There are a few classic ways to reach your homelab when you’re out:
- Port forwarding. Every app you open is one more thing on the internet for bots to poke at.
- A traditional VPN (OpenVPN or WireGuard on the router). Better, but it still means an open port, plus certificates and dynamic DNS to manage.
- Tailscale. A WireGuard-based mesh VPN with no open ports and almost no setup.
I went with Tailscale, and specifically with a subnet router, so I didn’t have to install it on every single machine.
Subnet router in one paragraph
Normally you install Tailscale on each device you want to reach. A subnet router is one always-on machine at home that says “I can route traffic to the whole home network”. Your phone or laptop connects to Tailscale, and anything addressed to your home network goes through that one machine. Your NAS, printer, smart plugs and everything else become reachable without Tailscale on any of them.
Setting it up
Pick a machine that’s always on. A Proxmox host, a small LXC or a Raspberry Pi all work. Then:
1. Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh
2. Turn on IP forwarding so the machine is allowed to route traffic:
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
3. Advertise your home subnet (swap in your own range):
sudo tailscale up --advertise-routes=192.168.50.0/24
4. Approve it. In the Tailscale admin console, find the machine, open Edit route settings and tick the subnet. While you’re there, disable key expiry for this machine. Otherwise it’ll quietly drop off your tailnet after a few months and you’ll find out at the worst possible time.
5. Test it. Turn Wi-Fi off on your phone, connect to Tailscale and open something on your home network by its local IP address. If it loads, the router is working.
Linux clients: other Linux machines on your tailnet need
sudo tailscale up --accept-routesbefore they’ll use the subnet route. Phones, Windows and macOS accept routes automatically.
Adding Pi-hole as the DNS server
Reaching things by IP is fine, but I wanted my nice internal names (the ones my reverse proxy uses) to work away from home too, and I wanted ad-blocking on my phone everywhere.
In the Tailscale admin console under DNS:
- Add nameserver → Custom and enter your Pi-hole’s LAN IP address.
- Turn on Override local DNS.
Now every device on the tailnet uses Pi-hole for DNS. Internal names resolve to the proxy, the proxy is reachable through the subnet router, and ads are blocked on mobile data too.
Why this works with Pi-hole’s default settings
Pi-hole is usually set to only answer queries from the local network. By default, Tailscale’s subnet router rewrites the source address of forwarded traffic to its own LAN address, so Pi-hole sees the queries as local and answers them. If you ever turn that behaviour off (--snat-subnet-routes=false), you’ll also need to change Pi-hole’s Interface settings to permit queries from the Tailscale range.
Gotchas I hit
- The subnet router is a single point of failure for DNS. If it goes down, your tailnet devices can’t reach Pi-hole and lose DNS entirely. Adding a public fallback resolver keeps things working, but ads won’t be blocked during an outage. Decide which matters more to you.
- Clashing subnets. If you’re on a café or hotel network that uses the same range as your home network (
192.168.1.xis very common), routing gets confused. Using a less common range at home avoids this. - Remember to remove old VPNs. I had Tailscale installed on my NAS from an earlier experiment. With the subnet router in place, it was redundant, so I removed it. That’s one less thing to update.
The result
From my phone, anywhere, I can open my dashboard, check the NAS or manage containers exactly as if I were at home, and nothing is exposed to the internet. Setup took about twenty minutes, and it’s the single best quality-of-life upgrade I’ve made to my homelab.