Why Tailscale Makes Remote Pi Access Actually Work
Remote access to a Raspberry Pi sounds straightforward until you run into the real obstacles: dynamic IP addresses, router port forwarding rules that vary by ISP, firewall configurations that block incoming connections, and the general complexity of exposing a home server to the public internet. Most traditional solutions require you to either pay for a static IP, configure a VPN server from scratch, or poke holes in your network security. Tailscale cuts through all of that by building a peer-to-peer mesh network using WireGuard under the hood, with an authentication layer that requires no manual firewall configuration at all.
The setup is genuinely fast – under 10 minutes from a fresh Raspberry Pi OS install to a working remote connection.
This guide covers everything from installing Tailscale on a Raspberry Pi to enabling persistent access, setting up SSH over the Tailscale network, and optionally advertising the Pi as an exit node or subnet router so other devices on your home network become reachable remotely. Whether the Pi is running a media server, a self-hosted notification tool, or just sitting headless in a closet, Tailscale turns it into something you can reliably reach from anywhere.
What You Need Before Starting
The requirements are minimal. You need a Raspberry Pi running Raspberry Pi OS (Bullseye or Bookworm both work), connected to the internet via ethernet or Wi-Fi. The Pi should have SSH enabled – if it does not, you can enable it by placing an empty file named ssh in the boot partition before first boot, or by running sudo raspi-config and navigating to Interface Options. You also need a Tailscale account, which is free for personal use and supports up to 100 devices on the free tier.
On the account side, head to tailscale.com and sign up using a Google, Microsoft, GitHub, or Apple account. Tailscale does not have its own username and password system – it delegates authentication entirely to your identity provider. Once signed in, you will land in the admin console at login.tailscale.com/admin, where all your connected devices will appear once enrolled. Keep this tab open – you will need it shortly to authorize the Pi.
It is worth confirming your Pi is fully updated before proceeding. Run sudo apt update && sudo apt upgrade -y and let it finish. Tailscale’s install script pulls packages from its own repository and adds a GPG key to verify them, so a clean, updated system avoids dependency conflicts that can silently break the installation.
Installing and Connecting Tailscale on the Pi
Tailscale provides a one-line install script that handles everything – adding the repository, importing the signing key, and installing the package. On your Pi, run the following command:
curl -fsSL https://tailscale.com/install.sh | sh
Once the install finishes, bring the node online with:
sudo tailscale up
The terminal will return a URL. Open that URL in a browser, log in with the same account you used to create your Tailscale account, and click to authorize the device. Within a few seconds, the Pi will appear in your admin console with a Tailscale IP address in the 100.x.x.x range. That IP is stable across reboots and network changes – it will not change even if your ISP reassigns your home IP overnight.
To verify the connection, run tailscale status on the Pi. You should see the device listed as connected, along with any other machines already on your Tailscale network. From another device that also has Tailscale installed – a laptop, phone, or desktop – you can now SSH directly to the Pi using its Tailscale IP: ssh pi@100.x.x.x. No port forwarding. No dynamic DNS. No exposure to the public internet.
To make Tailscale start automatically on boot, confirm the service is enabled:
sudo systemctl enable tailscaled
It is typically enabled by default after installation, but confirming this prevents the frustrating scenario where you reboot the Pi remotely and lose access because the Tailscale daemon did not start. Running sudo systemctl status tailscaled will show whether the service is active and set to launch on startup.
Subnet Routing and Exit Node Configuration
Tailscale’s real depth shows up when you configure the Pi as a subnet router – meaning it advertises your entire home network (say, 192.168.1.0/24) to all your other Tailscale devices. This lets you remotely access any device on your home network, not just the Pi itself. A NAS, a desktop that is not running Tailscale, a smart home hub, a printer – all of it becomes reachable through the Pi as a gateway.
To enable subnet routing, run:
sudo tailscale up –advertise-routes=192.168.1.0/24
Replace the IP range with whatever subnet your router uses – check by running ip route on the Pi and looking at the network listed under the ethernet or Wi-Fi interface. After running the command, go to your Tailscale admin console, find the Pi in the device list, click the three-dot menu, and select “Edit route settings.” Approve the advertised subnet there. You also need to enable IP forwarding on the Pi itself so it can route traffic between interfaces:
echo ‘net.ipv4.ip_forward = 1’ | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
The exit node feature works differently – instead of routing traffic to devices on your home network, it routes all your internet traffic through the Pi, effectively using your home connection as a VPN exit point. This is useful when traveling and connecting to public Wi-Fi. Enable it by adding –advertise-exit-node to the tailscale up command and approving it in the admin console the same way. Keep in mind that exit node traffic flows through your home internet connection, so upload speed on your home plan becomes the ceiling for everything routed through it.
One Detail That Catches Most People Off Guard
After everything is running, the most common failure point is key expiry. By default, Tailscale expires device authentication keys after 180 days, which means your Pi will drop off the network and stop being reachable until you log in locally to re-authenticate it. For a Pi sitting headless in another room – or in a remote location entirely – this is a problem. Go to the admin console, find the Pi, open its settings, and disable key expiry for that device. It is a single toggle, and skipping it is the reason a lot of otherwise solid setups go dark six months after installation.
