Nothing at my house accepts a connection from the internet. The router has zero ports forwarded. I can still reach every machine at home from anywhere, and Tailscale is the reason.

This post builds on My Developer Setup, which covers the rest of the stack.

What it connects

Three machines are on my tailnet: an M4 Pro MacBook Pro that travels, an Arch Linux mini PC, and a Raspberry Pi 5 that runs the services I host myself.

Tailscale builds a WireGuard mesh between them. Each device has its own key, and devices connect to each other directly whenever the network allows it. When a hotel or café network blocks a direct path, traffic goes through Tailscale’s relays, still encrypted end to end. Tailscale’s servers hand out keys and tell devices how to find each other, but they can’t read the traffic.

MagicDNS gives every device a name, so I type the machine’s name instead of remembering addresses.

The Pi is the gateway home

I don’t install Tailscale on everything. The router, Pi-hole and the other devices on my home network don’t run it at all.

Instead, the Pi is a subnet router. It advertises my home network’s IPv4 and IPv6 ranges to the tailnet, so when I’m away the laptop reaches anything at home through the Pi. The router’s admin page loads from a coffee shop the same way it does from my couch.

Tailscale on the Pi runs in Docker with host networking and access to the kernel’s tunnel device, so it uses kernel WireGuard instead of the slower userspace mode. It sits next to the Pi’s other Compose stacks and updates the same way.

Tags keep the Pi in its place

The Pi is the machine most exposed to the internet. Public sites reach it through a Cloudflare Tunnel, so it’s the one I’d expect to be attacked first.

So the Pi joins the tailnet with a tag instead of as me. In Tailscale, a tagged device belongs to the tag rather than to a person, and access rules decide what it can reach. Mine let my own devices connect to the Pi, but the Pi can’t start a connection to my laptop or mini PC. If someone ever got into the Pi, the tailnet wouldn’t hand them my other machines.

This trips me up now and then. Testing whether the mini PC is reachable from the Pi always fails, because it’s supposed to. Traffic between those two goes over the home network instead.

Remote desktop over the tailnet

The mini PC runs KDE’s RDP server. Its firewall allows the RDP port from two places only: the home network and the Tailscale interface. From the Mac, I open Windows App and connect to the mini PC by its tailnet name. None of it is visible from the internet.

Why hosted

Tailscale’s free plan covers my setup with room to spare. The coordination server is the one piece I don’t run myself, and that’s deliberate. Running it at home would mean opening a port, which is exactly what this setup avoids, and my traffic never passes through it anyway.

If you’re starting out

  • Install Tailscale on the devices you carry, and make one machine at home that stays on all the time a subnet router for everything else.
  • Tag your servers. Let personal devices reach them, and don’t let them reach back.
  • Allow admin ports like SSH and RDP only from the local network and the Tailscale interface.
  • Turn on MagicDNS on day one.