Guides

WireGuard or Tailscale: secure access to your home network from anywhere

Want to access your Home Assistant, your NAS, or your photos while on the go? Don’t open them directly to the internet. Instead, create a VPN to your home network: your phone or laptop will then behave as if it’s at home. There are two good methods: Tailscale (the easiest) and WireGuard (full control yourself).

First: can you open ports?

For your own WireGuard server, a port must be accessible from outside to inside. That doesn’t always work. Some providers share one address with multiple customers (CGNAT). Here’s how to check:

  1. Check your router for the IP address of the internet connection (WAN).
  2. Check at What is my IP? which address we see.
  3. If they match, you’re not behind CGNAT. If they differ, or if the address in your router starts with 100.64. through 100.127., then you are, and port forwarding won’t work.

Behind CGNAT, choose Tailscale (or a VPN via a server outside your home).

Option 1: Tailscale

Tailscale builds on WireGuard and handles the keys, address exchange, and router traversal for you. You don’t need to open a port. For personal use there’s a free plan; check the current terms on their site.

  1. Create an account (you log in with an existing account, such as Google, Microsoft, or GitHub).
  2. Install Tailscale on the server (Linux): 
    curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
  3. Open the link that appears and approve the device.
  4. Install the app on your phone or laptop and log in with the same account. You’ll now see your devices with an address starting with 100..

Reaching your entire home network (including devices you can’t install Tailscale on) is done with a subnet router. Enable forwarding and advertise your network:

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale up --advertise-routes=192.168.1.0/24

Then approve the route in the Tailscale admin console (under the machine). Replace 192.168.1.0/24 with your own network. An exit node routes all your traffic through home, useful on public WiFi.

Option 2: Set up WireGuard yourself

This requires an open UDP port and a static or reachable address via a name (for example with dynamic DNS). On the server:

sudo apt install wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee telefoon.key | wg pubkey > telefoon.pub

Create /etc/wireguard/wg0.conf on the server (fill in the keys from the files above; eth0 is your network card):

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = INHOUD_VAN_server.key
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = INHOUD_VAN_telefoon.pub
AllowedIPs = 10.8.0.2/32

Enable forwarding (net.ipv4.ip_forward = 1, see above) and start the connection:

sudo systemctl enable --now wg-quick@wg0

Forward UDP port 51820 in your router to the server. The configuration for your phone (create a QR code from it in the app):

[Interface]
Address = 10.8.0.2/24
PrivateKey = INHOUD_VAN_telefoon.key
DNS = 192.168.1.2

[Peer]
PublicKey = INHOUD_VAN_server.pub
Endpoint = yourname.example.nl:51820
AllowedIPs = 192.168.1.0/24, 10.8.0.0/24
PersistentKeepalive = 25

With AllowedIPs = 0.0.0.0/0 all your traffic routes through home. Only use DNS if you have your own DNS server, for example Pi-hole.

Watch out

  • Choose a different network range for the VPN than for the network you’re currently on. Many home networks use 192.168.1.0/24; if your hotel or office uses that too, nothing will work. Check this with the CIDR overlap tool.
  • Our port checker only tests TCP ports. WireGuard uses UDP, so a “closed” result doesn’t mean anything here. Test by actually connecting.
  • Store private keys securely and revoke access (remove the peer) if you lose a phone.
  • Don’t put Home Assistant or NAS directly on the internet. A VPN is much safer.

Sources and attribution

This article was written in our own words. Read more: