How to Set Up Tailscale for Secure Remote Access to Your Home Network

In this article

Understanding How Tailscale Functions
Step 1: Create an Account and Register Your Primary Node
Creating Your Account
Installing Tailscale on a Linux Server or Raspberry Pi
Step 2: Connect Mobile Devices and Client Laptops
Step 3: Enable Subnet Routing for Unsupported Local Devices
Configuring the Subnet Router on Linux
Approving the Route in the Admin Console
Step 4: Configure an Exit Node for Secure Browsing
Setting Up the Exit Node Host
Using the Exit Node on Client Devices
Essential Security Configurations for Tailscale
Enable MagicDNS
Configure Key Expiry Policies
Implement Access Control Lists (ACLs)
Frequently Asked Questions
Does Tailscale route all my internet traffic through home by default?
Is my data exposed to Tailscale’s central servers?
Can Tailscale work if my home internet uses CGNAT?
Does running Tailscale drain mobile device batteries quickly?
Conclusion

Accessing local home network services while away from home used to require complex networking configurations or risky security trade-offs. Setting up traditional OpenVPN servers, configuring dynamic DNS services, and opening inbound ports on a router exposed local networks to continuous automated scanning and potential brute-force attacks across the internet. Carrier-Grade NAT (CGNAT) implemented by many modern fiber, cable, and mobile ISPs added another layer of difficulty, making incoming connections impossible without dedicated public IP addresses.

Tailscale solves these challenges by creating a zero-configuration, software-defined mesh network overlay based on the WireGuard VPN protocol. Instead of routing all network traffic through a central gateway server, Tailscale establishes encrypted peer-to-peer connections directly between your authenticated devices. This guide walks you through setting up Tailscale to access your home lab, NAS, SSH servers, and local web applications securely from any location without opening a single port on your home router.

Understanding How Tailscale Functions

To use Tailscale effectively, it helps to understand its underlying architecture. Tailscale forms a virtual private network—referred to as a tailnet—among your trusted endpoints. Every device connected to your tailnet receives a fixed, private IPv4 address (in the 100.x.y.z range) and an IPv6 address that remain consistent regardless of which physical network the device joins.

Key elements of this architecture include:

WireGuard Protocol: All data transmitted between endpoints is encrypted using state-of-the-art cryptography, including ChaCha20 encryption and Poly1305 authentication.
Direct Peer-to-Peer Connections: Tailscale uses NAT traversal techniques (STUN and ICE protocols) to establish direct connections between your endpoints, keeping latency to a minimum.
Encrypted Relay Services (DERP): If strict corporate firewalls or aggressive NATs prevent a direct point-to-point connection, traffic routes safely through Tailscale’s encrypted Designated Encrypted Relay for Packets (DERP) servers without compromising privacy.
Centralized Key Exchange: Tailscale manages public key distributions and device authentication through single sign-on (SSO) providers like Google, Microsoft, or GitHub, eliminating the need to manually pass cryptographic certificates between machines.

Step 1: Create an Account and Register Your Primary Node

Getting started requires signing up for an account and enrolling the first system on your home network. This primary node is typically an always-on device, such as a Linux home server, a Raspberry Pi, or a Network Attached Storage (NAS) unit.

Creating Your Account

Navigate to the official Tailscale website and select the sign-up option.
Authenticate using your preferred identity provider (such as Google, Microsoft, Apple, or GitHub). Tailscale does not store passwords directly; it relies on your chosen provider’s identity management and multi-factor authentication (MFA).

Installing Tailscale on a Linux Server or Raspberry Pi

If your primary node runs Ubuntu, Debian, or Raspberry Pi OS, open a terminal session on the device and run the automatic installer script:

curl -fsSL https://tailscale.com/install.sh | sh

Once the installation finishes, authenticate the device to your tailnet by running:

sudo tailscale up

The terminal will output an authentication URL. Copy this link into your web browser, log in with your identity provider account, and approve the connection. Once approved, your server joins the tailnet and receives its permanent 100.x.y.z IP address.

Step 2: Connect Mobile Devices and Client Laptops

With your primary home node active, install Tailscale on the client devices you use while traveling or working remotely, such as your smartphone, tablet, or laptop.

Windows and macOS: Download the official installer from the Tailscale downloads page, install the application, click the menu bar icon, and select log in.
iOS and Android: Install the Tailscale application directly from the Apple App Store or Google Play Store, launch the app, and log in with the same authentication credentials used in Step 1.

Once signed in, your client devices appear in the Tailscale admin console alongside your primary home server. You can now access your server’s local services—such as SSH on port 22 or a web dashboard on port 8080—by using the server’s 100.x.y.z Tailscale IP address directly from your mobile device, regardless of whether you are on cellular data or public Wi-Fi.

Step 3: Enable Subnet Routing for Unsupported Local Devices

Many smart devices on a home network—such as network printers, IP cameras, microcontrollers, or smart home hubs—cannot run the Tailscale client app directly. You can access these endpoints remotely by configuring your always-on home server to act as a Subnet Router.

Configuring the Subnet Router on Linux

First, enable IP forwarding on your Linux host so it can pass network packets between your tailnet and your local physical network.

Open the kernel parameters configuration file:

sudo nano /etc/sysctl.conf

Add or uncomment the following lines to enable IPv4 and IPv6 packet forwarding:

net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1

Save the file and apply the new settings immediately:

sudo sysctl -p

Next, restart Tailscale on the server while advertising your local home subnet (for example, 192.168.1.0/24):

sudo tailscale up --advertise-routes=192.168.1.0/24

Approving the Route in the Admin Console

To prevent unauthorized network access, Tailscale requires manual administrative approval before advertised routes become active:

Open the Tailscale Admin Console in your browser.
Navigate to the Machines tab and locate your subnet router host.
Click the options menu (three dots) next to the device and select Edit route settings.
Enable the checkbox next to the advertised IP range (e.g., 192.168.1.0/24) and save.

Your remote mobile client can now communicate with any IP address on your home network as if it were connected directly to your local Wi-Fi router.

Step 4: Configure an Exit Node for Secure Browsing

When connecting to untrusted public Wi-Fi networks in cafes, hotels, or airports, unencrypted web traffic and DNS queries can be vulnerable to local interception. Tailscale allows you to route all client internet traffic through your home network connection by configuring your home node as an Exit Node.

Setting Up the Exit Node Host

On your always-on Linux server, announce its capability as an exit node:

sudo tailscale up --advertise-exit-node

Go to your Tailscale Admin Console, select the options menu for that server, enter Edit route settings, and check the box to approve the Use as exit node setting.

Using the Exit Node on Client Devices

To route mobile or laptop internet traffic through your home connection:

Open the Tailscale application on your client device (such as your phone or laptop).
Select Exit Nodes from the settings menu.
Choose your designated home server from the list and toggle the connection on.

All internet traffic from your client device will now travel through an encrypted WireGuard tunnel to your home server before heading out to the public internet, securing your remote web sessions and giving you your home network’s external IP address worldwide.

Essential Security Configurations for Tailscale

While Tailscale handles complex cryptographic setups automatically, configuring a few key settings ensures your overlay network remains fully secured over time.

Enable MagicDNS

Remembering IP addresses like 100.x.y.z can be inconvenient. MagicDNS automatically registers readable hostnames for every node on your tailnet. Navigate to the DNS tab in the Tailscale Admin Console and enable MagicDNS. You can now access your server by entering hostnames (such as http://homeserver) instead of numerical IP addresses.

Configure Key Expiry Policies

By default, Tailscale expires machine authorization keys every 180 days to ensure stale devices do not maintain persistent access. However, for fixed home servers acting as subnet routers or exit nodes, unexpected key expiration can disrupt remote access while you are away. In the Admin Console, find your permanent home server, open its settings menu, and select Disable key expiry to prevent unexpected disconnections.

Implement Access Control Lists (ACLs)

If you share your Tailscale network with family members or colleagues, you may not want every user to access every server port. Tailscale includes a flexible JSON-based ACL editor in the Admin Console that allows you to define granular access rules. You can restrict specific users to designated IP addresses or ports (such as granting access to a media server port while blocking administrative SSH access).

Frequently Asked Questions

Does Tailscale route all my internet traffic through home by default?

No. By default, Tailscale uses split-tunneling. Only traffic directed at other devices on your tailnet (or declared subnets) flows through the encrypted VPN tunnel. Standard internet browsing bypasses Tailscale unless you explicitly select an Exit Node on your client device.

Is my data exposed to Tailscale’s central servers?

No. Tailscale’s coordination server manages device identification, public encryption keys, and network topology rules, but it never has access to your private decryption keys. All data payload traffic is encrypted end-to-end between your devices before leaving the source host.

Can Tailscale work if my home internet uses CGNAT?

Yes. Tailscale uses NAT traversal techniques to establish direct peer-to-peer outbound connections from both sides. Because both devices initiate outbound connections to Tailscale’s discovery infrastructure, inbound port forwarding and public static IP addresses are not required.

Does running Tailscale drain mobile device batteries quickly?

Tailscale relies on the lightweight WireGuard protocol, which operates inside the Linux and mobile operating system kernels with minimal processing overhead. Unlike older VPN protocols that send continuous heartbeat packets, WireGuard remains silent when no data is being transmitted, resulting in minimal impact on battery life.

Conclusion

Setting up Tailscale transforms how you manage home network infrastructure remotely. By eliminating port forwarding, dynamic DNS tracking, and perimeter exposure, you establish a zero-trust network model that keeps your servers and connected hardware safe from external threats. Whether you need access to a file server, home automation tools, or full network traffic encryption while traveling, a properly configured tailnet provides simple, secure remote access across all your devices.