You’re at a coffee shop, hotel, or your parents’ house — and you suddenly realize you need a file that’s sitting on your home PC. Or you want to check in on your Plex server, your NAS, your Pi-hole stats, or anything else buried behind your home router. Normally, that’d mean fumbling with port forwarding, dynamic DNS, or some sketchy third-party tunneling service. With Tailscale, it takes about ten minutes to set up a Tailscale home network and you never have to think about it again.
Tailscale is a zero-config VPN built on WireGuard — the same protocol that’s powering a lot of modern enterprise VPNs. But where WireGuard requires you to manage keys, ports, and configs manually, Tailscale wraps all of that into an app you install and forget. Every device on your “tailnet” gets a stable private IP address, and they can talk to each other securely regardless of what network they’re on. No port forwarding. No firewall rules. No headaches.
| Tailscale | Raw WireGuard | Traditional VPN (OpenVPN) | |
|---|---|---|---|
| Setup difficulty | Easy (install + login) | Moderate (manual keys/config) | Hard (certs, server, firewall) |
| Port forwarding needed? | No | Usually yes | Yes |
| Static IP needed? | No | Usually yes | Yes |
| NAT traversal | Automatic | Manual | Manual |
| MagicDNS / device names | Yes | No | No |
| Cost (personal) | Free (up to 100 devices) | Free | Free (self-host) |
Why Tailscale Is Different (and Way Easier Than a “Real” VPN)
If you’ve ever tried to set up a Tailscale home network the hard way using a traditional VPN, you know the pain. You pick a solution — OpenVPN, WireGuard, WireGuard over something else — and suddenly you’re deep in a rabbit hole of key generation, firewall configs, and hoping your ISP doesn’t change your IP address on you.
Tailscale sidesteps all of that. You download the app on each device, sign in with a Google or GitHub account, and Tailscale handles the key exchange and connection negotiation automatically. Every device gets a 100.x.x.x Tailscale IP that’s permanent and consistent. Your laptop is always 100.x.y.z no matter where it is. Your home server is always its own address. They can always reach each other.
It pairs beautifully with other self-hosted tools too — like Pi-hole, which routes all your DNS through your Tailscale home network for network-wide ad blocking even on mobile. It uses a relay network called DERP as a fallback, but in practice most connections punch through NAT directly using peer-to-peer WireGuard tunnels. The latency is nearly identical to a direct connection. And the free tier covers up to 100 devices and 3 users — more than enough for a personal homelab.
Setting Up Your Tailscale Home Network: The Basic Three-Step
Here’s the honest truth — setting up a Tailscale home network is so fast it feels like you’re doing something wrong. You’re not. It’s just actually this simple.
Step 1: Create a Tailscale account. Head to tailscale.com, hit “Get Started,” and sign in with Google, GitHub, or Microsoft. That’s your tailnet — your private network.
Step 2: Install Tailscale on every device you want connected. They’ve got apps for Windows, macOS, Linux, iOS, Android, and even Synology NAS, TrueNAS, and Raspberry Pi. On Linux (including Raspberry Pi), it’s a single command:
sudo tailscale up
That’s it. The device shows up in your Tailscale admin console within seconds.
Step 3: Connect from anywhere. Your Tailscale home network is now live. On your phone or laptop, open the Tailscale app, turn it on, and you can now reach your home server by its Tailscale IP — or better yet, by its MagicDNS name like my-homeserver.tailnet-name.ts.net. SSH, RDP, web UIs, Plex — all of it, just works.
What to Run Tailscale On: Hardware That Makes Sense
You need at least one device at home that’s always on — that’s your “always-available” node that acts as the bridge to everything else on your local network. Here are the options that work best.
Raspberry Pi: The classic homelab gateway. Cheap, silent, sips power, runs 24/7 without complaint. It also runs Docker containers like Pi-hole and Portainer alongside your Tailscale home network. The CanaKit Raspberry Pi 5 Starter Kit comes with everything you need to get started — Pi, case, power supply, SD card. Set it up as a Tailscale subnet router and you can reach every device on your home network, not just the Pi itself.
CanaKit Raspberry Pi 5 Starter Kit PRO
Everything you need in one box — Pi, case, PSU, SD card — so the subnet router is running the same afternoon it arrives.
- Pi 5, case, power supply and SD card in a single box
- Silent, low-draw, happy running around the clock
- Runs Pi-hole and Portainer in Docker alongside Tailscale
- Trade-off: Fine for subnet routing and light Docker duty, but this guide’s next pick — the mini PC — is the better choice once Plex, Jellyfin, Home Assistant, or a local LLM enter the picture.
Current price and availability shown on Amazon.
Mini PC: If you want more horsepower (to run Plex, Jellyfin, Home Assistant, or a local LLM alongside Tailscale), a mini PC is the move. The Beelink Mini S12 Pro runs an Intel N100 chip, uses about 6W at idle, and handles Docker containers and Tailscale routing simultaneously without breaking a sweat. It’s become the go-to for homelab folks who want more than a Pi but don’t want a full server.
Beelink Mini S12 Pro (Intel N100)
Idles around 6W and runs Docker plus Tailscale routing at the same time without strain — the natural step up once a Pi starts to feel thin.
- Intel N100, around 6W at idle
- Handles Docker containers and Tailscale routing at the same time
- The step between a Pi and a full server
Current price and availability shown on Amazon.
GL.iNet Router: This is the sneaky-smart option. GL.iNet routers run OpenWrt and have native Tailscale support baked in. You can run Tailscale directly on the router — which means every device on your home network gets access through the router without needing the Tailscale app installed on each one. The GL.iNet Beryl AX (GL-MT3000) is the portable version, which is also great for travel — run Tailscale on it and your hotel room becomes part of your home network.
GL.iNet GL-MT3000
Bakes Tailscale into the router firmware itself, so the whole network is covered without installing an app on every device — and it’s compact enough to toss in a bag for hotel Wi-Fi.
- OpenWrt with Tailscale support built into the firmware
- Covers every device on the network without an app on each one
- Portable — run it in a hotel room and that room joins your home network
Current price and availability shown on Amazon.
The Power Move: Subnet Routing
Here’s where Tailscale goes from “neat” to actually transformative. By default, Tailscale only lets you reach devices that have Tailscale installed. But with subnet routing, you can advertise your entire home network — like 192.168.1.0/24 — through a single Tailscale node. Once you do that, you can reach your smart TV, your router’s admin panel, your printer, anything on the local network, from anywhere in the world.
To enable it, run this on your always-on node:
Then approve the subnet route in your Tailscale admin console. Done — your Tailscale home network now covers every device on your LAN, making it the most powerful Tailscale home network config for local access. Every device on your remote connection (phone, work laptop, travel router) can now see every device on your home network. It’s the same effect as being physically plugged into your home router — without opening a single firewall port.
MagicDNS, Exit Nodes, and the Free Features You’ll Actually Use
MagicDNS: Enable this in the Tailscale admin console and your devices get human-readable names. Instead of remembering 100.64.1.15, you just SSH to homeserver or open homeserver:8096 in a browser for Jellyfin. It just resolves automatically across all your Tailscale devices.
Exit Nodes: You can designate one node as an “exit node” — meaning all your internet traffic routes through it when you’re connected. This turns your home connection into a full VPN, useful if you’re on sketchy public WiFi or want to browse from your home IP. On your always-on node:
Then on your phone or laptop, select that device as the exit node in the Tailscale app. Boom — you’re browsing through your home connection from wherever you are.
Tailscale SSH: Turn this on and you can SSH into any Tailscale node without managing SSH keys at all. Tailscale handles auth. Enable it with --ssh flag when running tailscale up, then just ssh hostname from anywhere on your tailnet.
NAS Users: Tailscale on Synology Is Shockingly Easy
If you’ve got a NAS, adding it to your Tailscale home network is one of the best ways to securely access it remotely without exposing it to the open internet. Synology has an official Tailscale package in its Package Center — you literally search for it, install it, sign in, and done. No terminal required.
Once it’s on your Synology as part of your Tailscale home network, you can access your file shares, DSM web UI, Surveillance Station, and any Docker containers running on the NAS from anywhere — all through the encrypted Tailscale tunnel. The Synology DS223j is a solid entry-level two-bay NAS that handles this setup well without straining the processor.
Synology 2-Bay DiskStation DS223j
Handles the official Tailscale package natively as an entry-level two-bay NAS, so DSM, file shares, Surveillance Station, and anything running in Docker on it become reachable the moment the package installs — no reverse proxy or port forwarding required.
- Official Tailscale package in Synology’s Package Center — no terminal
- File shares, DSM, Surveillance Station and Docker all reachable remotely
- Two-bay entry-level NAS that runs it without straining the processor
Current price and availability shown on Amazon.
The Takeaway
A Tailscale home network is one of those things you can’t imagine going back to life without once you’ve used it. It pairs naturally with a smart home setup so your automations stay accessible wherever you are. No port forwarding. No dynamic DNS. No firewall nightmares. Just a private mesh network that connects all your devices like they’re on the same LAN — whether you’re across town or on another continent. The free tier is genuinely generous, and the setup is fast enough that you can have it running before your coffee’s done.
If you’ve got a Raspberry Pi collecting dust, a mini PC, or a NAS — your Tailscale home network starts here today. Future-you stuck in a hotel with a dead laptop drive will thank you.
Got Tailscale running on an unusual setup — TrueNAS, Proxmox, a router, an old Android phone? Drop it in the comments. The homelab rabbit hole is deep and I want to hear what you’re running.
Frequently Asked Questions
Is Tailscale free?
Yes — the personal plan is free for up to 100 devices and 3 users, which covers almost any home lab.
Is Tailscale a real VPN and is it secure?
Yes. It builds an encrypted WireGuard-based mesh between your devices. It’s a peer-to-peer VPN, not a “hide my IP” service.
Do I need port forwarding for a Tailscale home network?
No. That’s the main reason people switch to it — it handles NAT traversal automatically, so you don’t open any ports on your router.
Can I run Tailscale on a Synology NAS?
Yes, there’s an official Synology package. Setup takes a couple of minutes and lets you reach your NAS from anywhere.
What’s the difference between Tailscale and WireGuard?
Tailscale uses WireGuard for encryption but adds automatic key management, NAT traversal, MagicDNS, and an admin console — so you skip all the manual config.
Does Tailscale slow down my connection?
For direct peer connections, barely. Speed only drops if traffic falls back through a relay, which is uncommon on home networks.
When you outgrow this guide, Tailscale’s knowledge base is the rare vendor documentation that reads like it was written by people who use the product — ACLs, exit nodes, and subnet routing are all covered clearly there.