Add private remote access

You’ll want to reach the server from outside the house. The tempting shortcut is forwarding port 22 on the router to the server. Don’t.

A forwarded SSH port is visible to the entire Internet, and scanners find it within minutes. From then on, your home server’s security depends on that one port being perfectly configured, forever.

An outbound-established private overlay can provide remote access without exposing SSH directly to the public Internet. Tailscale builds a WireGuard-based private network (a tailnet) between your devices. Every connection is outbound from the server’s point of view, so the router needs no inbound rules at all.

Install and join the tailnet

Install through the current official Tailscale path:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

tailscale up prints a login URL. Open it on any browser and authenticate; the server joins your tailnet. Then inspect the node:

tailscale status
tailscale ip -4

status lists the devices in your tailnet and their state. ip -4 prints the server’s tailnet address, something in the 100.x.y.z range.

Connect from another device

Install Tailscale on your laptop or phone, log into the same tailnet, and connect using the tailnet address:

ssh [email protected]

Try it from outside your home network, on mobile data, to prove the path really doesn’t depend on your LAN. Then confirm the router has no SSH port forward. If one exists from earlier experiments, remove it now.

What this does and doesn’t solve

Review tailnet access rules and device expiry in the Tailscale admin console. By default device keys expire and need re-authentication; that’s a feature, not a bug. A stolen laptop that stays in your tailnet forever is the failure mode you’re preventing.

When a node’s key expires you’ll see it marked in tailscale status, and connections to it fail. Fix it by running sudo tailscale up again on that machine.

Private connectivity still needs user authorization and host security. The firewall rules and SSH keys from the previous lessons stay exactly as they are. Tailscale decides which machines can reach the server; SSH still decides who gets in.