Secure Remote Access with Tailscale
How I use Tailscale to create a secure overlay network for remote administration without exposing management ports to the internet.
One of the biggest security decisions I made for my homelab was also the simplest: never expose a management interface to the public internet. No SSH on port 22, no web UIs reachable from outside. Which leaves an obvious question. How do I administer any of it when I'm not home?
Tailscale.
The problem with traditional remote access
Port forwarding is where most people start: open SSH or an admin port through the router and you're done. You're also trusting those services to hold up against internet-scale attacks.
Running your own VPN is better. OpenVPN or WireGuard on the edge, and now you're maintaining VPN infrastructure and managing certificates.
A jump box is the third option. Expose one hardened server, hop through it to everything else, and pay for it in latency and operational complexity.
All three work. All three leave something facing the internet.
Enter the overlay network
Tailscale builds a mesh network between my devices using WireGuard under the hood. Every device gets a stable IP on the Tailscale network, and traffic between devices is encrypted end to end.
Nothing has to be published. My devices find each other through Tailscale's coordination servers, which deal with NAT traversal, but the traffic itself flows directly between the devices.
My setup
Every machine in the homelab runs the Tailscale client. The Proxmox host, so I can manage it from anywhere. The VMs that matter: monitoring, storage management, the service hosts. My laptop and desktop join the mesh on their own, and so does my phone, which can SSH into a server when it needs to.
Access patterns
At home I still go over the local network for most things; it's faster and it doesn't depend on anything outside the house. Remote is where the mesh earns its place: traveling or working from somewhere else, I get the access I'd have if I were sitting at home.
Something breaks at 2 AM? I can SSH in from my phone. Internal services and databases are reachable from a coffee shop. My NAS storage from anywhere. Grafana dashboards on the go.
Security benefits
No public exposure
My firewall has zero inbound ports open for management. Scanners and bots find nothing to knock on. What's left of the attack surface is the Tailscale client itself, which is a much smaller thing than a full SSH server or a VPN stack.
Device-based authentication
Even if someone had my SSH key, they couldn't reach my servers without also being on my Tailscale network, because access is tied to authenticated devices and credentials alone aren't enough.
Encrypted by default
All of it is encrypted with WireGuard by default. No management traffic crosses my network or the internet in the clear.
Operational simplicity
No VPN certificates to renew, no CA to run. No port numbers to remember. No firewall rules to open for access, because the overlay does the routing, and it works from behind corporate firewalls, on cellular, on hotel WiFi.
None of that is interesting. All of it is the point.
Lessons learned
The best defense against an attack on a management interface is not having one reachable. That sounds glib, but it is most of what this setup buys. Overlay networks change the game. Traditional network security assumptions don't always apply.
A security tool that's irritating to use gets bypassed or misconfigured sooner or later. WireGuard's cryptographic primitives were already solid; what Tailscale adds is making them something I don't have to think about.
Beyond management
Administration is what I use it for, but it also works for handing access to people I trust. Family members can reach certain services without me exposing those services publicly or walking anyone through a complicated VPN configuration.
If you're running a homelab and still have SSH or an admin panel open to the internet, an overlay network costs very little to set up. There's nothing on the outside left for anyone to hit, which is why I've stopped thinking about it.