Secure remote access to your NAS with Tailscale

The problem

Around twenty services run on the NAS — Jellyfin, Immich, Home Assistant, monitoring dashboards — all reachable locally. Step off the network and none of them are.

The classic answer is to open ports on the router, set up port forwarding and dynamic DNS, then hope no bot finds the exposed services.

Classic VPN vs Tailscale

A classic self-hosted VPN (OpenVPN, native WireGuard) requires opening at least one UDP port on the router, configuring port forwarding, managing dynamic DNS if the IP changes, maintaining the server with its certificates and keys, and configuring each client by hand.

Tailscale is a WireGuard-based mesh VPN that creates point-to-point tunnels between devices: no central server to maintain and no open ports on the router. Connections use NAT traversal (STUN/DERP), which finds the most direct path between two devices, even behind double NAT. When that's impossible, traffic goes through DERP relays but stays end-to-end encrypted.

Installation via Ansible

# group_vars/nas.yml (Tailscale excerpt)
tailscale_auth_key: 'tskey-auth-xxxxx' # auth key (vault)
tailscale_subnet_router: true
tailscale_advertised_routes: '192.168.1.0/24'
tailscale_exit_node: true
tailscale_accept_dns: true

What the role actually runs:

curl -fsSL https://tailscale.com/install.sh | sh

sudo tailscale up \
    --authkey=tskey-auth-xxxxx \
    --advertise-routes=192.168.1.0/24 \
    --advertise-exit-node \
    --accept-dns

Subnet router: exposing the whole LAN

This is the most powerful feature. With subnet routing, the NAS becomes a gateway exposing the entire local network (192.168.1.0/24) to Tailscale devices.

From a phone on 4G with Tailscale on, you reach every NAS service by its local IP (192.168.1.50:8096 for Jellyfin), the other LAN devices (network printer, IP cameras, home automation hub) and admin interfaces (the router, managed switches). Apps behave exactly as if you were on the local network.

Two prerequisites. First, IP forwarding on the NAS:

# /etc/sysctl.d/99-tailscale.conf
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

Second, route approval in the Tailscale console (or via tailscale set with ACLs). Without it, advertised routes never propagate.

Exit node: secure browsing

Enabled on a client, the exit node routes all of the device's internet traffic through the NAS, which becomes the egress proxy. Useful on public Wi-Fi: instead of trusting the local network, everything is encrypted in the WireGuard tunnel to the NAS and exits via your home connection.

On the client it's a simple toggle in the Tailscale app, switchable per network.

Real use cases

• Jellyfin while travelling: watch your films and shows anywhere, without exposing port 8096
• Immich from the phone: automatic photo backup and browsing away from home
• Emergency SSH: connect to the NAS from a laptop to fix something quickly
• Internal dashboards: Homepage, Uptime Kuma, Scrutiny without making them public
• Secure public Wi-Fi: exit node enabled at a hotel to browse via the home connection

MagicDNS: names instead of IPs

Tailscale includes an internal DNS, MagicDNS, which automatically resolves tailnet machine names:

ssh nasadmin@nas.tail1234.ts.net

Combined with subnet routing, you keep local-IP access for Docker services and the Tailscale hostname for SSH.

Checking status

$ tailscale status
100.64.1.1    nas          francois@   linux   active; direct 192.168.1.50:41641
100.64.1.2    laptop       francois@   linux   active; direct 82.66.x.x:38412
100.64.1.3    pixel8       francois@   android active; relay "par"
100.64.1.4    macbook-pro  francois@   macOS   idle; offline

You immediately see which devices are connected, whether directly or via relay, and their state. Here the phone goes through a DERP relay in Paris — no direct connection possible, but end-to-end encrypted traffic.

Firewall integration

An important point: Tailscale uses its own interface (tailscale0) and isn't affected by UFW rules. Traffic arrives already decrypted on tailscale0 and then reaches services locally — which is why LAN-restricted services stay reachable over Tailscale.

No firewall rules to change, unlike a classic VPN where you often have to add rules for the VPN subnet.

Tailscale vs self-hosted WireGuard

The trade-off is depending on the Tailscale service for coordination — not for the traffic, which stays point-to-point.

On performance, WireGuard is known for minimal overhead: on a direct connection there's no perceptible difference between local access and Tailscale access. Only a DERP relay adds latency, and that's rare.

Summary

No open ports, no dynamic DNS, no complex VPN to maintain: install the app on a device, connect, and the whole local network is reachable as if you were at home. It's the solution to recommend to anyone self-hosting who wants remote access without compromising security.