2026-08-19

How to Set Up Tailscale on a Raspberry Pi 5 to Access Your Homelab from Anywhere

Tailscale turns your Raspberry Pi 5 into a WireGuard-based mesh VPN node in about ten minutes, letting you reach every service on your home network from anywhere without opening a single firewall port. This guide walks through the exact steps on the Pi 5 I actually run — including the real hardware, real temps, and real gotchas.

My Exact Build

Before we touch software, here's the hardware I'm working with so you can calibrate expectations:

I haven't personally tested the SanDisk Extreme Pro microSD or the GeeekPi PoE+ HAT in this build — those are commonly recommended for Pi 5 homelab setups based on their published specs, but I can't give you first-hand numbers on them.

Prerequisites

If you'd rather run Tailscale on a cloud VPS instead of (or in addition to) a Pi, a small instance on DigitalOcean or Hetzner Cloud works fine as an exit node or relay.

Step 1: Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh

This adds the official Tailscale apt repository and installs the tailscale and tailscaled packages. On my Pi 5 the install took about 15 seconds over a ~200 Mbps connection. Verify:

tailscale --version

Step 2: Authenticate

sudo tailscale up

This prints a URL. Open it in a browser, sign in with your Tailscale account (GitHub, Google, Microsoft, or email), and authorize the device. Back on the Pi, you'll see a confirmation within seconds.

Check your new Tailscale IP:

tailscale ip -4

You'll get a 100.x.y.z address. This is your Pi's stable identity on the tailnet, reachable from any other device you add to the same account.

Step 3: Enable IP Forwarding (Subnet Router)

This is where the real homelab value lives. Instead of installing Tailscale on every machine, you make the Pi a subnet router that advertises your entire LAN:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Now restart Tailscale with your LAN subnet (adjust to match yours):

sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-dns=false

Approve the Route in the Admin Console

Go to the Tailscale admin panel, find your Pi, click the … menu → Edit route settings, and enable the subnet route. This is a deliberate security step — routes don't activate automatically.

Step 4: (Optional) Enable as an Exit Node

If you want to route all your traffic through your home connection while traveling:

sudo tailscale up --advertise-routes=192.168.1.0/24 --advertise-exit-node

Approve the exit node in the admin panel the same way. On your phone or laptop, you can then select your Pi as the exit node in the Tailscale client.

Step 5: Make It Survive Reboots

Tailscale's systemd unit is enabled by default on Debian:

systemctl is-enabled tailscaled

Should print enabled. If not:

sudo systemctl enable tailscaled

On my build, tailscaled consumes roughly 12–18 MB of RAM and negligible CPU at idle — invisible on a Pi 5 with 15 Gi available.

Step 6: Connect a Client Device

Install Tailscale on your phone, laptop, or another server. Sign in with the same account. You can now:

Step 7: Set Up Tailscale SSH (Kill the Open Port)

Tailscale can handle SSH authentication itself, letting you disable port 22 entirely:

sudo tailscale up --advertise-routes=192.168.1.0/24 --ssh

Then from any device on your tailnet:

ssh user@pi5

No keys to copy, no port 22 exposed. Access is controlled by Tailscale ACLs in your admin panel.

Performance and Thermal Notes

Tailscale using WireGuard is light. On my Pi 5, running an iperf3 test through the Tailscale tunnel between two LAN devices, I saw negligible SoC temperature change — consistent with my baseline measurements of 49.4 °C idle and 48.8 °C under load. The NVMe boot drive's speed (453/438 MB/s sequential) is irrelevant to VPN throughput but matters if you're also running Docker containers or databases on the same Pi — my 16,433 random 4K read IOPS keeps things responsive even when Tailscale traffic coincides with disk-heavy services.

If you're working with your Pi headless and ever need to troubleshoot a display output issue remotely, an MS2131 HDMI Capture Card – 1080p Video & Audio for Headless Servers plugged into the Pi's HDMI port lets you capture the framebuffer over USB from another machine — handy when networking is down and you can't SSH in.

Who Should NOT Do This

Verdict

Tailscale on a Raspberry Pi 5 is the lowest-friction way to get secure remote access to your entire homelab — ten minutes from zero to working, no firewall rules, no dynamic DNS. The Pi 5's thermals and performance make it a set-and-forget subnet router. If you self-host anything at home, this should be the first thing you configure.

🛠️ From the bench shop

Gear from our own store that fits this build — shipped tracked, UK support.

The Homelab Agent Kit — 9 AI Agents, 13-Chapter Build Guide, Python£29.00View →
240W USB-C Fast-Charging & Data Cable – Braided, LED Indicator£5.99View →
MS2131 HDMI Capture Card – 1080p Video & Audio for Headless Servers£20.99View →

← all articles

Some links are affiliate links — if you buy through them I may earn a small commission at no extra cost to you. Benchmarks are run on my own hardware. · Shop · Contact