--- title: "Remote Desktop Without VPN or Port Forwarding — PocketRocket" description: "PocketRocket finds your Mac through iCloud, then tries the local network, your VPN, a direct path and a relay. Works behind CGNAT and on 5G." canonical: https://pocketrocket.click/en/how-it-works/ lang: en updated: 2026-09-30 --- # Remote desktop without a VPN or port forwarding It finds the way. You just connect. No VPN to set up. No ports to forward. No IP addresses to remember. PocketRocket Host needs a Mac with Apple silicon and macOS 26.1 or later. The PocketRocket app is coming soon to the App Store. ## Three steps. Then just tap. 1. Install PocketRocket Host on your Mac. It lives in the menu bar and introduces your Mac to your devices through iCloud. 2. Get PocketRocket on your other devices. iPhone, iPad, Apple Vision Pro or another Mac, signed in to the same Apple Account. 3. Tap your Mac. It’s already on the list. No codes, no IP addresses. ## How does PocketRocket find my Mac? *No IP addresses. No codes.* Through iCloud. PocketRocket Host publishes the name and public key of your Mac to your iCloud account, and every device signed in to the same Apple Account gets a tile for it automatically. There’s nothing to type and no pairing code. On the same network, Bonjour spots your Mac live and shows a green LAN badge. ## Can I control my Mac without a VPN or port forwarding? *Closest first.* Yes. PocketRocket finds your Mac through iCloud and tries your local network first, then an optional VPN, then a direct path. If none of those works⁠—for example behind carrier-grade NAT or on 5G⁠—both sides connect outward through a relay that only passes encrypted bytes, so there’s nothing to configure on your router. ### Same network? Found live with Bonjour and marked with a green LAN badge. ### Already on WireGuard or Tailscale? Add the VPN address of your Mac, and PocketRocket can use it⁠—switching without dropping the session. ### Direct, when your router allows it. PocketRocket Host can map a port with NAT-PMP or UPnP⁠—designed to stay open only for the session. ### When nothing else gets through. Behind carrier-grade NAT or on 5G, both sides connect outward to the relay, which forwards encrypted bytes it can’t read. ### Moves without dropping. The new path is ready before the old one closes. ### Your Mac decides. Turn off any path in PocketRocket Host. | Path | Used when | You set up | | --- | --- | --- | | Local network (LAN) | Your device and your Mac are on the same network; Bonjour finds the Mac | Nothing | | VPN | You use WireGuard or Tailscale and add the VPN address of your Mac | The VPN address (optional) | | Direct (NAT) | Your router supports NAT-PMP or UPnP; PocketRocket Host maps a port automatically (by design, only for the session) | Nothing | | Relay | Anything else⁠—carrier-grade NAT, 5G; both sides connect out | Nothing | *Connection paths, in the order PocketRocket tries them.* ## Do I need to open ports on my router? *Hands off the router.* No. If your router supports NAT-PMP or UPnP, PocketRocket Host is designed to open a port only while a session runs and close it 120 seconds after it ends; the session starts through the relay and moves to the direct path once it’s ready. Either way, you never forward ports by hand. ## Can I use Tailscale or WireGuard? *Bring your own tunnel.* Yes, if you want to⁠—it’s optional. Add the VPN address of your Mac, for example from WireGuard or Tailscale, to a connection, and PocketRocket will use that path whenever the tunnel is up, switching paths without dropping the session. You don’t need a VPN for PocketRocket to work. ## Does it work behind CGNAT or on 5G? *No public IP. No problem.* Yes. When a direct connection isn’t possible⁠—behind carrier-grade NAT, on 5G or on hotel Wi-Fi⁠—your device and your Mac both connect out to the PocketRocket relay, which passes encrypted bytes between them. We’ve tested it on 5G and on hotel Wi-Fi abroad. The first seconds of a session may run through the relay. ### How we tested - A 5G connection - Hotel Wi-Fi in Spain - The host Mac at home ## What happens when my connection gets worse? *Detail never slows you down.* PocketRocket adapts in the background, never at the expense of latency. When the connection weakens, it raises compression first, then lowers the frame rate, then reduces detail, while adaptive error correction and a mode for 5G radio losses handle dropped packets. PocketRocket Host lets you set a bandwidth cap and the lowest frame rate: 15, 20, 30, 60 fps. ### Take a closer look. Compression Standard Frame rate Full Detail Full Drag the slider to weaken the connection and watch what gives way first. ### The picture, in facts - **HEVC** encoded in hardware, no B-frames - **Decoded in hardware,** drawn with Metal - Up to **60 fps** - Your minimum: **15, 20, 30, 60 fps** (PocketRocket Host › Advanced › Sharpness vs fluidity) - Bandwidth cap from **1 Mbps** to no limit - **Adaptive error correction;** 5G loss mode ## What happens when my network changes? *Step away. Come back. Carry on.* PocketRocket keeps going. When you walk from Wi-Fi to 5G, or come back to the app after a while, it resumes the session behind a single glass curtain instead of starting over. In the background, the session stays alive for as long as you choose⁠—from 30 seconds to 10 minutes⁠—or you can turn that off. ## Can I copy and paste files between my device and my Mac? *Copy on iPad. Paste on Mac.* Yes, both ways. Text, images and files move through a shared clipboard between your device and your Mac. Your device sets the size limit⁠—16 MB by default, adjustable from 128 KB to 1 GB on iPhone, iPad and Mac. Larger items are skipped on iPhone, iPad and Apple Vision Pro; a Mac fetches them when you paste. Change the limit in Settings › PocketRocket › Clipboard on iPhone and iPad, or in PocketRocket Settings (⌘,) › Clipboard on Mac. On Apple Vision Pro, it’s fixed at 16 MB. ## A display cut to fit. PocketRocket doesn’t squeeze the screen of your Mac into your device. It gives your Mac a new virtual display with the exact proportions of your window. [See it on iPad](https://pocketrocket.click/en/ipad/#pixels) ## Hardware all the way. Your Mac encodes the screen in hardware⁠—HEVC through VideoToolbox, in a low-latency mode without B-frames. Your device decodes it in hardware and draws it with Metal. Your Mac 1. **Encode** HEVC, in hardware 2. **Encrypt** ChaCha20-Poly1305 Your device 1. **Decode** In hardware 2. **Draw** With Metal ### Sound, too. Sound from your Mac arrives at 48 kHz, encoded with Opus in mono or stereo at up to 256 kbps, with a buffer that adapts to your network. ## One session, step by step. 1. PocketRocket Host publishes the name and public key of your Mac to your iCloud account. 2. Your device, on the same Apple Account, shows the Mac as a tile. 3. PocketRocket tries paths in order: local network → VPN → direct → relay. 4. Both sides agree on fresh session keys (X25519), and your Mac proves its identity (Ed25519). 5. If the session started on the relay, it moves to a better path when one is ready⁠—without reconnecting. 6. The displays of your Mac go dark; your session runs on a virtual display made for your device. ## Before you start. ### Can I access my Mac remotely over the internet without a VPN or port forwarding? Yes: PocketRocket finds your Mac through iCloud and connects over your local network, an optional VPN, a direct connection or an encrypted relay⁠—whichever works first. Behind carrier-grade NAT or on 5G, both sides connect outward to the relay, which forwards encrypted bytes it can’t read, so there’s nothing to configure on your router. ### How does PocketRocket find my Mac without an IP address? Through iCloud: PocketRocket Host publishes the name and public key of your Mac to your iCloud account, and devices on the same Apple Account get a tile for it automatically. There’s nothing to type and no pairing code. On the same network, Bonjour spots your Mac live and shows a green LAN badge. ### Do I need a pairing code or an ID and password to connect to my Mac? No: there are no codes⁠—devices signed in to the same Apple Account find your Mac through iCloud. Your Mac shares its public key through your iCloud account and doesn’t answer anyone who can’t prove they know it. ### Do I need to open ports on my router for PocketRocket? No: PocketRocket works without port forwarding, and when your router supports NAT-PMP or UPnP, PocketRocket Host is designed to map a port only for the length of a session. By design, the port closes 120 seconds after the session ends, and the session starts through the relay and moves to the direct path once it’s ready. Either way, you never forward ports by hand. ### Does PocketRocket work on 5G or behind carrier-grade NAT (CGNAT)? Yes: when a direct connection isn’t possible, your device and your Mac both connect out to the PocketRocket relay, and it has been tested on 5G and on hotel Wi-Fi abroad. The relay only passes encrypted bytes between them. The first seconds of a session may run through the relay while a more direct path is prepared. ### Can I use PocketRocket with Tailscale or WireGuard? Yes, optionally: add the VPN address of your Mac to a connection, and PocketRocket uses that path whenever the tunnel is up. PocketRocket switches paths without dropping the session, and you don’t need a VPN for PocketRocket to work. ### Why does my session sometimes start through the relay? PocketRocket uses whatever path works first⁠—often the relay⁠—and moves the session to a more direct path when one becomes available, without dropping it. The new path is ready before the old one closes. On the relay, your session stays end-to-end encrypted, and the relay only forwards bytes it can’t read. ### What happens if my network changes during a session? The session resumes behind a single glass curtain instead of starting over, and it can stay alive in the background for as long as you choose⁠—from 30 seconds to 10 minutes. When you walk from Wi-Fi to 5G, PocketRocket switches paths without dropping the session. You can also turn keeping the session alive in the background off. ### What happens to the picture when my connection gets worse? PocketRocket adapts without adding delay: it raises compression first, then lowers the frame rate, then reduces detail, with adaptive error correction and a mode for 5G radio losses. In PocketRocket Host, you can cap the bandwidth anywhere from 1 Mbps to no limit and set the lowest acceptable frame rate⁠—15, 20, 30 or 60 fps⁠—under Advanced › Sharpness vs fluidity. ### Can I hear the sound of my Mac on my iPhone, iPad or Apple Vision Pro? Yes: the sound of your Mac plays on your device, encoded with Opus in mono or stereo at up to 256 kbps. It’s captured at 48 kHz and played through an adaptive buffer with clock correction. ### Can I copy text and files between my iPad or iPhone and my Mac? Yes: the clipboard works both ways for text, images and files, up to a size limit you set on your device⁠—16 MB by default. The limit is adjustable from 128 KB to 1 GB on iPhone, iPad and Mac, and fixed at 16 MB on Apple Vision Pro. Larger items are skipped on iPhone, iPad and Apple Vision Pro; a Mac fetches them when you paste. ### What frame rate does PocketRocket stream at? Up to 60 frames per second; for a weak connection you choose the lowest acceptable rate⁠—15, 20, 30 or 60⁠—in PocketRocket Host, and Apple Vision Pro displays the session at 90 Hz. [Full answer ›](https://pocketrocket.click/en/specs/#faq-frame-rate) ### Does my session stay connected when I leave the app on iPhone? Yes, for as long as you choose⁠—from 30 seconds to 10 minutes, or not at all⁠—while a Live Activity in the Dynamic Island shows the connection. [Full answer ›](https://pocketrocket.click/en/iphone/#faq-iphone-background) ### Will I see black bars around my Mac desktop on iPad or iPhone? No: PocketRocket gives your Mac a virtual display in the exact proportions of your window⁠—2752 × 2064 on the 13-inch iPad Pro⁠—so nothing is letterboxed or cropped. [Full answer ›](https://pocketrocket.click/en/ipad/#faq-ipad-full-screen) ### Can the PocketRocket relay server see my screen? No: the relay only forwards encrypted bytes it can’t decrypt, and your Mac signs its identity, so the relay can’t pose as your Mac. [Full answer ›](https://pocketrocket.click/en/security/#faq-relay-see-screen) ## Leave your Mac at home. Take it everywhere. PocketRocket Host needs a Mac with Apple silicon and macOS 26.1 or later. The PocketRocket app is coming soon to the App Store. ## One Mac. Four ways in. - [iPhone Your Mac fits in your pocket.](https://pocketrocket.click/en/iphone/) - [iPad Your Mac, tailored to iPad.](https://pocketrocket.click/en/ipad/) - [Apple Vision Pro A world away. Right in front of you.](https://pocketrocket.click/en/apple-vision-pro/) - [Mac Home is where your Mac is.](https://pocketrocket.click/en/mac/) [**And on your Mac: PocketRocket Host ›**The menu bar app for the Mac you connect to.](https://pocketrocket.click/en/host/) ## Footnotes 1. A new connection may start through the relay for its first seconds while a more direct path is prepared.