Skip to content
Muxen
Docs · Connections

Your machines

Connections

How Muxen reaches your machines: one ssh connection, or a direct one over QUIC, on your local network or through Tailscale.

Muxen reaches each machine with your own ssh, installs its small agent there, and from then on talks to that agent over one live connection. Requests take milliseconds, terminals open at once, and the sidebar changes the moment a session does. You don’t set any of this up: it happens when you add a machine.

This computer

Muxen

  • The app
  • muxen on the command line
  • muxen mcp for your AI agents
  • ssh

    Forge

    macOS

  • direct · QUIC

    Beacon

    Ubuntu

  • over Tailscale

    Atlas

    Windows 11

Muxen reaches each machine with your own ssh, then talks to its small agent there: over that ssh connection, or directly once you pair them. Away from home it goes over Tailscale.

Over ssh

By default each machine has one ssh connection, kept open and opened again when it drops. Everything goes through it: checks, terminals, the desktop, files, servers you open in your browser.

Anything ssh accepts works as a machine’s host: an alias from ~/.ssh/config, user@host, a Tailscale name. Muxen uses your keys and your ssh config, so jump hosts, ports and identity files you’ve set up there apply.

Direct connections

On a machine’s page, Connect directly in the Connection card pairs the app with the agent there. Each side trusts only the other’s certificate, swapped over ssh, and the agent’s listener runs as a user service on the machine: systemd on Linux, launchd on a Mac, a scheduled task at sign-in on Windows (with a firewall rule).

  • Direct connections use QUIC on UDP port 47821. There’s no ssh in between, which helps the desktop and busy terminals most.
  • When the direct connection is down, Muxen falls back to ssh on its own, and goes back to direct when it can.
  • Use ssh only in the same card turns it off again.
  1. 01

    Connect directly

    On the machine’s page, in the Connection card.

  2. 02

    Pairing over ssh

    The app and the agent swap certificates; the listener starts as a user service.

  3. 03

    QUIC on UDP 47821

    Muxen connects directly, and falls back to ssh whenever that’s down.

Pairing happens once per machine.

On a Mac, direct connections need the Local Network permission. If the card says the machine is “not reachable on this network”, allow Muxen in System Settings › Privacy & Security › Local Network and reopen it. When the machine is a Mac, allow muxen-agent there on that Mac too.

If direct doesn’t connect and neither of those is the reason, the card says “Direct didn’t connect (UDP 47821 blocked?), so it’s ssh.” A firewall between you and the machine is the usual cause.

Local network and Tailscale

If Tailscale is on this computer, Muxen uses it to reach your machines away from home. It only reads Tailscale’s status and never changes its settings.

  • Home network first. A paired machine is tried at its local-network address first, and at its Tailscale address a moment later; the first to answer wins.
  • Moving. When you change networks, connections that stopped working are rebuilt the best way from where you are. Open terminals and desktops carry on (“Reconnecting…”).
  • ssh too. If a machine’s host only works at home (a local IP), ssh goes to its tailnet address when the usual one doesn’t answer.
  • Peer-to-peer or relay. Through Tailscale, the card says whether traffic goes straight to the machine or through one of Tailscale’s relays, which is slower.

The Connection card shows all of this: Direct or Over ssh, then Local network or Tailscale, and the round trip in milliseconds. Below that, whether the machine is on your tailnet. On a Linux machine that isn’t, Set up Tailscale types the install command into a shell there for you to run.

Beacon's page with a web server open at localhost:5173, and the Connection card below: direct, local network, a few milliseconds. Beacon's page with a web server open at localhost:5173, and the Connection card below: direct, local network, a few milliseconds.
The Connection card on a machine’s page, under its servers.

A forwarded port

If a machine is behind a router or NAT and you forward a UDP port to it, tell Muxen where direct connections reach it with direct_address in config.toml:

[[machine]]
name = "NAS"
host = "nas"
direct_address = "nas.example.com:47822"

VMs Muxen makes get one automatically: their host forwards a UDP port to each VM, and the card says “QUIC through Beacon’s forwarded port 47822”.

Machines reached through another

A machine you reach through another one, with ProxyJump in your ssh config (or -J), is shown under that machine in the sidebar. Its Connection card says “One ssh connection through Beacon”, and “Through Beacon: reachable wherever Beacon is.” When it can’t be reached, Muxen says whether the machine in front of it is off, or up with nothing answering behind it.

Disconnecting

Disconnect (in the Connection card, or a machine’s right-click menu) stops everything for that machine: Muxen closes its connection and stops checking it and reading its sessions. The sessions keep running there.

  • It shows as Disconnected until you Connect it again, from its page, its menu, or search.
  • It’s kept in config.toml as disconnected = true.
  • Anything that would reach it fails with “Connect to it first.”

From the command line

muxen connection beacon              # how it's reached, and how fast
muxen connection beacon --direct on  # pair for direct connections
muxen disconnect beacon
muxen connect beacon