Reach your whole home network with Tailscale

For a long time my home network had exactly one door. I had opened a port on my router so I could get to my photo server from outside the house, and everything else lived behind that wall, invisible. If I was away and my ad blocker started misbehaving, or I wanted to check on a backup, my options were to wait until I got home or to open another port and feel bad about it.

The thing that fixed it is a Tailscalesubnet router. It took about twenty minutes, it opened no new ports, and it is the first thing I would tell anyone with a home server to set up. I have no affiliation with them. I am just annoyed that nobody told me sooner.

What this gets you

Every device on your home network becomes reachable from your phone or laptop anywhere in the world, by the ordinary address it already has. The bookmark you have for your router's admin page keeps working. So does the one for your server, your printer, the thing you set up eighteen months ago and forgot the name of.

You open no additional ports. Your router keeps forwarding exactly what it forwarded before. From the internet's point of view nothing about your house has changed.

What you need

• One machine that is always on. A home server, a Raspberry Pi, a NAS. It needs to be on whenever you want remote access, which is the whole job.
• A Tailscale account.The personal plan is free and covers far more devices than a house needs. Alternatives exist, including self-hosted Headscaleif you would rather not depend on a company at all. I use Tailscale because it took ten minutes and I have not thought about it since, which is the highest compliment I can pay a piece of infrastructure.
• Admin access to that machine's shell. A few commands, nothing exotic.

You do not need to touch your router, and you should not.

How Tailscale works, briefly

Tailscale is a mesh VPN built on WireGuard. It builds a small private network, a "tailnet," across all your devices. Each one gets its own address on that network and they talk to each other directly and encrypted, regardless of what network they happen to be sitting on. There is no central server your traffic flows through, and no port forwarding involved in any of it.

By itself that only connects devices that are running Tailscale. Asubnet routeris one of those devices volunteering to pass traffic through to everything else on its local network. Your phone asks for an address on your home network, your tailnet says "the always-on box back home can handle that," and the traffic goes there.

That single feature is the whole guide. Everything below is how to turn it on without hurting yourself.

The steps

1. Pick the machine carefully

   This should be something that stays powered on and where you install software through an official package. I nearly put mine on the router itself, which would have been tidier, until I read that it needed community scripts that firmware updates overwrite. Putting the thing your remote access depends on somewhere it gets silently wiped is a bad trade for tidiness.

2. Install Tailscale there, and on your phone

   Download it for both and sign in with the same account. At this point the two devices can already reach each other over the tailnet. Your home network still cannot be reached, which is the gap the next steps close.

3. Find your local network's address range

   Look at your router's admin page for something like192.168.1.0/24 or 192.168.0.0/24. The number in the third position is the part that varies. If your devices have addresses like 192.168.1.x, yours is 192.168.1.0/24.

4. Advertise the route

   On the always-on machine, with your own range in place of the example:

   sudo tailscale set --advertise-routes=192.168.1.0/24

   Some systems also need packet forwarding turned on. If your distribution does not do this for you, the Tailscale docs give the two sysctllines for your platform.

5. Approve it in the admin console

   Advertising a route is a request. Open the Tailscale admin console, find the machine, and approve the subnet route. Nothing happens until you do, and this is the step I spent fifteen minutes not doing while wondering why it was broken.

6. Turn it on where you want it

   On your phone and laptop, enable the setting that accepts routes from other devices. On mobile it is usually on by default. On a desktop it usually is not.

The parts that will bite you

A subnet router exposes your entire network to everyone on it

This is the part I want you to sit with for a second, because it is easy to set up and easy to under-think. You have not opened your network to the internet. You have opened it to every device signed into your Tailscale account.

That is completely fine while every device is yours. The moment you invite a family member or a friend so they can use one service, they get the whole local network unless you write anaccess control rule first. Write the rules before you send the invitation. Tailscale's default policy is "everyone can reach everything," which is the right default for one person and the wrong one the moment there are two.

The exit node is a separate thing, and you probably want it off

Tailscale also offers anexit node feature that routes all of your internet traffic through your home connection. It sounds appealing on hotel wifi. Remember that your home upload speed becomes your download ceiling everywhere in the world. Mine is about 30 Mbps up, so turning this on would cap my phone at 30 Mbps in a coffee shop with gigabit fibre. I advertise it and leave it switched off.

Your remote traffic will appear to come from one machine

By default the subnet router rewrites the source address of forwarded traffic, so everything you do remotely looks like it came from that one box. If you run local DNS filtering and enjoy the per-device statistics, this will flatten them. There is a fix involving a static route on your router and an extra flag. I have not bothered, because I like the per-device stats less than I dislike touching routing tables.

How to check it actually worked

Three checks, in order:

1. Read the state on the machine

   tailscale status --json

   Look for your range under the advertised and primary routes. If it is advertised but not primary, you skipped the approval step.

2. Test with wifi genuinely off

   Turn wifi off on your phone. Not "disconnect from the network," off. I have twice congratulated myself on a working remote setup while still on my own wifi, which proves nothing at all.

3. Open something that was unreachable before

   Your router's admin page is the best test, because it was definitely not reachable from outside before you started. If that loads over cellular, you are done.

Where this does not help

Anything you want to share with people who will not install software and make an account stays on the public internet. Photo albums shared with family, anything with a mobile app that expects a normal address, anything a neighbour might open once. Those still need a real public hostname and real authentication.

What this fixes is the administrative half: the dashboards, the settings pages, the backup consoles, the things only you ever touch. Those had no business being reachable from the internet, and now they are reachable only by you.