The clean current way to use Twingate with CasaOS is to run a Twingate Connector as a Docker container on the CasaOS host or another machine inside the same LAN. The Connector makes outbound connections to Twingate, so you do not need to port-forward the CasaOS dashboard.
The 2023 forum tutorial predates Twingate's current Docker Compose template. Use the current Connector tokens and official Compose variables rather than copying an old one-click store package blindly.
Create a Remote Network and Connector
In the Twingate Admin Console, create a Remote Network and a Connector. Twingate generates a unique Access Token and Refresh Token for that Connector.
Use the Current Docker Compose Template
The current Twingate Docker Compose guide documents these mandatory variables:
services:
twingate-connector:
image: twingate/connector:latest
restart: always
environment:
- TWINGATE_NETWORK=YOUR_TENANT
- TWINGATE_ACCESS_TOKEN=YOUR_ACCESS_TOKEN
- TWINGATE_REFRESH_TOKEN=YOUR_REFRESH_TOKEN
Keep Tokens Out of Public Screenshots
Access and refresh tokens uniquely authenticate the Connector. Store them in the CasaOS app configuration or an environment file that is not committed to Git or posted publicly.
Add CasaOS as a Twingate Resource
In the Twingate Admin Console, define the CasaOS LAN IP or hostname and the web port as a Resource. Grant access only to the users/groups that need it.
Bridge vs Host Networking
Twingate says bridge mode is the default, while host mode can help with local peer-to-peer networking. Start with the official default unless you have a specific reason to share the host network stack.
No Router Port Forward Is Required
The Connector sits behind the firewall and establishes outbound connectivity. Do not open the CasaOS admin port to the public internet just because you want remote access.
Install the Twingate Client on Your Remote Device
The Connector runs inside your home network; the Twingate Client runs on the laptop/phone you use remotely. Both register with the Twingate network before traffic reaches the private Resource.
Verify Access Before Adding More Resources
Test the CasaOS dashboard first, then add other NAS apps individually. This keeps access policy explicit instead of exposing an entire subnet unnecessarily.
The private remote access guide gives broader home-server context.
Check Connector Health Before Testing CasaOS
docker ps | grep twingate
docker logs --tail 100 twingate-connectorThe Connector should register successfully and remain running. If it repeatedly restarts, verify tenant name and tokens before troubleshooting the CasaOS Resource.
Use the Narrowest Resource Definition
If you only need the CasaOS dashboard, define the exact CasaOS IP and web port instead of exposing the whole LAN subnet. Add other apps as separate Resources when you actually need them.
Plan for Connector Updates
Twingate publishes container updates independently of CasaOS. Periodically pull the current Connector image and restart it during a maintenance window, then confirm remote access still works.
FAQ
Do I need to open CasaOS ports on my router?
No. Twingate Connectors are designed to run behind the firewall and establish outbound connectivity.
Where do the Twingate tokens come from?
The Admin Console generates them when you deploy a Connector.
Should I use host networking?
Only when needed for your topology or peer-to-peer behavior; bridge is the default.
Can one Connector expose more than CasaOS?
Yes, but define Resources and permissions deliberately instead of granting broad subnet access by default.
