Your Pi is useful at home. It is even more useful when you can check it from a train, a hotel, or the other side of town. Tailscale connects enrolled devices through a private network, giving you a way to reach your Pi without setting up a public SSH port forward.
The first milestone is simple: connect to the Pi's ordinary SSH server from a second device while that device is away from your home Wi-Fi.
Decide what needs remote access
Start with access to the Pi itself. You do not need to configure an exit node or a subnet router for that. Those features solve different problems and broaden what traffic the Pi handles.
You need a Raspberry Pi running a supported Linux release, an existing local SSH connection, and a Tailscale account. This project uses Tailscale's account and coordination service; it is separate from Open Pi's own local-first connection model.
Before you begin, verify that local SSH works. Keep that session open while setting up remote access so you have a recovery path if a setting is wrong.
Install and enroll the Pi
The official Linux instructions provide an installer and distribution-specific package steps. Here we download the installer before running it. Read it, then continue if it matches your intended setup.
curl -fsSL https://tailscale.com/install.sh -o tailscale-install.sh
less tailscale-install.sh
sudo sh tailscale-install.sh
sudo tailscale up
tailscale ip -4
tailscale status
Follow the authentication link printed by tailscale up, and enroll the Pi in your account. Install Tailscale on your laptop or phone and sign into the same network. Review the device list so you recognize every enrolled device.
Use the existing SSH server
Copy the Pi's Tailscale IPv4 address from tailscale ip -4. Use that address as the SSH host, with the same Linux user you already use locally. The values below are placeholders, not a real device address or account.
# Run on your other enrolled computer; substitute your own values.
ssh YOUR_USER@PI_TAILSCALE_IP
This uses ordinary SSH over the private connection. Tailscale SSH is an additional feature with its own authorization behavior; it is not required for this setup.
For Open Pi, add a connection using the Tailscale address while the Tailscale app is connected on your phone. Your Pi's SSH service and account authentication still need to work. Keep your existing LAN connection entry until you have verified the new route.
Test the connection you will actually use
Turn off Wi-Fi on your phone and use mobile data, or connect your laptop through a different network. Confirm Tailscale is connected, then open the SSH session. Run hostname and uptime to make sure you reached the intended machine.
A test while both devices remain on the same home network does not fully exercise your remote workflow. Repeat the off-network check after a Pi reboot, and record which hostname or address worked.
Give access a clear boundary
Review your Tailscale access policy before sharing the network with other people. Give each person or device only the reachability they need. Protect the identity-provider account, remove devices you no longer own, and review key-expiry behavior for an unattended Pi.
Do not assume that a private transport replaces application passwords or service updates. It limits who can reach a service; that service still needs appropriate authentication.
Diagnose the right layer
If the Pi is absent from tailscale status, check enrollment and internet access. If it is online but SSH refuses the connection, verify the SSH service and host firewall. If SSH connects but authentication fails, check the Linux username and key rather than reinstalling Tailscale.
Once remote administration works, you can use it to inspect your Pi-hole DNS server or check a home lab monitor. Keep the first version small and understandable before adding network-wide routing.
Sources and further reading
Researched from the official documentation linked above on September 10, 2026. Setup examples are starting points and have not been hardware-tested by Open Pi. Check your board, OS, and the project’s current instructions before installing.