How your devices reach your host

Your host is sometimes on the same Wi-Fi as you, sometimes behind a router in another country, and sometimes both within the same hour. Offsite does not ask you to know which.

The three paths

Path	When it works	Typical latency
Local network	your device and the host share a network	single-digit milliseconds
Tailscale	both machines are on the same tailnet	tens of milliseconds
Relay	always, as long as both sides can reach the internet	a hundred milliseconds and up

All reachable paths are tried at once; the first to answer carries the session. The highlighted path is the winner in this example — walk out of the building and the relay takes over, without dropping what you were doing.

Racing, not configuring

The client attempts every path it knows at the same time and uses whichever answers first. There is no “connection type” for you to pick and no wrong choice to make.

When a better path becomes available later — you walk back into your own network — Offsite switches to it live, without dropping your session.

The pill never lies

The connection pill in the app names the path actually in use and its latency. If it says relay, you are on the relay; if it says LAN at 7 ms, that is a measurement, not a label.

So when something feels slow, the pill tells you whether the network or the agent is responsible.

Turning the relay off

The relay is optional and switchable per host. Switch it off and that host is reachable only on your own network and your tailnet. Nothing else changes.

See The relay for what it can and cannot see.

Details

• Endpoint kinds on the wire are lan, tailscale and relay; a host profile additionally records how it authenticates (relay, directSSH, tailscale).
• LAN endpoints are discovered with Bonjour, which is why macOS asks for local network permission on first launch. Decline it and everything still works — connections take a slower path.
• Every path terminates in the same place: Offsite’s embedded agent on the host, over an SSH-backed RPC channel. There is no separate “relay mode” protocol, which is why a path switch does not reset your session.
• Both clients enforce connect deadlines (15 s and 30 s) so a black-holed socket fails instead of hanging forever.
• macOS localhost connections use the same architecture — the local host is not a special case.