Homelab from Zero #9: Reach your lab from anywhere with Tailscale

6/26/2026/7 minutes to read/Tags: homelab-from-zero, homelab, networking

This is part 9 of Homelab from Zero. In part 8 you gave every service a clean HTTPS hostname inside your LAN. But that’s the catch: inside your LAN. Today we fix that with Tailscale, so your lab follows you out the front door.

The problem with reaching home

You want to check Uptime Kuma from work, or pull up your dashboard on your phone at a café. The obvious-but-dangerous way is port forwarding: poke a hole in your router so the internet can reach your server. That exposes your services to the entire internet, including everyone scanning for things to break into. Don’t do it.

Tailscale solves this differently. It builds a private, encrypted network between your devices (laptop, phone, server) that works no matter where each one is. To your devices it looks like they’re all on the same LAN, even when they’re on opposite sides of the planet. Nothing is exposed publicly; only devices you’ve added can connect.

How it works, briefly

Tailscale uses a technology called WireGuard to create encrypted tunnels directly between your devices. You sign every device into the same account, and they find each other automatically. There’s no port forwarding, no public IP, no firewall surgery. Each device gets a stable private address on your “tailnet” that follows it everywhere.

Step 1: Install Tailscale on the server

SSH into your server and run the official installer:

curl -fsSL https://tailscale.com/install.sh | sh

Then bring it online:

sudo tailscale up

It prints a URL. Open it in a browser, sign in (Google, GitHub, or email, your choice), and that authenticates the server onto your tailnet. Check its tailnet address:

tailscale ip -4

You’ll get something like 100.x.y.z. That address is reachable from any other device on your tailnet, and only from your tailnet.

Step 2: Install Tailscale on your phone and laptop

Install the Tailscale app on whatever you’ll connect from:

• Phone: the Tailscale app from the App Store or Play Store.
• Laptop: download from tailscale.com/download.

Sign in with the same account on each. Within seconds they appear in your tailnet alongside the server. That’s it. They can now reach the server’s 100.x.y.z address from anywhere.

Step 3: Reach a service remotely

From your phone (on mobile data, away from home), open the Uptime Kuma dashboard using the server’s tailnet IP:

http://100.x.y.z:3001

It loads, as if you were sitting at home. The same works for every service; just swap in the right port.

Step 4: Use your .home names anywhere (MagicDNS)

Typing 100.x.y.z is no nicer than typing a LAN IP. Tailscale has a feature called MagicDNS that gives each device a clean name. Enable it in the Tailscale admin console under DNS → MagicDNS, and your server becomes reachable as a simple hostname like http://server:3001 from any of your devices.

Want your Caddy .home URLs to work remotely too? In the Tailscale admin console you can set your tailnet’s nameserver to point .home lookups at your Pi-hole. Then https://heimdall.home works from your phone exactly like it does at home, green padlock and all. It’s an optional extra; the plain tailnet IPs already get you remote access.

A note on safety

What you have now

Secure, encrypted access to every service in your homelab from anywhere in the world (your phone, your work laptop, a friend’s house) with nothing exposed to the public internet and no router configuration to get wrong. Your lab is no longer tied to your couch.

In part 10 we level up the hardware side: Proxmox, which turns your single box into a platform that can run several virtual machines at once, the first step from “a server” to “a real lab.”