🔐

Reach home from anywhere

Your router keeps its doors locked. Your phone gets a secret tunnel.

Want to check your Pi-hole or open your home server from a coffee shop? Tailscale builds an encrypted WireGuard network between your devices, and because every device connects outwards, you don't have to open a single port on your router.

Beginner1 eveningVPN

🧰 What you need

One always-on computer at home running Linux (a Raspberry Pi is perfect)
Your phone
A free Tailscale account (sign in with Google, Microsoft or GitHub)

Let's build it

Install Tailscale on the home computer

curl -fsSL https://tailscale.com/install.sh | sh

Then connect it. It prints a link; open it and log in:

sudo tailscale up

Install it on your phone

Get the Tailscale app from the App Store or Play Store and log in with the same account. Both devices now appear at login.tailscale.com/admin/machines, each with a 100.x.y.z address.

Test it away from home

Turn off Wi-Fi on your phone so you're on mobile data. Using an SSH app (Termius works well), connect to the home computer's 100.x.y.z address. You're in, from outside, through no open ports.

Reach your whole home network, not just one computer

Make the home computer a subnet router, so your phone can reach your printer, router and everything else. First let it forward traffic:

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Then advertise your home network (change it to match yours):

sudo tailscale up --advertise-routes=192.168.1.0/24

Approve the route

In the admin console, click the ⋯ next to your home computer → Edit route settings → tick your subnet → Save.

✅ How you know it worked

On mobile data, open your router's page (for example http://192.168.1.1) in your phone's browser. If it loads, your phone is inside your home network from the outside world.

💥 Break it on purpose

Run sudo tailscale down on the home computer and try again from your phone: the home addresses stop answering. Run sudo tailscale up --advertise-routes=192.168.1.0/24 to bring it back. Now you know exactly which box your remote access depends on.

🧠 What's really going on

Both devices dial out to Tailscale's coordination service, which introduces them to each other and hands them keys. They then build a direct WireGuard tunnel, punching through both home and mobile routers, and only fall back to a relay if a direct path is impossible. Because nothing ever connects in, your router needs no open ports and there's nothing for internet scanners to find.

← Back to all network labs · Stuck? Email me