Summary
I’ve got a great home lab running all sorts of services back home, and my smart home is entirely powered by Home Assistant. That’s great when I’m at home connected to my home Wi-Fi, but every time I step out, I lose access to everything. The solution was to set up remote access to my home network, but that also felt like choosing the least-bad option from several risky ones. I could expose individual services to the internet, maintain a reverse proxy and public DNS, or build a traditional VPN and figure out port forwarding. Thankfully, I had to do none of that because I found a sane way to access my network remotely without exposing myself to the internet. Tailscale got me into my homelab without opening a single port No port forwarding, no public DNS, and no reverse proxy to babysit Most if not all traditional remote access approaches add another moving part, credentials, or chance for me to misconfigure anything. That was especially frustrating because all I wanted to do was access services I had already configured perfectly on my LAN. Tailscale finally gave me an approach that feels proportionate to the problem. I installed it on the old laptop that already acts as my home server, turned that machine into a subnet router, and gained access to my local network from my phone and laptop without exposing those services publicly. Tailscale uses WireGuard for encrypting device-to-device connections and handles NAT traversal, so it generally works without opening an inbound router port, even if your ISP has rather weird NAT restrictions. When a direct connection isn’t possible, it falls back to relay servers. Installation is also rather easy. I installed Tailscale on my home server laptop, and the Tailscale app on my Windows PC and Android phone. Now, with a tap of a button, I could connect to my tailnet and access my entire home network, and the devices on it, without having to worry about punching holes in my firewall. The best part is that this setup doesn’t create yet another monthly bill either. Tailscale’s Personal plan is free forever for non-commercial use, supports up to six users, and includes unlimited user devices. More importantly, it also includes subnet routers, so using my server laptop to reach my LAN doesn’t require a paid upgrade. One subnet router beats installing Tailscale on everything that blinks Your ESP32s will never run a Tailscale client, and that’s fine Installing Tailscale directly on the server would’ve let me reach that one machine via its Tailscale address. That is useful, but many devices I wanted to access on my network were elsewhere. Home Assistant was running on a VM which had a separate IP, my 3D printers have their own local web interfaces, and several embedded devices and ESP32s that I have on my LAN can’t run Tailscale at all. The solution to that is a subnet router. Instead of putting the Tailscale client on every device I have, one always-on machine advertises a route to the whole local subnet. Remote devices in my tailnet send LAN-bound traffic through that machine, which then forwards it to the appropriate local address. My server laptop was the obvious choice for this as it’s always on, connected via Ethernet to my network, and running Linux. This also differs from a Tailscale exit node. An exit node routes general internet traffic through another machine, while a subnet router exposes one or more private network ranges. I only wanted traffic for my home LAN to return home. Ordinary browsing could continue using whatever connection my remote devices already had. There is one catch you need to keep in mind about subnet routers. The encrypted tunnel terminates at the router you choose. Traffic from the router to the final LAN device is protected only by whatever protocol that service uses, such as HTTPS, because it’s travelling on the local network outside the WireGuard tunnel. That is acceptable for my trusted home LAN, but you’ll have to pay attention to HTTPS, strong passwords, updates, or network segmentation for remote access. Five commands and one admin-console click, and your LAN goes mobile Install, forward, advertise, approve, then pretend you’re at home Installing and setting up Tailscale is a surprisingly simple process. Tailscale offers a distribution-aware installation script, although manual package instructions are available for anyone who, understandably, doesn’t like piping a downloaded script into their terminal. curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up Because my server laptop needs to pass packets between Tailscale and the physical LAN, I also enabled IP forwarding persistently by running the following commands: echo ‘net.ipv4.ip_forward = 1’ | sudo tee /etc/sysctl.d/99-tailscale.conf sudo sysctl -p /etc/sysctl.d/99-tailscale.conf Then I advertised my LAN range: sudo tailscale set —advertise-routes=192.168.0.0/24 Advertising your LAN range isn’t the final step though. In the Tailscale admin console, you’ll also have to open the Machines page, select whatever machine you want to use as the subnet router, and approve the advertised route. Tailscale requires this approval before it distributes a route to the rest of the tailnet. Flip one toggle and public Wi-Fi suddenly feels like home Same local IPs, new location, and one laptop that must never sleep Now to connect to your tailnet from the outside, all you need is the Tailscale app on your phone or laptop. Open the app, sign into your account, and just slide the connection toggle on. Windows, macOS, Android, and iOS accept approved client subnet routes automatically, while Linux clients require acceptance to be enabled explicitly by running this command: sudo tailscale set —accept-routes Once connected, I could disconnect from my home Wi-Fi but access all my services and devices on the same local addresses I used at home. If AFFiNE was available at 192.168.0.123:3010, that address now still works over mobile data or public Wi-Fi. Home Assistant’s local IP and port worked the same way. I did not need a public hostname, a cloud tunnel for every application, or separate Tailscale installations inside every container. The important practical detail is that the server laptop must remain awake and connected. If it sleeps, shuts down, changes networks, or loses power, the route disappears, and I lose access to my network. This wasn’t much of a problem, but I disabled automatic sleep while plugged in and gave the machine a static LAN IP address through a DHCP reservation in the router settings. I do plan to set up a second subnet router advertising on the same prefix, as Tailscale supports multiple routers for redundancy. Why this finally feels sane for a homelab Fewer forwarded ports, narrower access, and one very important laptop With Tailscale, the biggest improvement isn’t just convenience. None of my self-hosted dashboards need to listen to the public internet, and I do not have to maintain forwarded ports on my router. Traffic across the Tailscale portion of the path is mutually authenticated and encrypted with WireGuard. Access can also be narrowed with Tailscale grants, which control who or what may reach particular addresses and ports instead of treating every registered device the same. Tailscale did not make remote networking disappear. I still had to identify my subnet, enable forwarding, approve the router, and keep the router machine available. It did, however, reduce the setup to a small, understandable collection of parts. And for the first time, remotely opening Home Assistant or checking on a self-hosted document did not feel like publishing my homelab to the world just to reach it myself.