How to Access Your Home Network From Anywhere (Free Ways Compared)

Quick answer: to reach your home network from anywhere, use a VPN that connects out from your home, such as Tailscale. Install it on your phone and on one device at home that stays on, and let that device share your home network. Your phone can then open anything at home by its normal local IP address, from mobile data or any Wi-Fi, without opening a single port on your router. Avoid port forwarding for smart home gear.

Below: why your devices disappear when you leave the house, the four free options side by side, a short Tailscale walk-through, and what this looks like for smart lights. For every Tailscale command and platform (iPhone, Android, Mac, Windows, Linux, Raspberry Pi, Home Assistant, Unraid, Synology, Docker, routers), see our Tailscale setup guide.

Why your devices vanish when you leave home

Your home network works like an apartment building. The building has one street address that the whole internet can see (your public IP). Every device inside gets an apartment number (a private IP such as 192.168.1.50) that only means something inside the building.

On home Wi-Fi your phone is inside the building, so it walks straight to apartment 50. On mobile data it is outside. It knows the street address at best, and the front door (your router) has no idea which apartment the request is for, so it drops it. Many internet providers also put several homes behind one shared public address (called CGNAT), which means there is no front door of your own to open in the first place.

There are two ways around this. You can cut a hole in the front door (port forwarding), or you can give your phone a key to the building (a VPN such as Tailscale). The second one is the safe one.

Four free ways to reach home devices, compared

Method	Setup	Works behind CGNAT	Good fit
Tailscale	Easy, about 15 minutes	Yes	Reaching everything at home from your own phone and laptop
Cloudflare Tunnel	Medium, needs a domain on Cloudflare for anything permanent	Yes	Publishing one web page, such as a dashboard, with a login in front
WireGuard on your own server	Hard	No, unless you have public IPv6; needs one forwarded UDP port	People who want no third-party service at all
Port forwarding	Medium	No	Only devices built for the open internet, with HTTPS and strong logins

For most homes we start with Tailscale: nothing is opened on the router, it works behind CGNAT, and the free plan covers a family.

Tailscale in five steps

Tailscale builds a private network, which it calls a tailnet, between the devices you sign in. It uses WireGuard encryption and connects devices directly through NAT and CGNAT, so you don’t touch your router’s settings. When a direct path isn’t possible, traffic goes through a relay, either Tailscale’s servers or one of your own devices set up as a peer relay, still encrypted end to end.

1. Create a free account at tailscale.com with Google, Microsoft, GitHub, Apple or another identity provider. Tailscale has no passwords of its own.
2. Install Tailscale on your phone from the App Store or Google Play and log in.
3. Install it on one device at home that is always on, such as a Raspberry Pi, a NAS, a Home Assistant box, an Apple TV or a desktop PC, and log in with the same account.
4. Share your home network from that device (a subnet route), then approve the route on the Machines page of the admin console and disable key expiry for that device. Linux needs IP forwarding turned on first.
5. Test it away from home. Turn off Wi-Fi on your phone, make sure Tailscale is connected, and open a home device by its local IP, for example http://192.168.1.50.

The commands for each platform are in set up Tailscale step by step. Family members need an invite from you before they sign in, or they end up in a separate, empty tailnet.

Subnet router, Tailscale on every device, or an exit node?

• Tailscale on the device itself is the simplest when the device can run it (a PC, a NAS, Home Assistant). Each one gets its own 100.x.y.z address and a name.
• A subnet router is for everything that can’t run Tailscale: light controllers, cameras, printers, the router’s own admin page. One device shares the whole network, and the devices behind it don’t count toward your plan. Per Tailscale’s docs, installing Tailscale directly is still preferred where you can.
• An exit node is something else. It sends all of your phone’s internet traffic out through your home connection, like a privacy VPN. It is not needed to reach devices at home, and it is the most common reason for battery drain on phones.

More about the other options

Cloudflare Tunnel runs a small connector at home that dials out to Cloudflare, and you reach your service at an address like dash.example.com. Nothing needs to be installed on the phone, which is handy for sharing a page with people who won’t install an app. For anything beyond a quick test you need a domain managed by Cloudflare, and you should put Cloudflare Access in front so the page asks for a login.

WireGuard on your own is what Tailscale is built on, minus the coordination. You run the server, forward one UDP port, keep track of keys and handle a changing home IP with dynamic DNS. It is fast and fully under your control, but it doesn’t work if your provider uses CGNAT.

Port forwarding tells your router to send one port straight to one device. It exposes that device to every scanner on the internet. Use it only for software designed for it and kept up to date, and never for smart home gear like WLED.

Control your WLED lights away from home

WLED controllers are a good example of a device that can’t run Tailscale. They are small ESP32 or ESP8266 boards that only serve a web page and an API on your local network. With a subnet router at home, your phone reaches them by the same local IP it uses on your Wi-Fi.

1. Give each controller a fixed address. Add a DHCP reservation in your router so the IP never changes. Changing IP address in our offline lights guide shows where to find the MAC address.
2. Set up the subnet router with the Tailscale setup guide, and approve the route.
3. Use the IP, not the name. Names like wled-abc123.local come from mDNS, which stays inside your home network and won’t cross Tailscale. Auto discovery in apps won’t see your lights from outside either. Bookmark http://192.168.1.57 instead, or add the light by IP in your app.
4. Test on mobile data with Tailscale connected. The WLED page should open just as it does at home.

Anything that talks to the light’s IP works the same way while Tailscale is connected, including iPhone Shortcuts that send WLED commands (Siri and Shortcuts guide). If you use WLED Max, our app for WLED on iOS and Android, Manual Entry under Devices › Add Device takes the IP address, as described in add it by IP address.

If it doesn’t work

• Tailscale IPs work but local IPs don’t. The route isn’t approved yet, IP forwarding is off on the subnet router, or the subnet is wrong. The setup guide’s troubleshooting goes through each.
• It works on mobile data but not on a friend’s or a hotel’s Wi-Fi. That network probably uses the same range as yours (192.168.1.x is very common), so your phone has two networks with the same addresses and may send the request to the wrong one. Changing your home network to a less common range such as 192.168.47.0/24 avoids it.
• It worked for months, then stopped. Check the Machines page for an expired key on the subnet router and disable key expiry for it.

Questions people ask

Do I need to open ports or forward anything on my router? Not for Tailscale or Cloudflare Tunnel. Both connect out from your home and get through NAT and CGNAT without router changes. Your own WireGuard server needs one forwarded UDP port.

Is Tailscale the same as a VPN app like NordVPN? No. A commercial VPN sends your internet traffic through its servers. Tailscale connects your own devices to each other. It can act like a commercial VPN if you set up an exit node at home, but you don’t need that to reach home devices.

Can my family use it too? Yes. Invite them from the admin console before they sign in (the free plan allows 6 users), or share a single device with someone’s own Tailscale account. Access rules can limit what each person reaches; the setup guide has an example.

Does it work with Starlink or 5G home internet? Tailscale and Cloudflare Tunnel usually do. Those services often use CGNAT, which blocks port forwarding and a self-hosted WireGuard server, but not tools that connect out.

Sources: Tailscale subnet routers, peer relays, key expiry, exit nodes, pricing, Cloudflare Access, WLED: accessing WLED over the internet.