Tailscale: Secure Remote Access to Your Home
Set up Tailscale to reach your home network from anywhere with no port forwarding, using an encrypted WireGuard mesh, MagicDNS, and subnet routing.
Reaching your home network from outside used to mean opening router ports, wrestling with dynamic DNS, and exposing services to the entire internet for anyone to scan. Tailscale deletes all of that. It builds a private mesh VPN between your devices over WireGuard, so your phone, laptop, and home server talk directly through an encrypted tunnel, even across NAT, firewalls, and carrier-grade NAT.
Quick answer
Tailscale lets you reach your home network from anywhere with no port forwarding and nothing exposed to the public internet. You install the app on each device, log in with an identity provider you already use (Google, Microsoft, GitHub), and the devices join a private encrypted mesh called a tailnet built on WireGuard. Turn on MagicDNS to reach devices by name, and set up a subnet router on one always-on machine so even gear that cannot run Tailscale (printers, cameras, smart-home hubs) is reachable. It is free for personal use.
The payoff: sit in a coffee shop and reach your home NAS, media server, or desktop as if you were on your own couch, with no ports forwarded and nothing exposed publicly. This guide gets you from zero to a working tailnet.
Key takeaways
- Tailscale wraps WireGuard in a coordination layer that handles NAT traversal, DNS, and keys for you.
- No port forwarding is required, and nothing is exposed to the public internet.
- Your devices form a private tailnet authenticated through a login you already own.
- MagicDNS lets you reach devices by name instead of IP address.
- A subnet router exposes your whole home LAN, so even non-Tailscale devices are reachable.
How Tailscale works
Tailscale takes WireGuard, which is fast and secure but manual to configure, and adds a coordination layer. That layer manages key exchange, punches through NAT and firewalls, and keeps a directory of your devices. You install the app, log in with an identity provider like Google, Microsoft, or GitHub, and the device joins your tailnet. Traffic between your devices then flows through an encrypted point-to-point tunnel.
Because authentication rides on single sign-on you already trust, there are no VPN passwords to manage and no public endpoints for attackers to scan.
How does it stack up against the older ways of getting into your home network? This is why most people switch:
| Method | Port forwarding | Exposed to internet | Setup difficulty |
|---|---|---|---|
| Tailscale (WireGuard mesh) | None | Nothing | Easy |
| Self-hosted WireGuard | Yes | One UDP port | Moderate |
| OpenVPN on router | Yes | One port | Hard |
| Port-forward each service | Yes, many | Every service | Risky |
| Cloudflare Tunnel | None | Via Cloudflare | Moderate |
The standout is the "exposed to internet" column. Tailscale exposes nothing, which removes the entire category of attacks that scan the internet for open VPN and service ports.
Set up your tailnet
-
Create your tailnet. Go to the Tailscale site and sign in with an identity provider you already use. This creates your tailnet on the first login.
-
Install on your home device. Install Tailscale on the machine you want to reach, such as a home server, NAS, or always-on desktop. On Linux, the one-line install script followed by
sudo tailscale upprints a login URL. -
Authenticate the device. Open the printed URL in a browser and log in to add the device to your tailnet. It now appears in your admin console with a Tailscale IP.
-
Install on your other devices. Add Tailscale to your phone and laptop and log in with the same account. They all join the same private mesh.
-
Enable MagicDNS. In the admin console, turn on MagicDNS so you can reach devices by hostname instead of remembering IP addresses.
-
Test the connection. From your laptop on a different network, connect to your home server by its MagicDNS name. You are now reaching it over the encrypted tunnel.
Reach your whole home network
Installing Tailscale on every device is ideal, but some gear (printers, smart-home hubs, IP cameras) cannot run it. The fix is a subnet router: pick one always-on machine on your home LAN, advertise your home subnet from it, and approve the route in the admin console. Now any device on your tailnet can reach every device on your home network through that one router, even the ones that cannot run Tailscale themselves.
Note
For SSH access, Tailscale SSH lets you connect to devices on your tailnet without managing SSH keys. It authenticates users through your identity provider and authorizes access with centralized access-control lists instead of distributing public keys to every machine.
Security notes
Tailscale's appeal is that it shrinks your attack surface. Nothing is exposed to the public internet, every connection is end-to-end encrypted, and access is controlled centrally with ACLs. That said, your tailnet is only as secure as the accounts that can log into it, so protect those with strong authentication. Our guide on setting up passkeys is a good companion for hardening the identity provider you sign in with, and the secure home router checklist covers the LAN side that your subnet router exposes.
If you want a full self-hosted VPN instead of a managed mesh, our guide to running WireGuard on your router covers that path, and our Pi-hole on a Raspberry Pi guide pairs nicely with a subnet router for network-wide ad blocking on the go.
What you can actually do with it
Once your tailnet is up, the practical wins are immediate:
- Reach your home NAS or media server from anywhere without exposing it publicly.
- SSH into a home machine using Tailscale SSH, no keys to distribute.
- Use your home Pi-hole or DNS while traveling for ad blocking and filtering.
- Access IP cameras, printers, and smart-home hubs through a subnet router.
- Connect two homes or a home and an office into one private network.
What to do right now
To get from nothing to a working setup in about fifteen minutes:
- Create your tailnet by signing in at tailscale.com with Google, Microsoft, or GitHub.
- Install Tailscale on your always-on home machine and run
sudo tailscale up, then authenticate. - Install it on your phone and laptop with the same login so they join the same mesh.
- Enable MagicDNS in the admin console to reach devices by name.
- Set up a subnet router on one home machine and approve the route, so non-Tailscale gear is reachable.
- Harden the login with passkeys or strong MFA, since your whole tailnet depends on that account.
Frequently asked questions
Do I need to forward ports on my router for Tailscale?
No. Tailscale punches through NAT and firewalls automatically, so no ports are forwarded and nothing is exposed to the public internet.
Is Tailscale actually secure?
Yes. It builds end-to-end encrypted WireGuard tunnels between your devices, exposes nothing publicly, and controls access through centralized ACLs tied to your single sign-on login.
How do I reach a device that cannot run Tailscale?
Set up a subnet router on an always-on machine on your home LAN and advertise the subnet. Approved routes let your tailnet reach every device on that network.
What is MagicDNS?
MagicDNS assigns memorable hostnames to your tailnet devices so you connect by name rather than IP address. Enable it in the admin console.
