Tailscale for beginners: reach your home network from anywhere, without opening ports

The short version: Tailscale puts your own devices, like your phone, laptop and home server, on a private network that only they can see, wherever they are. You can open your home dashboard from a hotel Wi-Fi as if you were sitting on your couch, and you never open a port on your router.

The plain-English explanation

Imagine every device you own gets a secret walkie-talkie. The walkie-talkies only talk to each other, every message is scrambled so nobody in between can understand it, and you decide which walkie-talkies are allowed in the group. That’s Tailscale. Under the hood it uses WireGuard, a modern, well-reviewed encryption protocol, and a coordination service that helps your devices find each other.

What it is not: it is not an “anonymity VPN” that hides your browsing from websites. By default it only carries traffic between your devices. Your normal web browsing still goes out your usual internet connection. (You can route all traffic through a home device using an “exit node”, but that’s optional.)

What it’s good for

• Reaching a home server, NAS, Home Assistant or self-hosted AI chat (like Open WebUI) while away
• SSH into your homelab from a laptop
• Getting to devices that can’t run Tailscale (printers, cameras, a router’s admin page) through one “subnet router” device (our follow-up guide)
• Sharing one service with a family member without giving them your whole network

What it costs (checked 2026-10-21)

From Tailscale’s pricing page:

• Personal (free): for non-commercial use, up to 6 users, unlimited user devices, 3 ACL groups and up to 50 tagged resources. It includes nearly all core features: subnet routers, exit nodes, MagicDNS and access controls.
• Standard: $8 per user per month. Premium: $18 per user per month. Enterprise: custom.
• If you sign up with a custom-domain email (like you@yourcompany.com), Tailscale treats it as business use and starts a 14-day trial. For home use, sign in with a personal Google, Apple, Microsoft or GitHub account, or choose the free plan afterwards.

Limits and tradeoffs, honestly

• You trust a third-party coordination service with your device list and login. Your traffic is end-to-end encrypted between devices, but the “who’s in the network” part runs on Tailscale’s servers. If that bothers you, Headscale is a self-hosted, open-source alternative to the coordination server. It’s more work to run.
• Your login is the key to the kingdom. Use an account with strong 2-factor authentication.
• Every device needs the app, or it has to sit behind a subnet router.
• Sometimes traffic is relayed (through Tailscale’s DERP relays or peer relays) when a direct connection can’t be made. It still works, but it can be slower.
• It doesn’t replace updates. A dashboard reachable only over Tailscale is safer, but it still needs patching.

Set it up on two devices (about 10 minutes)

1. Sign up: go to login.tailscale.com and sign in with a personal Google, Microsoft, Apple or GitHub account that has 2FA on.
2. Install on your computer: download from tailscale.com/download (Windows, macOS, Linux). On Linux the official one-liner is in the Linux install docs.
3. Sign in from the app with the same account. The device appears in the admin console.
4. Install on your phone from the App Store or Google Play (“Tailscale”), then sign in with the same account.
5. Test: in the admin console, copy your computer’s Tailscale name or 100.x.y.z address. On your phone, turn off Wi-Fi (use mobile data), then open something running on the computer, or ping it from the app.
6. Optional: turn on MagicDNS so you can use names instead of numbers.

Access-control basics

By default every device in your tailnet can reach every other device. That’s fine for one person, but tighten it once you add family or servers:

• Tag servers (e.g. tag:server) so they’re owned by the network, not a person.
• Write a simple rule in the access controls (ACL) editor: for example, only your user can reach tag:server, and family devices can reach only the media server’s port.
• Turn on device approval so a new device can’t join without you clicking approve.
• Expire keys: leave key expiry on for laptops and phones, so a lost device stops working on its own.

Easy troubleshooting

• Can’t connect? Check that both devices show “Connected” in the admin console and are signed into the same account.
• Works at home, not away? The service may only listen on your LAN address. Bind it to all interfaces or use a subnet router.
• Slow? Run tailscale netcheck and tailscale ping <device>. “via DERP” means traffic is being relayed. See connection types.
• Firewall on the server? Allow traffic on the tailscale0 interface.
• Name doesn’t resolve? Make sure MagicDNS is on, and that a custom DNS setting on the device isn’t overriding it.

Sources

• Pricing and plan limits: https://tailscale.com/pricing (checked 2026-10-21)
• Downloads: https://tailscale.com/download · Install docs: https://tailscale.com/kb/1017/install
• ACLs: https://tailscale.com/kb/1018/acls · MagicDNS: https://tailscale.com/kb/1081/magicdns · Connection types: https://tailscale.com/kb/1257/connection-types
• Headscale: https://github.com/juanfont/headscale