Remote desktop over Tailscale, from your phone

Reachbeam connects directly over your network, so at home on Wi-Fi it just works. To reach those same machines from anywhere — without opening a single port on your router — put them on a Tailscale network. It's a WireGuard mesh with almost no configuration: install it on your home machine and your phone, sign into the same account, and the two can talk over an encrypted private link as if they were side by side.

A community how-to from the Reachbeam team. Tailscale's apps and dashboard change occasionally; the CLI commands are stable.

How it works

Tailscale builds a private mesh (a "tailnet") between your devices using WireGuard. Every device that signs in gets a stable 100.x.y.z address that only your tailnet can reach. There's nothing listening for inbound traffic on your router, so there's no port to forward and no public IP to expose — devices find each other through Tailscale's coordination server and then connect directly, peer to peer, encrypted end to end. From Reachbeam you simply connect to the home machine's Tailscale IP (or its MagicDNS name) and it works from anywhere.

Reachbeam doesn't need to know any of this — you point it at the Tailscale address instead of the LAN address, and everything else is the same.

What you'll need

• A machine at home that stays on — the computer you want to control, or any always-on box (Raspberry Pi, NAS, mini-PC) if you use the subnet-router option below.
• A free Tailscale account — the Personal plan is free for individual use and covers up to 100 devices.
• The Reachbeam app on your phone or tablet.
• A VNC, RDP, or SSH server already running on the target machine (e.g. VNC on 5900, RDP on 3389, SSH on 22).

Step 1 — Create your tailnet

Sign up at login.tailscale.com with an existing identity (Google, Microsoft, GitHub, etc.). That first login creates your tailnet; every device you add later joins the same private network.

Step 2 — Install Tailscale on the home machine

Linux (Raspberry Pi, Ubuntu, most NAS shells):

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The tailscale up command prints a link — open it and authenticate to attach this machine to your tailnet. On Windows and macOS, install the desktop app from tailscale.com/download and sign in. For a Docker host, the official tailscale/tailscale image works too.

Step 3 — Install Tailscale on your phone

Install Tailscale from the App Store or Google Play, open it, and sign in with the same account. Toggle it on — your phone now has a private route to every machine in your tailnet, on any network.

Step 4 — Find the machine's Tailscale address

In the Tailscale admin console (Machines) each device shows a 100.x.y.z address and a MagicDNS name like myserver.tail-scale.ts.net. On the machine itself you can also run:

tailscale ip -4

Either the 100.x IP or the MagicDNS name works as the host in Reachbeam.

Step 5 — Connect in Reachbeam

Open Reachbeam, add a connection, and use the Tailscale address as the host — for example 100.101.102.103 (or the MagicDNS name) on port 5900 for VNC, 3389 for RDP, or 22 for SSH. It connects from anywhere as long as Tailscale is on. For an extra layer, point Reachbeam at the SSH host and run VNC-over-SSH so the desktop session is encrypted independently of the transport.

Optional — reach your whole LAN with a subnet router

Steps 1–5 reach any machine that runs Tailscale. If you'd rather reach everything on your home network — a printer, a router UI, a device you can't install Tailscale on — turn one always-on box into a subnet router:

sudo tailscale up --advertise-routes=192.168.1.0/24

Then approve that route in the admin console (Machines → the subnet router → Edit route settings), and enable Use Tailscale subnets in the phone app's settings. Now Reachbeam can connect to any LAN IP (e.g. 192.168.1.50) through that one router.

Locking it down

• No open ports. Nothing listens for inbound traffic; your router stays closed and your home IP is never exposed.
• Encrypted end to end. Every hop is WireGuard between your own devices — not decrypted by a relay in the middle.
• Only your devices get in. A device must be signed into your tailnet to reach anything. Add ACLs in the admin console to restrict which devices can hit which ports, and keep key expiry on for phones you might lose.
• Credentials stay on-device. Reachbeam stores VNC/RDP/SSH passwords and keys in the device keychain and never sends them anywhere but the target machine.

Prefer a different tool?

Tailscale is the least-config option and its free tier is generous, which is why it's a great default. If you'd rather not run a mesh client on every device, a free Cloudflare Zero Trust tunnel gives a similar no-port-forwarding path back to your LAN. A self-hosted WireGuard server is another solid route. In every case Reachbeam just connects to whatever address the VPN makes reachable.

FAQ