I built my own secure network in the cloud to access my home PCs remotely - for free
Follow ZDNET: Add us as a preferred source on Google.
ZDNET's key takeaways
- Tailscale is a free service that helps you create secure private networks
- Setting up a tailnet doesn't require advanced networking expertise
- It uses trusted encryption software and well-known identity providers
I just got back from an extended vacation that took me to three countries over nearly three weeks. It was supposed to be a relaxing getaway, but I couldn't avoid work entirely. To stay connected, I needed access to two PCs running in my home lab. Those machines are available 24/7, hosting a handful of virtual machines where I'm testing Insider builds of Windows 11, and managing other critical tasks for my business.
When I'm sitting at my desk connected to my home-office network, I can use any Remote Desktop client (including Microsoft's Windows App) to connect directly to any of those machines, physical or virtual. But when I'm out of the office, that network is secured behind my router and unavailable for any outside connections.
If I just needed access to one of those PCs every once in a while, I could use Chrome Remote Desktop or a service like TeamViewer, which is free for personal use. But I'd rather find a secure way to use the tools I already know and trust, regardless of whether I'm at home or on the road.
The answer is Tailscale, a free service that creates a secure private network between all my devices - not just PCs and Macs but also mobile devices. Those devices can connect securely over the internet as though they were all on the same local network, without requiring me to tinker with options on my router or mess with firewall settings.
Also: I've used Windows for decades, but I tried Linux - and one thing surprised me
The result? While I was out of the office, I clicked a shortcut in my Windows App and connected to one of the virtual machines back in my office. It opened effortlessly, even when I was using a slow airplane connection or tethered to my mobile phone on a roaming network.
Did I mention that it's free?
How Tailscale works
Many remote-access and VPN services use a hub-and-spoke model, with encrypted packets from remote PCs (the spokes) flowing through a central server or a VPN gateway (the hub). That model works fine, but it tends to be (a) expensive and (b) slower than you might like, adding latency to every connection.
Tailscale, on the other hand, works like a peer-to-peer mesh network. My machines back in the office are running the lightweight Tailscale client software, and so is the laptop stuffed into my travel bag. They're all authenticated using a secure identity service. I've tested Tailscale with GitHub and Microsoft Entra ID, but I could have chosen Google or Apple as the identity provider or used passkeys managed by 1Password, Bitwarden, or YubiKey.
That authentication adds them to my tailnet, with each one getting a private IP address where they can communicate directly over secure, encrypted tunnels using the well-known and highly regarded WireGuard protocol.
Tailscale's role in all this is to act like a secure directory service that introduces your devices to one another and then gets out of the way. Any device that's signed into my tailnet tells Tailscale's servers where it's located on the internet. When I open that Remote Desktop connection, my laptop asks Tailscale, "Where is this device?" Tailscale's servers reply, "It's online. Here's the information you'll need to reach it securely."
Also: How to upgrade your 'incompatible' Windows 10 PC to Windows 11 - for free
Those two devices establish a direct, encrypted WireGuard connection whenever possible, with Tailscale largely getting out of the way. In cases where a direct connection can't be established, Tailscale relays the encrypted traffic through its network without being able to decrypt it.
Is it secure?
The underlying architecture of Tailscale is rock-solid. Every connection is encrypted end-to-end, and the encryption keys never leave the device. The WireGuard encryption layer is well respected by security experts, and authentication is handled by sources you already know and trust. Tailscale's servers never receive your credentials and they don't see the content of your encrypted traffic.
On my local network, I've allowed Remote Desktop traffic over TCP port 3389. But that port is blocked at the router for outside connections, and for good reason: It's an open door for attackers who want access to your network. But those connections work just fine through the secure tunnel without my having to worry about port numbers, NAT traversal, and firewall configurations. That secure traffic can only come from machines that I've personally added to the private network using my secure credentials.
For an overview of the technology, see the Tailscale whitepaper: "How Tailscale works."
What's the catch?
The free version of Tailscale does everything I need and supports up to six users across an unlimited number of devices, with few limitations and no gotchas. The company promises it will be "free forever." For a home lab or a very small office, that's enough.
Once your organization grows bigger than six people, you probably need to upgrade to a paid plan, which starts at $8 per user per month. That plan will also allow you to set up more than three Access Control List (ACL) groups.
Also: Duress passcodes explained: How they work and why they can land you in court
If you do a lot of work with "ephemeral resources" -- containers, cloud VMs, and Kubernetes workloads that are created and destroyed automatically -- you'll quickly hit the limit of 1,000 minutes per month and you'll need to pay for a new plan.
But most home users, hobbyists, consultants, and very small businesses can use the free Tailscale plan indefinitely.
Tailscale's most impressive trick
One thing you'll quickly discover when you travel overseas is that a lot of services you take for granted just don't work, thanks to regional limitations. Online news sources and streaming services, for example, often stop working or block content for US-based customers accessing the site or service from outside the country.
The normal workaround for those restrictions is to use a VPN service to route your traffic through their servers so it appears to be coming from the correct region.
With a Tailscale network, you can designate a device as an exit node, so that it becomes a gateway for all your internet traffic. Normally, the Tailscale network only carries traffic destined for other devices in your tailnet. Once you enable an exit node, all of your web browsing and app traffic is routed through that device.
I could use one of my laptops back at home as an exit node, but Tailscale offers a much cooler option if you own an Apple TV. Install the Tailscale app on that device and set it up as an exit node.
In that configuration, all internet traffic goes to its destination through your home internet connection. Websites see your home's public IP address instead of the IP address assigned by the hotel, airport, or coffee shop Wi-Fi or the mobile provider you're tethered to.
Apple TV devices are always on. When you turn them off, they go into standby mode, but the network stays up and running. For all intents and purposes, that device is now a personal VPN server, running on a device you own.
I'll be going back to Europe for nearly a month next year. I can't wait to test this feature out.