Connecting to home lab services, media libraries, and IoT automation hubs from outside your home network has traditionally required configuring dynamic DNS, opening firewall ports on your router, and managing complex reverse proxies with public SSL certificates. Every open port on your public IP invites automated port scanners, credential brute-forcing, and zero-day exploit attempts.

Tailscale fundamentally transforms remote access. Built upon the modern, high-speed WireGuard VPN protocol, Tailscale establishes a private, zero-config encrypted mesh network (called a tailnet) between your Raspberry Pi, laptops, and mobile phones. Devices communicate directly point-to-point without exposing any open ports to the public internet.

This guide walks you through installing Tailscale on Raspberry Pi OS, configuring your Pi as a subnet router to reach other home network devices, setting up an exit node for secure public Wi-Fi browsing, managing Tailscale SSH, and monitoring your node with Open Pi.

Why Tailscale on Raspberry Pi?

Tailscale operates at the network overlay layer: - No Port Forwarding: Tailscale uses NAT traversal (STUN/DERP) to coordinate direct, encrypted peer-to-peer tunnels between devices through home firewalls and mobile carrier NATs. - Modern WireGuard Encryption: Tailscale uses modern public-key cryptography (Curve25519, ChaCha20-Poly1305) rather than heavy legacy IPsec or OpenVPN overhead. - MagicDNS: Every device added to your tailnet receives a stable, human-readable domain name (like raspberrypi.your-tailnet.ts.net), eliminating the need to track dynamic local IP addresses. - Subnet Routing: A single Raspberry Pi running Tailscale can act as a bridge, allowing your phone to securely access smart bulbs, NAS shares, and printers on your home LAN without installing Tailscale on those individual devices.

Hardware planning and prerequisites

  • Supported Boards: Tailscale is extremely lightweight. It runs seamlessly on any Raspberry Pi 3, 4, 5, or Zero 2 W running a 64-bit release of Raspberry Pi OS or Debian.
  • Network Interface: For high-throughput applications (such as accessing a home NAS or routing streaming traffic through an exit node), use a Raspberry Pi 4 or 5 connected via gigabit Ethernet.
  • Tailscale Account: Create a free personal account at tailscale.com using your Google, Apple, Microsoft, or GitHub identity. Free personal plans allow up to 3 users and 100 connected devices.

Installation on Raspberry Pi OS

Tailscale provides an automated installation script that adds their signed APT repository and packages:

BASH
sudo apt update && sudo apt upgrade -y
sudo apt install -y curl
curl -fsSL https://tailscale.com/install.sh | sh

Verify that the background system daemon (tailscaled) is active and enabled:

BASH
sudo systemctl status tailscaled

Authenticate your Raspberry Pi with your Tailscale account:

BASH
sudo tailscale up

The terminal will print an authentication URL:

TEXT
To authenticate, visit:
https://login.tailscale.com/a/123456789abc

Copy that link into your browser, log in with your account credentials, and click Connect. Once approved, your Raspberry Pi immediately appears in your Tailscale admin console.

Verify your assigned Tailscale IP address:

BASH
tailscale ip -4

Configure Subnet Routing to access your entire home LAN

By default, Tailscale allows you to communicate with the specific Raspberry Pi running the software. However, by enabling Subnet Routing, your Raspberry Pi acts as a secure gateway, allowing remote phones and laptops to reach any device on your home network (such as your router, Home Assistant hub, IP cameras, or printer at 192.168.1.x).

Step 1: Enable IPv4 and IPv6 packet forwarding on the Pi

Linux disables IP packet forwarding by default. Enable it permanently by editing /etc/sysctl.d/99-tailscale.conf:

BASH
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Step 2: Advertise your home subnet

Identify your local subnet (typically 192.168.1.0/24 or 192.168.0.0/24). Start Tailscale with the subnet advertisement flag:

BASH
sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-dns=false

Step 3: Approve the route in the admin console

For security, advertised routes are disabled until approved by an administrator: 1. Open the Tailscale Admin Console. 2. Locate your Raspberry Pi in the machine list. 3. Click the ... menu next to the board and select Edit route settings. 4. Check the box next to your advertised subnet (192.168.1.0/24) and save.

Now, whenever your mobile phone is connected to Tailscale on cellular data, you can open any browser and type http://192.168.1.x to reach local devices exactly as if you were sitting on your living room Wi-Fi.

Set up an Exit Node for untrusted public Wi-Fi

When connecting to public Wi-Fi networks in coffee shops, hotels, or airports, your internet traffic is vulnerable to snooping, rogue DNS servers, and malicious captive portals. You can configure your Raspberry Pi to act as an Exit Node, tunneling all your laptop or phone's internet traffic back through your trusted home broadband connection.

Advertise your Raspberry Pi as an exit node:

BASH
sudo tailscale up --advertise-exit-node

In the Tailscale Admin Console: 1. Click the ... menu for your Raspberry Pi and select Edit route settings. 2. Enable Use as exit node.

On your phone or laptop Tailscale app, tap Exit Nodes and select your Raspberry Pi. Verify by visiting a public IP checking site; your traffic now exits through your home ISP connection.

Secure SSH access without key management (Tailscale SSH)

Managing SSH keys across multiple devices, phones, and laptops can be cumbersome. Tailscale SSH eliminates key distribution by handling SSH authentication through your tailnet's cryptographic identity layer:

BASH
sudo tailscale up --ssh

Now, any authenticated device on your tailnet can SSH into your Raspberry Pi using its MagicDNS name:

BASH
ssh username@raspberrypi

Authentication is verified against your Tailscale login identity, completely eliminating open port 22 vulnerabilities and brute-force password guessing attempts.

Keep-alive and systemd service reliability

Ensure that Tailscale automatically recovers across network reboots and interface changes. Enable persistent reconnects:

BASH
sudo systemctl enable tailscaled

If your home internet uses dynamic IP re-negotiation, Tailscale handles NAT re-binding automatically within seconds.

Monitor Tailscale with Open Pi

Monitoring your Raspberry Pi's network interfaces and throughput ensures your VPN gateway operates without packet throttling.

With Open Pi on your iOS or Android device: - Network Interface Statistics: View real-time packet transmission rates across physical Ethernet (eth0) and virtual VPN interfaces (tailscale0). - CPU & Thermal Headroom: Verify that encrypted WireGuard packet processing does not cause thermal throttling during high-throughput downloads. - Service Verification: Check that tailscaled remains active in your background system process list.

Troubleshooting Tailscale connections

When connections fail to establish or transfer data:

  • Subnet Devices Not Responding: Verify that IP forwarding is enabled by running sysctl net.ipv4.ip_forward. If the output is 0, re-apply your sysctl configuration. Also ensure your local router does not have client isolation enabled.
  • Subnet Overlap in Hotels: If the remote hotel network uses the exact same subnet IP range as your home network (for example, both use 192.168.1.0/24), routing collisions will occur. To avoid this, configure your home router to use a less common private subnet range, such as 10.45.0.0/24 or 192.168.188.0/24.
  • Relay (DERP) vs Direct Peer Connection: In rare situations with restrictive symmetric NATs, Tailscale falls back to an encrypted relay server (DERP). Check your connection status with tailscale status. If connections show relay, check your router settings to enable UPnP or create a UDP port mapping for Tailscale's preferred port (41641).

Sources and further reading

Open Pi logo
Monitor your Raspberry Pi from your phone

Check real-time CPU, RAM, temperature, and service health for your networking projects with Open Pi for iOS and Android. Local-first, private, and no cloud account required.

Explore Open Pi App StoreGoogle Play
About this guide

Researched and validated against official project documentation and community standards on September 11, 2026. Review your board model, storage, and current release notes before deploying.