What remote access means
At home, your phone reaches the server across your own network. Out of the house it can’t, because your router sits in the way and, quite rightly, turns away connections from the internet that nobody inside asked for. Remote access is any way of getting past that, so your photos, films and dashboards work on mobile data or in a hotel.
There are two broad ways to do it. You can open a door in the router so the internet can reach the server, which is called port forwarding. Or you can connect your own devices to each other through a private, encrypted tunnel, so nothing at home is open to anyone else. For a homelab the tunnel is safer, and these days it’s also the easier of the two.
Private or public: decide this first
Ask who needs to reach the thing.
- Only you and your household. Jellyfin, photos, a dashboard, admin pages. Use a private tunnel such as Tailscale. Nobody else can even see that these apps exist.
- Anyone with the address. A website, or a booking page for a club. That has to be public, and Cloudflare Tunnel in the options below is the safer way to publish it. The domains and reverse proxies page covers giving it a proper address.
Most homelabs only ever need the first.
How the ways compare
| Tailscale | Port forwarding | Cloudflare Tunnel | |
|---|---|---|---|
| Who can reach it | Only your own signed-in devices | Anyone on the internet | Anyone, unless you add a login |
| Changes on your router | None | One rule for each app | None |
| Works when your provider shares addresses (CGNAT) | Yes | No | Yes |
| Needs a domain | No | No | Yes |
Tailscale works by putting a small app on each device. The apps find each other through Tailscale’s coordination servers, swap keys, then talk directly, encrypted with WireGuard, a modern VPN protocol. When a direct connection isn’t possible, the traffic goes through Tailscale’s relay servers instead, still encrypted end to end, so it’s slower but no less private. Each device gets an address beginning 100. that works wherever it is. Your group of devices is called your tailnet.
What it needs
- A free Tailscale account. You sign in with an account you already have, such as Google, Microsoft, Apple or GitHub. The free Personal plan is for non-commercial use and currently covers up to six users with unlimited devices.
- The app on each device: the server, and every phone, tablet or laptop you want to connect from.
- About ten minutes.
- Nothing on your router. No ports to open and no settings to change.
How Tailscale fits in
- A fixed address for every device. Your server gets a 100. address that stays the same at home, at work or abroad.
- Names instead of numbers. MagicDNS, on by default for new accounts, lets you type the server’s name, such as http://homeserver:8096.
- Nothing exposed. Your apps aren’t visible from the internet, so scanners have nothing to find.
- Works on awkward connections. Hotel Wi-Fi, mobile data and shared addresses (CGNAT) all work without any setup.
- Your whole home network, if you want it. A subnet router lets your phone reach the printer, the router and other devices that can’t run Tailscale themselves.
- Sharing. Invite someone in your household to your tailnet, or share a single machine with a friend’s account without giving them anything else.
- One list of devices. The admin console at login.tailscale.com shows every device and when it was last seen, and lets you remove one if a phone goes missing.
The easy way to set it up
You only need the terminal if your server runs plain Linux, and the step-by-step guide covers that route in two commands. Everywhere else it’s an app and a sign-in.
- On a server running ZimaOS or CasaOS, open the App Store, install Tailscale, and open it. A Tailscale page appears with a Log In button. Press it and sign in.
- On a Windows PC or a Mac, install the Tailscale app from tailscale.com/download (on a Mac, also from the App Store) and sign in.
- On your phone, install Tailscale from the App Store or Google Play, sign in with the same account, and allow it to add a VPN configuration when it asks. It only carries traffic meant for your own devices.
- Find the server’s address. Open the admin console at login.tailscale.com. Your server is listed there with an address beginning 100.
- Stop the server dropping off. In the same list, open the server’s menu and choose Disable key expiry. Otherwise it has to be signed in again after 180 days, the default for new accounts.
- Test it away from home. Turn off Wi-Fi on your phone so it’s using mobile data, then open one of your apps with the 100. address in place of the home one, such as http://100.101.102.103:8096 for Jellyfin. If it loads, you’re reaching home through Tailscale.
Use the same account on every device. That account is what ties them together.
Questions people ask
Is it free?
For a household, yes. The Personal plan costs nothing for non-commercial use and currently covers up to six users with unlimited devices.
Can my family use it?
Yes. Invite them from the admin console, and each person installs the app and signs in with their own account. They only do this once on each device.
Can I use it alongside another VPN?
Not at the same time on a phone, because iPhone and Android only allow one VPN connection at once, so you’d switch between them. Tailscale isn’t a privacy VPN in any case. It connects you to your own devices, and it doesn’t hide your browsing unless you set up a device at home as an exit node, one that all your browsing passes through. The VPNs page explains the difference.
What if Tailscale the company disappears?
Your apps keep working at home exactly as before. Headscale, in the options below, is an open-source replacement for Tailscale’s coordination server, and the official apps can connect to it, so you’re not locked in.
Do I need to open anything on my router?
No. Tailscale connects outwards from each device, which routers allow by default. If you set up port forwarding for remote access in the past, remove it once Tailscale works. The securing your homelab page explains why.
