Stop opening ports on your router to access your home server (do this instead)
When you're connected to the same Wi-Fi network, it's pretty simple to SSH into any device connected to the same network. But outside that same network, you cannot do that because your ISP doesn't assign a unique public IP to your home network. You might have heard that you need to set up "port forwarding" to get into your home servers when you're out. But it doesn't have to be so complicated. Here's an easy and safe way to SSH into your home network when you're away.
What is Tailscale, and how does it work
The no-config setup for remoting into your servers
Tailscale is a free service that provides you with a secure and private network which your devices can connect to . This private network, called a Tailnet, is a mesh network where your phone, laptop, PC, or home server can connect with each other without routing their traffic through a central server.
Once you have set up a Tailscale account and authorized your devices to connect to it, they'll act as if they're all still on the same network regardless of where they are in the world or what connection they're using. Tailscale assigns each device a new Tailnet IP.
For example, if you have a Docker container running on a home server at this address.
You can access it at this address in your browser as long as you're connected to the same network as the home server. Now let's say you have Tailscale running on that home server and your computer. Regardless of where your computer is, you will be able to access that container's web UI using the IP address that Tailscale assigned to your home server. It could look something like this.
You can even get Tailscale to create a MagicDNS. That way, you don't even have to remember the actual IP address of the device. You could remote into your server using the easy-to-remember MagicDNS. For example, an address like this could point to that Docker container on your home server.
Using the same Tailscale IP address, you could also SSH into your home server . So instead of using a local IP address like 192.168.1.1, you could run the same command with the Tailscale user and IP:
You can replace the actual IP address with the MagicDNS too. You can even use Tailscale's own SSH server to avoid password authentication.
Setting up your private Tailscale network
Just create a Tailscale account and install Tailscale on your server
Here's how you can set up your own Tailnet using Tailscale. Start by signing up for Tailscale if you don't already have an account. You can use your Google, GitHub, or Microsoft account for easy sign up, if you like.
The next step is to install and set up Tailscale on all our target devices. For your home server, you can use this simple to fetch and run the official Tailscale script.
You should always examine scripts downloaded from the internet before running them.
It'll automatically identify your system and install the correct version of Tailscale on it. It's built for systemd machines, but if your OS is using a different init system, you will probably need to configure it manually.
Once it's installed, let's get the Tailscale service up and running. Use this command on the same server.
It should generate a URL in the terminal. Follow that link to the Tailscale website where you'll be asked to authenticate and add this device to your private Tailnet.
Now let's get a Tailscale SSH server up.
Next, we'll want to install Tailscale on our devices. It's a platform app which you can install on Windows, macOS, Linux, iOS, and Android devices. Find the installers on the Tailscale website.
For Linux computers, the setup is identical (curl and run the Bash script, then sudo tailscale up to connect). On other platforms, the apps have graphical user interfaces for easy connectivity. Just make sure you're logging into the same Tailscale account on all of them.
Remote into your server via Tailscale
Three ways to SSH into your server
To check which devices are currently connected to your private Tailnet, go to the Tailscale admin console and look for the list of connected machines. Here, you'll also see the IP address that Tailscale assigned to each device. Note that the machine with the Tailscale SSH running has a green SSH tag.
On the same admin console, you can click the three dots next to your server and click the SSH button. It'll show a button to Start SSH Session. Press that button to open remote into that machine (it'll ask you to log into your Tailscale account again and open an SSH session inside a browser window). This browser-based session avoids any firewall complications, and it keeps things simple.
Alternatively, you can SSH into your server in a regular terminal using its username (listed under "Machine") and the Tailnet IP. You'll have to reauthorize using a link it generates.
If you want to avoid the authentication hassle, try connecting via Tailscale SSH.
This will instantly drop you into the server environment.
The convenient way to SSH from any device, anywhere
Tailscale makes it incredibly convenient to remote into your home servers, even when you're out and about. It works on any device, so you could even SSH into your server from, say, Termux .
