shorter (without :8443). In that case, use 443 as the external port and in the Port open on the router field of 28JoursBox, with 8443 as the internal port. Many routers (Bbox and Freebox in particular) reserve port 443 for their own remote access: when in doubt, keep 8443.

Step 4: turn it on in 28JoursBox admin

1. Open 28JoursBox (on the server PC, or elsewhere after unlocking administration with the administrator password) › Me › Settings › Server › card Fast access through your router.
2. Fill in Name chosen on duckdns.org (just mongroupe, without ".duckdns.org"), duckdns.org account code (paste the token copied in step 1) and Port open on the router (8443, or 443).
3. Check Turn on direct access, then Save.
4. The status changes to "Setting up (HTTPS certificate: one to two minutes)…", then to "Active: members' PCs use direct access (Tailscale stays as a backup)." The card shows the checked router address and the certificate's expiration date (renewed automatically).

Step 5: test from outside

1. On a phone, turn off Wi-Fi.
2. Open the fast address shown in the card (e.g. https://mongroupe.duckdns.org:8443): the 28JoursBox sign-in page should appear, with the padlock.
3. Or tap Check now in the card.

Note: testing from your home Wi-Fi proves nothing (many routers can't "loop back"). Always test on 4G.

Members' PCs follow along on their own. Phones keep the address of the installed app; listening and downloads go through direct access when it responds, and automatically fall back to Tailscale otherwise.

Router by router

These sections cover French internet providers. With another provider, look in your router for "port forwarding" and "DHCP reservation" (or "static lease"): the five pieces of information of the rule stay the same.

Interfaces change with the model and with updates: if a label differs slightly, look for the closest word ("DHCP," "NAT," "ports"). Each section links to the provider's official help, always up to date. For all routers: sign in from a device at home (Wi-Fi or cable).

Orange and Sosh: Livebox

Signing in: open http://192.168.1.1 (or http://livebox). Username admin; password: by default, the first 8 characters (no spaces) of the security key printed on the label under the Livebox or on its screen. If you've forgotten it: "Mot de passe oublié" (Forgot password) link on the sign-in page.

1. Fixed address for the PC: Paramètres avancés (Advanced settings) icon at the bottom of the page › Réseau (Network) › DHCP tab › Baux DHCP statiques (Static DHCP leases) section. Choose the server PC in the device list, enter the address you want, then Ajouter (Add).
2. Port forwarding: same Réseau page, NAT/PAT tab. Create a custom rule: name 28JoursBox, internal port 8443, external port 8443, protocol TCP, device: the server PC (leave "IP externe" (External IP) empty). Click Créer (Create): the rule appears in the table at the bottom. It may take a few minutes to take effect.

Orange official help: accessing the interface · static IP address · NAT/PAT rules (Livebox 6 and 7, with screenshots) · Livebox 5.

SFR and RED by SFR: SFR Box

Signing in: open http://192.168.1.1. Username admin; password: the Wi-Fi security key printed on the router's label (unless you've changed it). Another option: press the router's WPS button for about 5 seconds to unlock access.

SFR Box 8 / 8X:

1. Check the IPv4: WAN section › Informations générales (General information). If the IPv4 address is missing or starts with 10., the line has a shared IP: port forwarding won't work (see the box below).
2. Fixed address for the PC: LAN section › Baux statique (Static leases) › IPv4 heading › ajouter bail statique (add static lease). Choose the server PC in the list and the end of the address (between 2 and 253), then Créer (Create). Restart the router.
3. Port forwarding: Sécurité (Security) menu › Accès (Access) › Réseau v4 (Network v4) section, Redirection des ports (Port forwarding) heading › Créer une règle (Create a rule): name 28JoursBox, device IP: the server PC's, protocol TCP, internal and external ports 8443, access from any address. Turn the rule on.

NB6, box Plus: fixed address in Réseau v4 (Network v4) › DHCP (static addresses), port forwarding in Réseau v4 › NAT (name, TCP protocol, external port 8443, destination IP, destination port 8443). If Etat (Status) › Internet shows "Carrier-grade NAT," the address is shared.

SFR official help: SFR Box 8: IPv4, static lease and port forwarding (with screenshots) · NB6 and box Plus: advanced features.

Bouygues Telecom and B&You: Bbox

Signing in: open https://mabbox.bytel.fr (http://192.168.1.254 also gets you there), or from the Bouygues Telecom app: Bbox line › Gérer ma Bbox (Manage my Bbox) › Accéder à mon interface admin (Access my admin interface). If you've forgotten the password: "mot de passe oublié ?" (forgot password?) link, with a confirmation on the router.

1. Fixed address for the PC: icon menu on the left › Réglages avancés (Advanced settings) › IPv4 DHCP server: add a static IP address rule. Choose the server PC (or enter its MAC address), the address you want and a name, then Appliquer (Apply).
2. Port forwarding: Réglages avancés › Redirection de ports (Port forwarding) › add or edit rules, NAT & PAT section: name 28JoursBox, protocol TCP, destination IP: the server PC, source IP empty, external port 8443, internal port 8443, then Appliquer.

Bouygues doesn't publish an official guide for these two settings: the menus above come from the Bbox WiFi 6 (Must, Ultym) and may vary slightly. Official help: accessing the Bbox interface.

Free: Freebox

Signing in: open http://mafreebox.freebox.fr (Freebox OS). No password on a label: the first time, click Première connexion (First sign-in), confirm on the Freebox (right arrow on the Freebox Server's screen, or depending on the model), then choose your password.

1. Check the IP address: Freebox OS › Etat de la Freebox (Freebox status) › Etat Internet (Internet status). If the port range shown isn't "0 à 65535" (0 to 65535), your IPv4 is shared: request the IP fixe V4 full-stack option in the Espace Abonné (subscriber area) › Ma Freebox (My Freebox) › Demandez une adresse IP V4 fixe full-stack (Request a full-stack fixed IPv4 address) › Valider (Confirm), then restart the Freebox Server 30 minutes later.
2. Fixed address for the PC: Paramètres de la Freebox (Freebox settings) › Mode avancé (Advanced mode) › DHCP › Baux statiques (Static leases) tab (not "Baux actifs" (Active leases)) › Ajouter un bail DHCP statique (Add a static DHCP lease): MAC address of the server PC, address you want, comment.
3. Port forwarding (after the static lease): Paramètres de la Freebox › Mode avancé › Gestion des ports (Port management) › Ajouter une redirection (Add a forward): destination IP: the server PC, forwarding active, source IP: all, protocol TCP, start port 8443, end port 8443, destination port 8443, comment 28JoursBox.

From your phone, the Freebox app also handles these settings (Réseau (Network) › Paramètres réseau avancés (Advanced network settings) › DHCP / Redirection de port (Port forwarding)). If you create the static lease after the port forward, delete the forward and create it again.

Free official help: accessing Freebox OS · IP fixe V4 full-stack · DHCP and port forwarding from the app.

Other cases

• 4G / 5G routers (all providers): shared address, port forwarding probably won't work. Tailscale works very well.
• Your own router behind the provider's router (TP-Link, Asus, Netgear…): you need two port forwards, one on the provider's router to your router, then one on your router to the server PC.
• Other provider: in the router's interface, look for "NAT," "port forwarding," and "static DHCP" or "reservation." The five pieces of information of the rule stay the same.

Not working?

Still stuck? Ask on the forum, mentioning your provider and router model (never share your DuckDNS token or your passwords).

What about security?

• With Tailscale as with direct access, everything goes over HTTPS (encrypted), and access requires the group password.
• Direct access opens a single port, to the server PC only: don't open anything else, and don't turn on the router's "DMZ."
• Keep Windows and 28JoursBox up to date.
• The DuckDNS token must not be passed around: it lets anyone change your DuckDNS name. If in doubt, regenerate it on duckdns.org and paste the new one into 28JoursBox.
• To stop everything, uncheck Turn on direct access and delete the rule on the router. Tailscale takes over.
• By turning on direct access, you accept the Let's Encrypt terms of use.