Reaching home servers without port forwarding

As you all might know by now, I host my own servers.

Yep, I'm that guy. I’ve got a few machines operating around the clock, hidden in various spots around the house. Some are old laptops brought back to life with Linux, while others are small Raspberry Pis that are probably doing more than they should. One is managing DNS, another is running Jellyfin for movies, and a couple more are taking care of smaller tasks like file storage, self-hosted AI tools, and maybe a development server or two. You get the picture. (Read more here↗)

Now, here’s the problem I was facing for the longest time: accessing my servers remotely was a mess.

Trying to access my servers from a distance was a total hassle. Whenever I was away from home, like at school or hanging out somewhere, I just couldn’t get into my systems easily. Sure, I tried port forwarding on my router, but honestly, that’s just inviting problems. It’s awkward, it puts your system out there on the internet (which is pretty scary), and half the time it doesn’t even function right because of CG-NAT or strange ISP restrictions. For Example, my ISP (cough Airtel cough) gave me a router that blocked access to 80 and 443 ports, because the router used them for forwarding its own interface over the internet. WHY? (This makes me soo mad every time I see an ISP doing this) Nevermind, it doesn't matter now. 

Then I discovered Tailscale.

Tailscale is like magic for networking. You just install it on your devices, and suddenly—boom—they all connect to each other as if they’re on the same local Wi-Fi, even if they’re far apart. No need for port forwarding, no weird scripts, and no more “trying to SSH into some random public IP and hoping it works.” My home server? I can access it from my school laptop in just two seconds. My phone connects to my home NAS as if I’m right there. Everything is encrypted and private. Honestly, it felt like I was cheating. It took just five minutes to set up, and I instantly had a personal mesh network linking all my devices with no latency.

In this blog, I’m going to walk you through how I set it up, how it works, and how you can use it to make your self-hosted life 10x better.

Setup & Usage

Basically, to use Tailscale, you can create an account at tailscale.com↗ and then, you will be redirected to the dashboard. There, you will be able to add devices to your Tailnet. A Tailnet is basically a private network that connects all your devices together.

I recommend you start by connecting your server. It will give you detailed instructions for the platform you're using. Since I use Linux for most of my servers (Ubuntu gang RISE UP), I just had to run a single command that installed Tailscale and authenticated my device.

Here’s literally all I had to do on my Ubuntu server:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Once you run that, it’ll open a login link in the terminal. You just open that in any browser (even on your phone), log in, and your server is now part of your Tailnet. You’ll instantly see it show up on your dashboard with its own private IP address, something like 100.x.x.x. This IP stays the same across reboots and even across networks.

Then, go ahead and install Tailscale on any other device you want to connect—your laptop, phone, tablet, even another server. Just repeat the steps or download the Tailscale app if you’re on Android, iOS, or Windows.

The cool thing is that all the devices can now talk to each other, no matter where they are. I can now SSH into my home server from my phone while I’m outside, stream Jellyfin from my server while on mobile data, or even share files directly from one device to another like they’re on the same Wi-Fi.

Oh, and everything is end-to-end encrypted by default. That means nobody—including Tailscale—can see what’s going on between your devices. It’s just yours.

What’s the Catch?

Now, before you go thinking Tailscale is 100% perfect, there are a couple of things you should keep in mind.

The main con, and this might be a dealbreaker depending on what you’re trying to do, is that anything you host over Tailscale is not publicly accessible. (I mean duh thats the whole point right?)

What I mean is: if you’re running a website or some project on your home server and you want other people to be able to access it from the internet, Tailscale alone won’t cut it. It’s strictly for your own private network. Only devices connected to your Tailnet can reach the services you’re hosting. So while you can stream Jellyfin from your phone or SSH into your server from your laptop, your friend can’t just type in a link and visit your project page unless they’re also on your Tailnet (which you probably don’t want unless they’re part of your setup).

But here’s the good news: you can totally get around this.

There’s a super neat tool called Cloudflare Tunnel, which basically lets you expose any local service (like a website running on localhost:5000 or a port on your server) to the public internet securely and for free—without any port forwarding or exposing your IP. It works really well with Tailscale too.

I’ve been using Cloudflare Tunnels side-by-side with Tailscale to keep my stuff private and publicly accessible when I want it to be and honestly, it's the best of both worlds.

I’ll be dropping a full blog on how to set up Cloudflare Tunnel soon, so stay tuned if you want to publicly host your projects straight from your local machines.

Extra Features

Here are some extra neat features of Tailscale:

• Taildrop: A secure way to share files directly between your devices without using cloud storage, links, or worrying about file sizes, everything transfers straight over your encrypted Tailnet.
• Subnet Routing: This feature allows one Tailscale node to serve as a gateway to an entire local network. You can remotely access non-Tailscale devices like printers, routers, and older servers as if you were connected to the same local area network.
• Exit Nodes: You can route all your internet traffic through a trusted device, like a home server or VPS. It acts like your own private VPN, which is perfect for using public Wi-Fi, traveling, or getting around restrictive networks.
• Tags: These are made for machines rather than people. Instead of giving access based on users, you tag servers (for example, tag:prod, tag:db) to manage access neatly without needing to share credentials.
• ACLs (Access Control Lists): This provides detailed, zero-trust networking. You clearly specify who can access what and on which ports. There’s no automatic trust just because a device is connected to the network.
• Tailscale Serve: You can expose local services like web apps, dashboards, and APIs within your Tailnet with automatic HTTPS, there’s no need for reverse proxies or manual TLS configurations.
• Tailscale Funnel: This allows you to securely expose a service to the internet with HTTPS, even if you’re behind CG-NAT, great for demos, webhooks, or temporary public access.
• Taildrive: You can securely mount shared storage across devices in your Tailnet, making remote files feel local without the usual headaches of traditional VPN file sharing.
• End-to-End Encryption by Default: Every connection is encrypted from device to device. Even Tailscale can’t see your traffic, security is built in, not just an extra feature.

Check out their Docs for More Information: https://tailscale.com/kb↗

TL;DR

• Accessing my servers remotely used to be painful (port forwarding, firewalls, ISP issues, all that mess).

• Tailscale fixed all of that by creating a private mesh network between all my devices. Now everything just works, securely, no matter where I am.

• Setup is really easy: install, log in, done.

• Only catch? Stuff hosted via Tailscale is private. Not accessible publicly.

• You can make it public though, using another awesome free tool: Cloudflare Tunnel (more on that in my upcoming blog).