How to Set Up Tailscale and Reach Your Home Network

Quick answer: Tailscale setup has three parts: the app on your phone and computer, one always-on device at home that shares your network, and one approval in the admin console.

Create a free account at tailscale.com.
Install the app on your phone and computer and log in with the same account.
Install Tailscale on one always-on device at home. On Linux, turn on IP forwarding first, then run sudo tailscale set --advertise-routes=192.168.1.0/24 (with your own network).
Approve the route on the Machines page of the admin console and disable key expiry for that device.
Turn off Wi-Fi on your phone and open a home device by its local IP. It works from anywhere.

This tutorial covers each platform, the home server options, MagicDNS, exit nodes, access rules and the problems people run into. If you are still choosing between Tailscale, Cloudflare Tunnel and port forwarding, our comparison of free ways to reach home devices explains the trade-offs. Steps and labels were checked against Tailscale’s documentation in October 2026.

Before you start

An account. Tailscale signs you in through an identity provider: Google, Microsoft, GitHub, Apple, Okta, OneLogin or a custom OIDC provider. There are no Tailscale passwords, and you can’t sign up with a plain email address. Whichever account creates the tailnet becomes its owner.
The plan. The free Personal plan allows up to 6 users and unlimited user devices, with up to 50 tagged resources, as of October 2026. Devices behind a subnet router don’t count. See Tailscale pricing for current numbers.
Your home network range. On your phone at home, open the Wi-Fi details. An IP of 192.168.1.23 with mask 255.255.255.0 means your network is 192.168.1.0/24. Many Android phones show no mask; there, a gateway (router) of 192.168.1.1 almost always means 192.168.1.0/24. Your router’s admin page shows the exact range.

Install Tailscale on your phone

iPhone and iPad

Install Tailscale from the App Store. It needs iOS 15 or later.
Open it and tap Get Started.
Accept the prompt to add a VPN configuration and allow notifications. The notifications warn you before a key expires.
Tap Log in and sign in.

Android

Install Tailscale from Google Play. It needs Android 8.0 or later.
Open it and accept the VPN connection request.
Tap Sign in with Google, or Sign in with other for Apple, Microsoft or GitHub. Use the same account as before, and allow notifications so you hear before a key expires.

Phones accept subnet routes automatically, so once the home side is set up there is nothing else to change here.

Install Tailscale on a computer

Windows

Download the installer from tailscale.com/download/windows. It needs Windows 10 or later.
Run it. A Tailscale icon appears in the system tray (check the overflow arrow if you don’t see it).
Right-click the icon, select Log in and sign in in the browser.

Mac

Tailscale offers three versions for macOS 12 Monterey or later. Its docs recommend the Standalone version from its own download server; the Mac App Store version works too. Install, follow the onboarding to add the VPN configuration, and log in from the menu bar icon. Tailscale explains the differences.

Linux

Tailscale’s install script covers the mainstream distributions, Raspberry Pi OS included:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

tailscale up prints a login link. Open it in a browser, sign in, and the machine shows up in the admin console.

Linux (like other command-line-only installs) does not accept subnet routes by default. On a Linux laptop that leaves the house, run sudo tailscale set --accept-routes so it can reach your home network from elsewhere. Never turn this on for the subnet router itself or for other Linux machines that stay at home: their own home traffic would be pulled into Tailscale, and a subnet router can lose its network entirely. On a laptop it works, but at home its traffic to those devices goes through the subnet router. The routes show with ip route show table 52, not plain ip route.

Add more devices and family members

Add another device

On the Machines page, select Add device. For a phone or computer, install the app and sign in with your account. For a Linux server, pick the Linux server option and copy the install command it gives you, which already includes a key. A TV or another device without a browser shows a QR code or a short code at login; scan it with your phone, or enter the code from Add device.

Once a device is in, open it from any other device by its Tailscale address (100.x.y.z, shown in the app or with tailscale status) or by its name (see MagicDNS).

Add family members

Each person who signs in without an invite gets their own empty tailnet and sees none of your devices. A partner who installs Tailscale and signs in with their own Google account lands in exactly that situation. So invite them first:

Open the Users page of the admin console and select Invite external users.
Enter their email address, or use Copy invite link and send it yourself.
Have them open the invite, accept it, and only then install the app and sign in.

The free plan allows up to 6 users. To limit what each person can reach, see access rules.

Make a home device a subnet router

A subnet router shares your whole home network with your tailnet, so you can reach devices that can’t run Tailscale: light controllers, cameras, printers, the router itself. Pick a device that is always on and wired to your network if possible. Then approve the route (next section).

Raspberry Pi or any Linux box

Flash Raspberry Pi OS Lite with Raspberry Pi Imager. In Imager’s customization step, set a username, password and hostname, enable SSH and add Wi-Fi if you won’t use Ethernet.
Boot it and connect: ssh [email protected].
Install Tailscale and log in with the two Linux commands above.
Turn on IP forwarding and advertise your network:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

sudo tailscale set --advertise-routes=192.168.1.0/24

Use tailscale set to change settings on a machine that is already connected: it changes only what you name and keeps the rest. tailscale up expects every option each time you pass any, and tailscale up --reset clears the ones you leave out. Both commands save their settings across reboots, and tailscale get shows what is set now. If the machine uses firewalld (Fedora, for example), Tailscale’s docs also suggest sudo firewall-cmd --permanent --add-masquerade.

Home Assistant

The Tailscale app comes from the Home Assistant Community Apps repository (apps were called add-ons before Home Assistant 2026.2).

In Home Assistant, go to Settings › Apps, open the app store and install Tailscale.
Start it, check the log, then open its Web UI and log in. The app’s docs suggest doing this step on a computer in Chrome.
On the app’s Configuration tab, add your network under advertise_routes, for example 192.168.1.0/24. The default is an empty list, so nothing is shared until you add it.
Restart the app, then approve the route in the admin console.

The app’s documentation also recommends disabling key expiry for the Home Assistant machine. Details are in the Tailscale app docs.

Unraid

On Unraid 7 and later, use the official plugin:

Open Apps, search for Tailscale (Plugin) and install it. Ignore the older Docker options.
Open Settings › Tailscale (under Network Services), turn on Advanced View, select Reauthenticate and then Connect.
In the plugin’s Advertise Routes section, add your network (192.168.1.0/24) or only the server’s IP as a /32, and select Apply.

Sources: Unraid docs, Tailscale’s Unraid page.

Synology

Open Package Center, search for Tailscale and install it.
Open the app and log in.
SSH is off by default on DSM. Turn it on under Control Panel › Terminal & SNMP › Enable SSH service, then connect with an administrator account.
Run sudo tailscale set --advertise-routes=192.168.1.0/24. If tailscale isn’t found, use the full path, /var/packages/Tailscale/target/bin/tailscale.

On DSM 7, other apps on the NAS can’t make outgoing Tailscale connections until you add a boot task. That only matters if the NAS itself needs to reach other tailnet devices. Go to Control Panel › Task Scheduler › Create › Triggered Task › User-defined script, set the user to root and the event to Boot-up, and use this script:

/var/packages/Tailscale/target/bin/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service

Run it again after each Tailscale package update. Synology can advertise routes but can’t accept them, devices shared through it may not answer ping even though web pages load, and Tailscale SSH doesn’t run on it. All of this is in Tailscale’s Synology guide.

QNAP

Install Tailscale from the Communications section of App Center, open it and select Connect. Subnet routes need the command line: SSH in and run tailscale set --advertise-routes=... from the app’s package folder, since the command isn’t on the normal path. Tailscale’s QNAP page shows where it is.

Docker

The official image takes its settings from environment variables. TS_ROUTES advertises a subnet, TS_STATE_DIR with a volume keeps the container logged in across restarts, and TS_AUTH_ONCE=true stops it from logging in again on every start (without it, a restart can fail once the key is used up or expired). The image runs in userspace mode by default, which handles subnet routing without extra privileges.

services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}     # from an .env file, not committed anywhere
      - TS_HOSTNAME=home-router
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_AUTH_ONCE=true
      - TS_ROUTES=192.168.1.0/24
    volumes:
      - ./tailscale-state:/var/lib/tailscale
    restart: unless-stopped

Create the auth key under Settings › Keys in the admin console. Auth keys expire after 1 to 90 days (90 if you don’t choose); with the state volume and TS_AUTH_ONCE in place, a one-off key is enough, and a reusable key is riskier if it leaks. The container still gets the normal 180 day device key, so disable key expiry for it on the Machines page, or create the auth key with a tag, since tagged devices don’t expire. In userspace mode the host and other containers can’t use the tailnet; only routing into your network works. Docker parameters reference.

Windows PC or Apple TV

A Windows PC that stays on works as a subnet router. Open PowerShell as administrator and run tailscale set --advertise-routes=192.168.1.0/24, then right-click the tray icon and turn on Run unattended under Preferences; otherwise Tailscale stops when you sign out of Windows. A Mac is a poor choice, since the app needs a logged-in user. Running unattended.

An Apple TV is the easiest home device for many families. It needs tvOS 17 or later (18 is recommended). Install Tailscale from the App Store on the TV, log in by scanning the QR code with your phone, then open the app’s Subnet Router screen and enter your network in CIDR form, such as 192.168.1.0/24. Keep the Apple TV set as a home hub in its Settings, or it sleeps and drops off. Apple TV routes IPv4 networks only. Tailscale’s Apple TV page.

Your router

Most routers from internet providers can’t run Tailscale, and neither can the stock firmware on Fritz!Box or TP-Link Archer and Deco models. The ones that can:

GL.iNet routers have Tailscale built in (firmware 4.2 or later, still marked beta by GL.iNet), with a switch to share your LAN (called “Allow Remote Access LAN”, or “Advertise LAN Subnets” in firmware 4.9 and later). GL.iNet’s Tailscale page.
pfSense has a Tailscale package in Package Manager.
OPNsense has the os-tailscale community plugin under System › Firmware › Plugins (tick Show community plugins; it needs OPNsense 24.7.11 or later). Tailscale’s OPNsense page.
OpenWrt has a tailscale package (apk add tailscale on 25.12, opkg install tailscale on older releases). It needs about 30 MB of storage, more than many retail routers have, and subnet routing also needs a tailscale0 interface and a firewall zone for it. Follow the OpenWrt wiki for both.

UniFi only runs it through an unofficial community script, and MikroTik only in a RouterOS container. For any of these, a Raspberry Pi, a NAS or an Apple TV is the simpler subnet router.

Approve the route and keep it running

Open the Machines page of the admin console. Devices that advertise routes have a Subnets badge.
Select the device, go to its Subnets section and select Edit.
Under Subnet routes, tick your route and select Save.
Back on the Machines page, open the device’s menu and choose Disable Key Expiry.

Keys expire after 180 days by default. When the subnet router’s key expires, remote access stops until someone logs it in again, which is never convenient when you’re away.

Test from outside

On your phone, turn Wi-Fi off and make sure Tailscale shows as connected.
Open the subnet router’s Tailscale address (find it in the app or with tailscale ip -4). If that works, Tailscale itself is fine.
Open a home device by its local IP, for example http://192.168.1.50. If that works, the subnet route is working.

Names instead of numbers: MagicDNS

Every device running Tailscale gets a name. With MagicDNS, on by default for tailnets created since October 2022, you can type ping pi or open http://homeassistant:8123 instead of a 100.x.y.z address, or use the full name ending in .ts.net. Enable it from the DNS page of the admin console if your tailnet is older.

MagicDNS only names devices that run Tailscale. Devices behind a subnet router keep their local IPs. Names like printer.local come from mDNS, which stays inside your home network, so they won’t resolve from outside. If you run your own DNS server at home, Tailscale’s split DNS setting on the DNS page can send lookups for your home domain to it. MagicDNS docs.

Exit nodes: use your home internet from anywhere

An exit node sends all your internet traffic through a device at home, which is handy on public Wi-Fi. It is not needed to reach home devices. On Linux, enable IP forwarding as above, then:

sudo tailscale set --advertise-exit-node
sudo tailscale up

If tailscale up complains about missing flags, skip it; set alone takes effect. Approve the exit node in the admin console (Edit route settings, then Use as exit node), and pick it under Exit Node in the phone app. Allow LAN access (Android) or Allow Local Network Access keeps printers and other devices on the Wi-Fi you’re on reachable while the exit node is active. Expect more battery use while it’s on. Exit node docs.

Who can reach what: access rules

A new tailnet starts with a policy that lets every device reach every other device. That is fine when it’s just you. When you invite family, you can narrow it on the Access controls page. Tailscale’s docs now favor rules written as grants. This example lets the owner and admins reach everything, lets everyone reach their own devices, and lets other members reach only two light controllers at home:

{
  "hosts": {
    "porch-lights": "192.168.1.57",
    "kitchen-lights": "192.168.1.58"
  },
  "grants": [
    // owner and admins: everything, including exit nodes
    { "src": ["autogroup:owner", "autogroup:admin"], "dst": ["*", "autogroup:internet"], "ip": ["*"] },
    // everyone: their own devices
    { "src": ["autogroup:member"], "dst": ["autogroup:self"], "ip": ["*"] },
    // family members: two light controllers
    { "src": ["autogroup:member"], "dst": ["porch-lights", "kitchen-lights"], "ip": ["*"] }
  ]
}

The policy file is HuJSON, so comments like these are allowed. Replacing the default policy removes the allow-all rule and the default SSH rule, so use the Preview rules tab before saving and check that your own devices still connect afterwards. Using an exit node needs a grant to autogroup:internet, which is why the first line includes it. Grants docs.

Can you use Tailscale without installing it?

Mostly no: the device you connect from needs Tailscale. There are a few ways around that, each with limits.

Serve (tailscale serve 3000) puts a web app running on that machine behind an HTTPS address ending in .ts.net. It is still only reachable from your tailnet, but the address is easier to remember and has a real certificate.
Funnel (tailscale funnel 3000) publishes one web service to the whole internet at https://<name>.<tailnet>.ts.net. It needs MagicDNS, HTTPS certificates and the funnel attribute in your policy, only uses ports 443, 8443 or 10000, runs only where the Tailscale command line is available, and is still in beta. Anyone can reach what you publish, so only use it for apps with their own login, never for smart home gear. Funnel docs.
Sharing a device with someone outside your tailnet still needs them to install Tailscale, but they keep their own account and see only that one device. Sharing docs.

For a public dashboard with no app at all, a Cloudflare Tunnel with a login in front is the other common choice; our comparison covers it.

Smart lights on the other end

Light controllers such as WLED are a typical reason to set up a subnet router: they can’t run Tailscale, and they should never be port-forwarded. Give each controller a fixed IP with a DHCP reservation (where to find the MAC address), then open it by that IP from your phone while Tailscale is connected. Auto discovery won’t see the lights from outside, because it relies on your home network.

To control WLED lights away from home with WLED Max, our app for WLED on iOS and Android, add each light by its IP once (add it by IP address). With Tailscale connected, the app then reaches those lights on mobile data the same way it does on your Wi-Fi.

Troubleshooting

Can’t reach devices on the home network

Work through these in order:

Route approved? The Machines page should show the route under the device’s Subnets section without a pending label.
Tailscale IP works? Open the subnet router’s 100.x.y.z address. If even that fails, the problem is the connection itself, not the route.
IP forwarding on? Run sysctl net.ipv4.ip_forward on a Linux router. It should print = 1. Recent Linux clients also show a health warning when it is off.
Right range? The route has to cover the device. 192.168.1.0/24 does not cover 192.168.0.50.
Linux client? A Linux laptop away from home needs sudo tailscale set --accept-routes to use routes. Leave it off on Linux machines that stay at home (why).
Same range on both ends? If the Wi-Fi you’re on also uses 192.168.1.x, your device sees two networks with the same addresses. Try mobile data, or move your home network to a less common range.
Access rules? If you edited the policy, make sure it allows you to reach the subnet.
Expired key? An expired subnet router stops routing for everyone. Check the Machines page.

Names don’t resolve

Use IPs for devices behind the subnet router. MagicDNS and .local names won’t find them.
Make sure the client uses Tailscale DNS: tailscale set --accept-dns=true on Linux, or in PowerShell as administrator on Windows; on a Mac, turn on Use Tailscale DNS settings in the menu bar menu.
Some routers and internet providers block DNS answers that point to private addresses (DNS rebinding protection). Tailscale’s DNS troubleshooting covers the workarounds.

It worked, then stopped after a few months

That is key expiry. Log the device in again (sudo tailscale up --force-reauth on Linux, or log in from the app), then disable key expiry for it. Don’t run --force-reauth over an SSH session that goes through Tailscale, because it drops that connection. If the key has already expired, the device’s menu on the Machines page offers Temporarily extend key, which gives you 30 minutes; use that window to select Disable Key Expiry. On phones Tailscale sends a notification before the key expires, which is a good reason to allow notifications.

Phone battery drains faster

Tailscale’s docs name using an exit node for all traffic as the most common cause, so turn the exit node off when you don’t need it. Beyond that, our own advice: keep the app updated, and switch Tailscale off at home if you don’t need it there. Battery drain notes.

Slow connection

Run tailscale ping <device> from a computer. The first replies often come “via DERP” while the two devices look for a direct path. If every reply says via DERP and it ends with “direct connection not established”, traffic is going through a relay, which adds delay. tailscale netcheck shows whether your network blocks UDP; strict firewalls on hotel or office Wi-Fi are the usual cause.

Two things help. Turn on UPnP or NAT-PMP on your home router, which makes direct connections easier. Or run a peer relay on an always-on device at home: sudo tailscale set --relay-server-port=40000, make sure that UDP port is reachable (on most home routers, forward it), and add a grant with the relay capability as described in Tailscale’s peer relay docs. tailscale status then shows the connection as peer-relay, which is usually much faster than Tailscale’s shared relays. Connection types.

Commands worth knowing

tailscale status                 # devices in your tailnet and how you're connected
tailscale ip -4                  # this device's Tailscale IPv4 address
tailscale ping <device>          # direct or relayed, and the latency
tailscale netcheck               # what your current network allows
sudo tailscale set --advertise-routes=192.168.1.0/24   # share a subnet
sudo tailscale set --accept-routes                     # use subnets (Linux laptops only)
tailscale down                   # disconnect
tailscale up                     # connect again

Tailscale setup FAQ

How long does Tailscale setup take? Phones and computers take a couple of minutes each. A Raspberry Pi subnet router takes longer, mostly for flashing the card.

Is Tailscale free for home use? Yes. The Personal plan is free for non-commercial use with up to 6 users and unlimited user devices, as of October 2026 (pricing).

Do I need Tailscale on every device at home? No. One subnet router shares the whole network. Install Tailscale directly only on devices you want to reach by name or that leave the house.

Do I need to forward ports? No. Tailscale connects out from both ends and works behind CGNAT.

Should I use tailscale up or tailscale set? Use up to log in or bring the connection back. Use set to change options; it keeps everything else as it is.

Does a subnet router slow down my home network? Only the traffic you send through Tailscale goes through it. Everything else on your Wi-Fi is untouched.

Can I have two subnet routers? Yes, for failover if one goes offline. Advertise exactly the same range on both and approve both. The switch takes a short while, not an instant.

Is Tailscale open source? The core client code is open source on GitHub. The coordination server is Tailscale’s own service. Headscale is a self-hosted alternative to that server.

Sources: Tailscale documentation for subnet routers, Linux install, iOS, Android, macOS, Windows, Apple TV, inviting users, key expiry, auth keys, MagicDNS, exit nodes, grants, policy file syntax, peer relays and pricing.