HomeGrid VPN Guides(HomeGrid VPN Guides)

← All guidesGuide

Control which devices can reach each LAN with LAN ACL

Published Updated

These steps show the screens as of September 2026. If the screens have changed, follow what the dashboard shows.

HomeGrid VPN’s LAN access control (LAN ACL) lets you decide, for each device connected to the VPN, whether it may reach a LAN behind a Grid (such as your home LAN). Everything is blocked at first, and only the devices you allow reach the LAN behind a Grid. For example, you can let your own phone reach the NAS on your home LAN while keeping a family member’s phone from reaching it.

What to know first

LAN access control is designed to let through only the devices you allow (everything is blocked at first; default deny). Even a device connected to the VPN does not reach the devices on a destination LAN at first. Only the devices checked for a destination LAN (such as a NAS or PC) reach it, so you can connect family members’ devices or other devices with peace of mind. If you clear a device’s checkbox, that device no longer reaches the LAN.

Before and after checking a device When no device is checked for a LAN, no device can reach it. When Device A is checked, only Device A can reach that LAN, and Device B, which is not checked, cannot. Nothing checked Device A Device B Home LAN × × No device can reach it Only Device A checked Device A (allowed) Device B Home LAN × Only checked devices
Only checked devices can reach a LAN

A newly registered device cannot reach any LAN until you check it. A newly added LAN can be reached only by the devices you check for it. Check every device that uses that LAN.

Before you begin

  • Check that a destination LAN is registered. For a Docker Grid, the “Your home LAN subnet (CIDR)” you entered when creating the Grid becomes the destination. If there are no LANs, “No destination LANs. …” is shown instead of the table or cards.
  • A change can take up to 5 minutes to be applied.

How the screen is laid out

“LAN access control” is inside the “Add a Spoke” panel on the dashboard. Its layout depends on the screen width.

Screen Layout How to read it
PC and similar (768px wide or more) Table Rows are devices (“Device ↓”) and columns are destination LANs (“Allow to →”). The checkbox where they meet decides access
Phone and similar (767px wide or less) A card for each device The card heading is the device. Under it are the Grid and other names marked with 🌐, and rows for the LANs it can reach

The meaning of each checkbox is shown under “What the checkbox means:” on the screen.

Shown Meaning
Checked “Allowed”
Unchecked “Not allowed”
🔒 “Always allowed (can’t change)”. A gateway such as a Grid can always reach its own LAN
🚫 “Its LAN → VPN can’t be allowed (can’t change)”. It appears for devices whose row is labeled “Not a source” (such as a Docker Grid). It is also listed under “What the checkbox means:” only when there is such a device

Allowing the row of a device labeled “Gateway” allows access from the entire LAN behind that device. You cannot choose the hosts behind it one by one.

Steps: table view on a PC

  1. Open the “LAN access control” table on the dashboard.

    Screenshot (to be replaced): the “LAN access control” table on a PC

  2. Check the box where the row of the device you want to allow meets the column of the destination LAN. To stop allowing it, clear the checkbox.

  3. Check the icon to the right of the box. After a spinning icon (saving, then confirming it’s applied), a ✓ (applied) means the change has taken effect. ⏳ means it has been saved and is waiting to be applied. Hover over the icon to see the status text.

Steps: card view on a phone

  1. Open the dashboard on your phone and scroll to “LAN access control”. You will see a card for each device.

    Screenshot (to be replaced): the per-device cards of “LAN access control” on a phone

  2. Find the card of the device you want to allow.

  3. In the card, tap the row of the destination LAN. Tapping anywhere in the row toggles the checkbox.

  4. Check the status shown in the row. After “Saving…” and “Confirming it’s applied…”, “Applied” means the change has taken effect. “Saved — still applying (this can take a few minutes)” means it has been saved and is waiting to be applied.

Do not toggle the same item again until it shows “Applied”.

Troubleshooting

Message What to do
“Failed to load access control: …” Click “Reload”.
“Failed to update: …” The checkbox goes back to its previous state. Wait a moment, then toggle it again.
“No destination LANs. …” No destination LAN is registered. As the message on the screen explains, either the Grid’s home LAN CIDR (for a Docker Grid, the subnet you entered when creating it) is not registered, or no Spoke gateway custom routes have been added.
The checkbox cannot be clicked (it shows 🔒 or 🚫) That item cannot be changed (see the table of checkbox meanings above).