Tailscale
A WireGuard-based mesh VPN that lets your own devices reach the Pi from anywhere, without opening a single port on your router.
#What it is
Tailscale is a mesh VPN built on WireGuard. You install it on the Pi, your laptop and your phone, sign every device in to the same account, and those devices form a private network, a tailnet, that only they can see. Each device gets a stable 100.x.y.z address that doesn't change when you move between Wi-Fi networks, so ssh pi@100.x.y.z works from a café, from mobile data, from anywhere.
#Why I use it
I want to reach the Pi when I'm not at home: to check on the agent, restart a service, or fix something that broke. The old answer was to forward port 22 on the router. Don't. An SSH port exposed to the internet starts collecting credential-stuffing attempts within minutes, and here it would be guarding a box that runs shell commands on request.
#Benefits
- Nothing is exposed. The router keeps every inbound port closed. Devices reach out to Tailscale's coordination servers and then connect to each other directly, so there is no listening service on your public IP to find, scan or brute-force.
- The coordination server never sees your traffic. It only exchanges public keys and helps devices find each other. The tunnel is end-to-end encrypted between your devices.
- Works behind CGNAT. If your ISP doesn't give you a real public IP (common on fibre and mobile broadband), port forwarding isn't even an option. Tailscale doesn't care.
- Identity-based and instantly revocable. Lose a laptop and you disable that one device in the admin console; the Pi doesn't need touching.
- MagicDNS lets you
ssh pi@hermes-piinstead of remembering an IP. - Free for personal use, covering far more devices than a home lab needs.
#Gotchas I hit
- Run
sudo tailscale set --accept-dns=falseon the Pi. By default Tailscale takes over a device's DNS settings. That's fine on a laptop and wrong on a Pi that is your DNS server. Set it early and save yourself a confusing evening. - Pi-hole on your phone, away from home: point Tailscale's DNS (admin console, DNS, add a custom nameserver) at the Pi's tailnet IP, turn on Override local DNS, and in Pi-hole set Permit all origins. That last setting is safe only because nothing forwards port 53 from the internet to the Pi.
#Alternatives
Plain WireGuard (more setup, no coordination server at all), Headscale (a self-hosted Tailscale control server), or ZeroTier.