New tonie and away from home -> Wireguard and macvlan?


I am trying to add tonies when I am not at home :slight_smile: To do this my plan is to make a wifi hotspot with my phone and tunnel the traffic from the toniebox home with a vpn (wireguard).

I have TeddyCloud running on a respberry pi and also a wireguard (pivpn) instance. Unfortunately, this is not complicated enough. Port 443 is in use on the pi so i used macvlan according to this link. I assigned a seperate ip adress to the docker container ( The pi has Everything is working so far.

I confirmed that my wireguard instance is working. I can access other ip adresses on the network when I am not at home i.e. or

The only ip adress i cannot reach is

After some research i learned about a limitation of macvlan link. Maybe a can get this to work but then i found out that on android the wifi hotspot data is not tunneled through VPN :frowning:

Has anybody managed a easy setup so you can play new tonies when you are not at home for initial setup? Any ideas? Lets say the kids get a tonie as a gift and want to play it immediately?

Hosting Teddycloud public on the internet is also a bad idea i think.

TeddyCloud is awesome! Thanks for your great work! :+1:

Hi Martin,

just to promote your question: I am also planning to do the same with a similar set-up. I didn’t try yet as I have only set-up my @home wifi on the toniebox. Is there anything to consider when setting up a second wifi (for the hotspot)? Then I will try as well.

I don’t understand your comment “on android wifi hotspot data is not tunneled via VPN”. When I use my smartphone with VPN tunnel (wireguard) activated as hotspot the clients can access my remote network as well…


Hello Johannes,

I used pivpn because it is very easy to set up. Generated a user. Scanned the qr code with the phone. Forwarded the port on the router. Done.

Unfortunately, my hotspot client (laptop) cannot access the remote network. To verify this, I did the following: I removed my phone from local wifi. I remove my laptop from local wifi. I activate wireguard on the phone. Then I activated the hotspot on the phone. Then I connected my laptop to the phone hotspot.

On my phone I can access i.e. On my laptop I cannot access. This leads me to the conclusion that wifi hotspot traffic is not routed over wireguard. I found also lots of threads on the internet with the same problem: Link or Link. Did you have to check some box on the phone or how did you get this working? My only option I think is to take a cheap travel router with me as a VPN gateway. :frowning:

My big mistake was that I hosted wireguard on one ip and because 443 was already in use on that device I created a second one with macvlan and put Teddycloud there. As far as I understand there is no direct communication between those two ip addresses possible. I would not recommend this. I never got it working.