Secure Remote Access with Tailscale

Goal: reach services running on the headless Linux home server from outside the local network — without opening service ports to the public internet.

Tailscale was installed on the server and on an iPhone, joining both to the same private overlay network. Services kept their existing ports; the only change is that authorized devices reach the server through its private Tailscale IPv4 address. Remote access was verified over cellular data with Wi-Fi disabled, including the self-hosted music server.

• ·Turned off Wi-Fi on the phone to verify Tailscale was genuinely connecting over cellular data instead of the local network.

• ·Access kept working with Wi-Fi disabled on the phone — confirming traffic was genuinely traversing the internet over cellular, not just the LAN.
• ·Services required no reconfiguration: the same ports that work locally work over the Tailscale address.

• ·IP addresses identify machines while ports identify individual services.
• ·Tailscale creates a private overlay network between authorized devices.
• ·Existing services remain on their normal ports while being accessed privately through Tailscale.
• ·The server receives a private Tailscale IP that authorized devices can use remotely.
• ·Remote access can be achieved without exposing service ports directly to the public internet.

• ·Enable MagicDNS so devices can be reached by hostname instead of remembering Tailscale IP addresses.
• ·Explore Tailscale ACLs to control which devices on the network can reach which services.
• ·Set the server up as an exit node so phone traffic can be routed through home when on untrusted networks.
• ·Look into subnet routing to reach other LAN devices that can't run Tailscale themselves.