IT-Ops Field Notes

How to Set Up Tailscale for Secure Remote Access to Your Homelab or Small Office

Published

Why Tailscale instead of traditional port forwarding

Traditional remote access to a home or office network means either forwarding ports on your router (exposing whatever’s behind that port directly to the internet) or setting up and maintaining a VPN server (WireGuard or OpenVPN) yourself, including certificate/key management and router configuration.

Tailscale is a mesh VPN built on WireGuard that skips both problems: it creates direct encrypted connections between your devices without any inbound ports opened on your router, and there’s no VPN server to run and maintain — Tailscale’s control plane handles device coordination while your actual traffic still goes device-to-device.

Tradeoffs to know going in:

  • You depend on Tailscale’s coordination servers being reachable (though your data traffic doesn’t route through them once devices connect — Tailscale calls this NAT traversal with direct connections, falling back to a relay only when direct isn’t possible).
  • The free plan is generous for a homelab or very small team but caps at 6 users (see below) — a larger office will hit paid tiers.

What you’ll need

  • A device to act as your “home base” — a NAS, a Raspberry Pi, or any always-on machine on the network you want to reach.
  • Any devices you want to connect from (laptop, phone).
  • 15 minutes.

Step 1: Create a Tailscale account

Go to Tailscale’s signup page and sign up with an existing identity provider (Google, Microsoft, GitHub, etc. — Tailscale doesn’t offer separate username/password accounts, only SSO-style sign-in). This creates your “tailnet” — your private mesh network.

Step 2: Install Tailscale on your home-base device

On Linux (most NAS units and homelab servers run Linux under the hood):

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The tailscale up command prints a login URL — open it in a browser and authenticate with the same account from Step 1. This device now joins your tailnet and gets a stable Tailscale IP (in the 100.x.x.x range) that doesn’t change even if your home IP does.

Synology and QNAP NAS units have Tailscale available as an installable package (Synology: Package Center; QNAP: App Center) if you’d rather not use the command line.

Step 3: Install Tailscale on the devices you’ll connect from

Install the Tailscale app on your laptop and phone (available for Windows, macOS, Linux, iOS, and Android) and sign in with the same account. Each device shows up in your tailnet’s device list in the Tailscale admin console.

Step 4: Connect

Once two devices are on the same tailnet, they can reach each other directly by Tailscale IP or by MagicDNS name (e.g. homeserver instead of 100.x.x.x) — no port forwarding, no VPN client configuration beyond installing the app. Turn on MagicDNS in the admin console’s DNS settings to use device names instead of IPs.

Test it: from your phone (on cellular data, not the home Wi-Fi), try reaching your home-base device by its Tailscale name — e.g. ping homeserver or opening its NAS web UI at https://homeserver:5001.

Step 5 (optional): Use it as an exit node for full traffic routing

If you want all your phone or laptop’s internet traffic to route through your home connection (useful on untrusted public Wi-Fi), enable your home-base device as an exit node:

sudo tailscale up --advertise-exit-node

Then, in the admin console, approve it as an exit node, and select it from the Tailscale app’s menu on the connecting device.

Step 6 (optional): Subnet routing to reach your whole LAN, not just one device

If you want to reach every device on your home/office LAN (printers, other computers, IoT devices) without installing Tailscale on each one, advertise a subnet route from your home-base device:

sudo tailscale up --advertise-routes=192.168.1.0/24

Then approve the route in the admin console under that device’s settings. Now any device on your tailnet can reach anything on 192.168.1.0/24 through that one gateway device.

Free plan limits to know

As of 2026, Tailscale’s free Personal plan includes:

  • Up to 6 users
  • Unlimited devices per tailnet
  • MagicDNS, exit nodes, and subnet routing — all included, not gated to paid tiers
  • Up to 3 ACL groups and 50 tagged resources

This comfortably covers a homelab or a small office of a handful of people. If you outgrow it, paid tiers start at $8/user/month (Standard) and add SSO/SCIM provisioning and device posture checks — overkill for most homelabs, relevant once you have IT policies to enforce across a real team.

Security notes

  • Tailscale uses WireGuard under the hood for the actual encrypted tunnels — a well-audited, modern VPN protocol, not a custom crypto implementation.
  • Access control lists (ACLs) in the admin console let you restrict which devices/users can reach which other devices — worth setting up before you add a whole team, rather than leaving every device able to reach every other device by default.
  • Turning on 2FA on the identity provider account you used to sign up (Google/Microsoft/GitHub) protects your tailnet the same way it protects that account — don’t skip this.

Bottom line

For a homelab or small office, Tailscale removes the two most annoying parts of remote access — router configuration and VPN server maintenance — for free, up to 6 users. Start with Steps 1-4 for basic device-to-device access, and add exit-node or subnet routing once you know you need them.

Note that Tailscale gets you network access to a device — for actually taking control of a remote desktop’s screen once you’re connected (or for IT-support scenarios where you don’t want to hand out network access at all), see RustDesk vs AnyDesk vs TeamViewer for the remote-desktop layer on top.

If the device on the other end of the tailnet is a cheap cloud VPS rather than home hardware, see Hetzner vs DigitalOcean vs Vultr for picking a provider to run the exit node on.

If what you actually need is a public hostname pointed at a self-hosted service (not just device-to-device access), Tailscale doesn’t solve that — see DuckDNS vs No-IP vs Cloudflare for keeping a public-facing domain resolvable behind a changing home IP instead.