Tailscale: Reach Your Lab From Anywhere
Flat, private networking to every lab machine with zero opened ports — and why port forwarding was never the answer.
Homelab From Zero04 / 08TL;DR
Install Tailscale on the hypervisor and your laptop, sign in twice, and every lab machine is reachable from anywhere by a stable private address — with nothing exposed to the internet and no router configuration at all.
ELI5
Port forwarding is cutting a hole in your front door so you can reach in from the street. It works, and now the street can reach in too.
Tailscale is different: every one of your devices gets a private phone line to every other one. No holes in any door — the devices call out to find each other, the way every app on your phone already does, and WireGuard encrypts the line end to end. Nothing about your lab is visible from the street at all.
HOW IT WORKS
The twenty minutes
- Install on the Proxmox host — one command from Tailscale’s docs,
then
tailscale upand sign in. The host joins your private network (your “tailnet”) with a100.x.y.zaddress that never changes. - Install on your laptop and phone. Same sign-in. That is the whole client list to start: the machines you sit at, plus the lab.
- Turn on MagicDNS in the admin console, so the lab is
https://proxmox:8006from anywhere instead of a memorised IP. - Check the doors are actually shut: no port forwards on the router, UPnP off. The lab should be reachable from your laptop on mobile data and invisible to everything else.
FAILURE MODES
- The free plan covers a lab many times over — the limits sit far above anything this series builds. The failure is assuming you need to self-host the coordination layer on day one; that is its own project, for later, if ever.
- Tailscale on every VM by reflex. You can, but the host is enough to start — a subnet route from the hypervisor covers the machines behind it with one config instead of ten.
- Forgetting the phone test. Verifying from inside your own Wi-Fi proves nothing about reachability. Turn off Wi-Fi and check from mobile data once — that is the test that means it.
WHAT I LEARNED
The reason to do networking this early — part four, before storage, before any real workload — is that a lab you can reach from anywhere is a lab you actually use. Every part after this one assumes you can open the console from wherever you are, and that assumption is what keeps the series moving.