A Raspberry Pi sitting on your home network is a brilliant little doorway back into that network when you're away from home. Tailscale makes building that doorway almost embarrassingly easy, because it handles the encryption, the key exchange, and the awkward business of punching through your router's firewall without you touching a single port forwarding setting. This guide shows you how to set up Tailscale on a Raspberry Pi, whether you've got a brand new Pi 5, a solid Pi 4, or an older Pi 3 gathering dust in a drawer.
The whole process takes about 15 minutes, and you don't need any networking experience. If you can copy and paste a command into a terminal, you can do this.
Once it's running, your Pi becomes a permanent, always-on entry point into your home network. You'll be able to reach your other devices, printers, and smart home gear from anywhere, without opening your router to the wider internet.
What You'll Need
- A Raspberry Pi (any model from the Pi 3 onwards works fine, including the Pi 4 and Pi 5)
- A microSD card or SSD with Raspberry Pi OS already installed
- A power supply and a working internet connection for the Pi
- Either a keyboard and monitor, or SSH access to the Pi from another computer
- A free Tailscale account (you can sign up with a Google, Microsoft, GitHub or email account)
- About 15 minutes
Step 1: Update Raspberry Pi OS
Before installing anything new, it pays to make sure your Pi's software is current. Open a terminal (or SSH into the Pi) and run:
`` sudo apt update && sudo apt upgrade -y ``
This fetches the latest package lists and installs any pending updates. It can take a few minutes on an older Pi 3, so this is a good point to put the kettle on.
Step 2: Install Tailscale on the Pi
Tailscale provides an official install script that detects your system and sets everything up correctly. It works the same way whether you're installing Tailscale on a Raspberry Pi 5, a Pi 4, a Pi 3, or any other model running Raspberry Pi OS.
Run this single command:
`` curl -fsSL https://tailscale.com/install.sh | sh ``
This downloads the script, adds Tailscale's official repository to your system, and installs the Tailscale package along with its dependencies. You'll see a stream of output as it works through the process. It usually finishes within a minute or two, even on a Pi 3.
Step 3: Connect the Pi to Your Tailscale Network
With Tailscale installed, you now need to authenticate the Pi so it joins your personal network (Tailscale calls this a "tailnet").
Run:
`` sudo tailscale up ``
The terminal will print a URL. Copy that link into a browser on any device, log in with your Tailscale account, and approve the new device. Once approved, the terminal on your Pi will confirm the connection and the command will return.
Check that everything worked by running:
`` tailscale status ``
You should see your Pi listed along with its Tailscale IP address, something like 100.x.x.x. That address is how you'll reach the Pi from anywhere once you're away from home.
Step 4: Make Tailscale Start on Boot
A Pi that only connects to Tailscale when you remember to run a command isn't much use as a remote access point. You want it to start automatically every time the Pi boots, including after power cuts or restarts.
The install script already sets up a systemd service for this, but it's worth confirming it's enabled:
`` sudo systemctl enable --now tailscaled ``
This tells the Pi to start the Tailscale daemon at boot and keep it running in the background. To double check it's active:
`` sudo systemctl status tailscaled ``
Look for "active (running)" in the output. If your Pi ever loses power or restarts unexpectedly, Tailscale will reconnect on its own without you needing to log back in.
Step 5: Turn the Pi Into a Gateway to Your Home Network
By default, Tailscale only lets you reach the Pi itself, not the other devices sitting on the same network as it. To use the Pi as a true doorway into your home, you need to enable subnet routing.
- Find your home network's address range. This is usually something like 192.168.1.0/24 or 192.168.0.0/24. You can check this in your router's admin page or by running
ip routeon the Pi. - Enable IP forwarding on the Pi so it can pass traffic between networks:
`` echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf sudo sysctl -p /etc/sysctl.d/99-tailscale.conf ``
- Advertise your home network range to Tailscale:
`` sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-dns=false ``
Replace 192.168.1.0/24 with your actual network range from step 1.
- Open the Tailscale admin console in a browser and go to the Machines page. Find your Pi, click the menu next to it, and approve the advertised route. Until you do this, the Pi will offer the route but Tailscale won't actually use it.
Once approved, any device on your tailnet can reach devices on your home network through the Pi, even when you're sitting in a café on the other side of the country.
Step 6: Test Your Remote Access
Before you rely on this setup, test it properly. Take a laptop or phone, install the Tailscale app, log into the same account, and then disconnect from your home Wi-Fi (use mobile data, or a friend's hotspot).
Try pinging or accessing another device on your home network using its normal local IP address, such as 192.168.1.50. If you enabled subnet routing and approved it in the admin console, it should respond exactly as if you were at home.
If you're weighing up Tailscale against other remote access options, it's worth reading the best way to access your home network remotely, compared to see how it stacks up against traditional VPNs and other tools.
Common Mistakes to Avoid
- Forgetting to approve the subnet route. This is the single most common hiccup. The Pi will advertise the route, but nothing works until you tick it in the Tailscale admin console.
- Using the wrong IP range. If your router uses 192.168.0.0/24 but you advertise 192.168.1.0/24, nothing on your network will be reachable. Double check with
ip routebefore running the command. - Not enabling IP forwarding. Without the sysctl changes in step 5, the Pi can join the tailnet fine but it won't be able to pass traffic through to other devices.
- Powering the Pi from a weak USB port. An underpowered Pi can drop off the network randomly, which looks like a Tailscale fault but is actually a hardware issue.
- Assuming it works the same as port forwarding. Tailscale doesn't open anything to the public internet, so you won't see it in your router's port forwarding list, and that's exactly the point.
Conclusion
That's the whole process for how to set up Tailscale on a Raspberry Pi, from a blank install to a working gateway into your home network. The Pi's low power draw means you can leave it running permanently without worrying about your electricity bill, and because Tailscale handles encryption and NAT traversal for you, there's no need to touch your router's settings at all.
If you'd like to compare this approach against other ways of getting into your home network, have a look at this beginner's guide to accessing your home network remotely. And if you've already got a VPN provider you like, it's worth checking whether NordVPN's Meshnet feature can do something similar.
FAQ
Does Tailscale work on all Raspberry Pi models?
Yes. Tailscale runs on the Pi 3, Pi 4, Pi 5, and even older models like the Pi Zero 2 W, as long as they're running a 64-bit or 32-bit version of Raspberry Pi OS with internet access. Older boards will just feel a touch slower during the initial install.
Do I need a static IP address for this to work?
No. Tailscale assigns your Pi a fixed address within its own private network (something like 100.x.x.x), and that address stays the same even if your home router changes your Pi's local IP. You don't need to configure a static IP on your router at all.
How do I start Tailscale on a Raspberry Pi after a reboot?
If you followed step 4 and enabled the systemd service, Tailscale starts automatically every time the Pi boots. You don't need to run tailscale up again. If it ever doesn't reconnect, check the service status with sudo systemctl status tailscaled.
Can I use Tailscale and still restart my router remotely?
Yes, the two aren't connected. Tailscale just gives you a secure path into your network. If you also want to restart your router itself from afar, take a look at these ways to restart your router remotely.
Is Tailscale free to use on a Raspberry Pi?
Tailscale offers a free tier that covers personal use, including a generous number of devices. It's enough for most home setups, including a Pi acting as a gateway alongside your phone and laptop.
What if I want more control, like running my own WireGuard setup instead?
Tailscale is actually built on WireGuard under the hood, but if you'd rather manage WireGuard directly on your router, guides like setting up WireGuard on an ASUS router or understanding WireGuard config files are good next steps.
