Remote access without opening ports

With the DNS stack built and monitored, I wanted to administer it from outside the house without forwarding any ports. Tailscale does that. It builds a private mesh between devices, so the Pi-hole nodes, Proxmox, and my admin machines can all reach each other over an encrypted overlay that never touches the public internet.

The tailnet

Install Tailscale on each device, authenticate it, and it shows up in the admin console with an address on the 100.64.0.0/10 range.

Tailscale admin console: the tailnet with the admin laptop and both
Pi-hole nodes joined, addresses and account details redacted

Once the nodes are on the tailnet, SSH to them works from anywhere I’m also on the tailnet, with no port 22 exposed to the world.

systemctl status ssh on ashpi-1: the service active, with journal
lines showing accepted public-key logins over the tailnet and rejected
attempts from outside

That journal is worth looking at. The accepted logins come in over the 100.x tailnet address. The rejected Invalid user attempts are the background noise any SSH daemon sees, and none of them get anywhere, because there’s nothing to reach.

The subnet router

Tailscale connects devices, not networks, by default. To reach a device on the LAN that doesn’t run Tailscale itself, one node advertises the local subnet into the tailnet as a route. After that, the whole 192.168.68.0/24 is reachable from any tailnet device, through that one node.

That covers things like the router’s web UI and the managed switch later, without installing an agent on every box.

The access model

The result is a clean split:

administration goes over Tailscale, private, encrypted, no public surface
the services themselves stay on the LAN
nothing needs a port forward, and there’s no VPN server of my own to patch and expose

This is also the pattern the VPS lab uses later, where SSH is Tailscale-only even though the box is public.

The next phase moved the services off my workstation and onto dedicated infrastructure.