Connect Heeler through EasyTier

1. Install EasyTier on the Mac

1. Download the ZIP from the EasyTier v2.6.4 release: easytier-macos-aarch64-v2.6.4.zip for Apple silicon or easytier-macos-x86_64-v2.6.4.zip for Intel.

2. Extract it in Downloads, then run this in Terminal (on an Intel Mac, change aarch64 to x86_64):

   Terminal

   Copy code

   ET_BIN="$HOME/Downloads/easytier-macos-aarch64"
   "$ET_BIN/easytier-core" --version

   Expect 2.6.4.

3. macOS blocks each EasyTier program the first time it runs. Open System Settings > Privacy & Security, click Open Anyway for that program, and run the command again. Do not turn off Gatekeeper.

2. Start EasyTier on the Mac

In the same Terminal window as step 1, run this. Replace 192.168.1.20 with your Mac's IP address, and type your secret when asked.

read -rs 'ET_NETWORK_SECRET?EasyTier network secret: '
printf '\n'
export ET_NETWORK_SECRET
ET_LISTEN_HOST=192.168.1.20

"$ET_BIN/easytier-core" \
  --network-name heeler-home \
  --hostname heeler-mac \
  --ipv4 10.144.144.2/24 \
  --listeners "tcp://$ET_LISTEN_HOST:21010" \
  --rpc-portal 127.0.0.1:15888 \
  --no-tun \
  --private-mode true \
  --disable-upnp \
  --disable-p2p \
  --accept-dns false

• If macOS asks about incoming connections, allow them.
• Leave this Terminal window open. EasyTier stops when you close it.
• Anyone who joins this network can reach SSH and other services that listen only on the Mac itself, so keep the secret private.
• Save the secret in your password manager; you will type it into Heeler next.

3. Add the network in Heeler

Open Settings > Overlay Networks > Add Network, choose EasyTier, and keep Network selected.

Tap Add and Connect. When the network shows Connected, your Mac appears under Peers at 10.144.144.2.

4. Add the Mac as a Host

Tap Add next to the Mac under Peers, or follow Connect from Heeler with Home EasyTier as the Network.

• Address: 10.144.144.2, port 22
• User: your Mac username, with the sign-in method you picked
• Jump Host: none

Save. Trust the SSH fingerprint only if it matches the one from your Mac, then complete Verify the connection. For the cellular check, first follow Reaching a Mac outside the LAN.

1. Get the server URL

Ask the server's admin for the configuration URL. It ends with your account name, for example tcp://192.168.1.20:22550/USER or wss://et.example.com/USER. It is not the web console's address.

Only use a server you trust: it can see the network secrets it hands out. Over the internet, use a wss:// URL.

ET_BIN="$HOME/Downloads/easytier-macos-aarch64"
ET_WEB_DATA="$HOME/Library/Application Support/Heeler-EasyTier-Console"
mkdir -p "$ET_WEB_DATA"
chmod 700 "$ET_WEB_DATA"
umask 077

"$ET_BIN/easytier-web-embed" \
  --db "$ET_WEB_DATA/et.db" \
  --config-server-port 22550 \
  --config-server-protocol tcp \
  --api-server-port 11750 \
  --api-server-addr 127.0.0.1 \
  --web-server-addr 127.0.0.1 \
  --api-host http://127.0.0.1:11750 \
  --console-log-level warn

2. Register Heeler's device

1. Open Settings > Overlay Networks > Add Network, choose EasyTier, then Config Server.
2. Enter a Name that differs from any other network, such as Home EasyTier Console.
3. Paste the configuration URL into Server.
4. Give it a recognizable Device name, and leave Advanced at Encryption required.
5. Note the Machine ID, then tap Add and Connect.

Heeler shows Connecting…, then Waiting for a network. In the web console, your phone now appears by its device name and Machine ID.

3. Assign a network in the console

In the console, open your phone's device page, choose Create Network, and fill in:

Click Run Network. Saving alone does nothing until the network runs.

In Heeler, the network shows Connected with the Mac as a peer. Add the Mac as a Host at 10.144.144.2 (as in step 4 above), choosing this network, then complete Verify the connection.

1. Start the relay on the VPS

1. Download the v2.6.4 Linux ZIP for your VPS (easytier-linux-x86_64-v2.6.4.zip or easytier-linux-aarch64-v2.6.4.zip) and extract it.
2. Allow inbound TCP 21010 in the VPS firewall and your cloud provider's security group.
3. Run this in Bash, with ET_BIN set to the extracted folder (easytier-linux-x86_64 or easytier-linux-aarch64). Enter the same secret as before.

ET_BIN="$HOME/easytier-linux-x86_64"
read -r -s -p 'EasyTier network secret: ' ET_NETWORK_SECRET
printf '\n'
export ET_NETWORK_SECRET

"$ET_BIN/easytier-core" \
  --network-name heeler-home \
  --hostname heeler-relay \
  --listeners tcp://0.0.0.0:21010 \
  --rpc-portal 127.0.0.1:15888 \
  --no-tun \
  --private-mode true \
  --disable-upnp \
  --disable-p2p \
  --accept-dns false

The relay stops when you close the SSH session. Run it inside tmux for a quick test, or as a system service to keep it running.

The VPS holds your network secret, so use one only you control.

2. Connect the Mac to the relay

Stop the earlier Mac command with Control-C. In the same Terminal, run this instead, replacing YOUR_VPS_IP:

"$ET_BIN/easytier-core" \
  --network-name heeler-home \
  --hostname heeler-mac \
  --ipv4 10.144.144.2/24 \
  --peers tcp://YOUR_VPS_IP:21010 \
  --no-listener \
  --rpc-portal 127.0.0.1:15888 \
  --no-tun \
  --private-mode true \
  --disable-upnp \
  --disable-p2p \
  --accept-dns false

Keep it running.

3. Point Heeler at the relay

• Network mode: open the network, choose … > Edit, and change Peers to tcp://YOUR_VPS_IP:21010. Leave Secret blank to keep it.
• Config Server mode: change Peer URLs in the console to tcp://YOUR_VPS_IP:21010. The configuration URL must also be reachable from outside your home network.

Your Host stays at 10.144.144.2, port 22; do not use the VPS address.

To test, turn off Wi-Fi on your phone and open the Host. You should get a working terminal over cellular.