Skip to content

Secure Remote Access to Raspberry Pi using Tailscale (No Port Forwarding)

Access your Raspberry Pi from anywhere in the world without exposing ports on your home router! This step-by-step guide explains how to install and configure Tailscale to create a secure, encrypted mesh VPN network for easy remote access.

Introduction

Traditionally, accessing your Raspberry Pi from outside your home network required configuring Dynamic DNS (DDNS) and setting up Port Forwarding on your home router. This process is not only complicated but also exposes your home network to malicious scans and attacks.

Tailscale solves this problem by using the modern WireGuard protocol to establish secure, peer-to-peer connections (a "mesh VPN"). It traverses firewalls and NATs automatically, meaning you do not need to open any ports on your router.

Step 1: Install Tailscale on the Raspberry Pi

Tailscale provides an automated installation script that detects your Raspberry Pi OS version and configures the repository.

  1. Connect to your Raspberry Pi locally (via terminal or local SSH).
  2. Run the official Tailscale installation script: 
    1
    curl -fsSL https://tailscale.com/install.sh | sh
  3. Once the installation completes, the Tailscale daemon will start automatically.

Step 2: Connect the Raspberry Pi to Your Tailnet

Now, authenticate your Raspberry Pi to associate it with your Tailscale account (your "Tailnet").

  1. Run the login command: 
    1
    sudo tailscale up
  2. The terminal will print a unique authentication URL: 
    1
2
    To authenticate, visit:
https://login.tailscale.com/a/a1b2c3d4e5f6
  3. Copy this URL, paste it into a web browser on your PC or phone, and sign in (using Google, Microsoft, GitHub, or email).
  4. Click Authorize to connect the Raspberry Pi to your network.
  5. Back in the terminal, you should see: 
    1
    Success.

To find your Raspberry Pi's new private Tailscale IP address, run: 

1
tailscale ip -4
This IP address (usually starting with 100.x.y.z) is static and belongs only to your private network.

Step 3: Remote Connect from Your Client Devices

To access your Raspberry Pi remotely, you must install Tailscale on the device you want to connect from (such as your laptop, desktop, or smartphone).

  1. Download and install Tailscale on your client device from tailscale.com/download.
  2. Launch the Tailscale app and sign in with the same account you used for the Raspberry Pi.
  3. Once connected, your client device and Raspberry Pi are part of the same secure virtual network.

Test SSH Access

From your laptop (connected to any network, e.g., cellular data or public Wi-Fi), run: 

1
ssh username@your-pi-tailscale-ip

Test VNC Desktop Access

If you use VNC for graphical desktop access, open your VNC Viewer client and enter your Raspberry Pi's Tailscale IP address (e.g., 100.80.90.100) to log in.

Advanced: Configure the Pi as an Exit Node

You can configure your Raspberry Pi to act as an Exit Node. This routes all of your client device's internet traffic through your home network—useful for securing your connection when using untrusted public Wi-Fi.

1. Enable IP Forwarding on the Pi:

Edit the sysctl file: 

1
sudo nano /etc/sysctl.conf
Uncomment the following lines to allow IP forwarding: 
1
2
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
Save the file and apply the changes: 
1
sudo sysctl -p

2. Advertise the Exit Node:

Restart Tailscale on the Pi with the exit-node flag: 

1
sudo tailscale up --advertise-exit-node

3. Approve the Exit Node:

  1. Open the Tailscale Admin Console.
  2. Locate your Raspberry Pi in the machine list.
  3. Click the three dots menu (...) next to it, select Edit route settings, and toggle on Use as exit node.

Now, from the Tailscale app on your phone or laptop, you can select your Raspberry Pi as the "Exit Node" to secure your web browsing.

Troubleshooting

  • Tailscale cannot connect:
    • Run sudo systemctl status tailscaled to verify that the daemon is running.
    • If it is stopped, run sudo systemctl enable --now tailscaled.
  • Latency is high:
    • By default, Tailscale attempts to make a direct peer-to-peer connection. If it fails due to strict NAT firewalls, it relays traffic through encrypted DERP servers, which increases latency. You can check connection status by running tailscale status.