The Night I Tried to Check on My Server From a Train, and Why Tailscale Fixed Everything

Picture this. You’re on a train. The wifi’s the kind that buffers a single emoji for four seconds. And for some reason — paranoia, boredom, you just need to know — you decide to check if your home server’s still alive.

You type in the address. The one that’s always worked. The one you’ve typed a hundred times at home, lying on the couch, half-watching something else.

Nothing loads.

You wait. Refresh. Start blaming your phone, then your carrier, then the train, then — dread creeping in — you start wondering if the server itself died. Did the power go out? Did a raccoon get in and unplug something out of spite?

Here’s the actual answer, and it’s almost insulting in how simple it is: your server was never reachable from outside your house in the first place. That address — the 192.168.something one — only means anything inside your home network. Step outside it, onto cellular data, onto a coffee shop's wifi, anywhere else, and that address might as well be a phone number missing its area code. It points to nothing.

This is the problem basically every homelab person runs into eventually. You build this cool little server at home — an old laptop, maybe one of those tiny dedicated mini PCs people build homelabs on — and it works beautifully while you’re sitting in the same room as it. The second you leave the house, it vanishes. Your server now lives in a locked room, and you left the only key on the kitchen counter.

The “Just Open a Port” Trap

So you go looking for a fix, and the first thing the internet tells you is: “just forward a port on your router.”

Sure. That works. Technically. You go into your router, say “any traffic that comes in on port 8097, send it straight to my server,” and congratulations — your server is now reachable from anywhere on Earth.

The problem is that “reachable from anywhere on Earth” includes a lot of people who are not you, and a non-trivial number of them spend their days scanning the entire internet for exactly this kind of open door. Port forwarding isn’t wrong — plenty of people run public-facing servers this way, deliberately, with real care put into locking them down. But it’s a serious commitment. You’re not just opening a door, you’re agreeing to stand guard at it forever — patching software, watching logs, configuring firewalls, hoping you didn’t miss anything. Less “quick fix,” more “new responsibility you’ve adopted, like a pet, except this pet can get you hacked.”

For most of us who just want to peek at our own media server from a train without inviting the entire internet over, there had to be a better way.

Enter Tailscale, the Quiet Hero of This Story

Here’s the idea, and it’s genuinely elegant once it clicks: instead of opening your home network to the internet, what if you built a tiny, private, invitation-only network made up of only your devices — server, phone, laptop — no matter where any of them physically are?

That’s Tailscale. It doesn’t punch a hole in your router. It doesn’t make your server visible to strangers. Instead, it gives every device you own its own permanent, private address, and lets those devices talk directly to each other through an encrypted tunnel — as if your phone on a train somewhere and your server sitting at home were plugged into the same network switch.

Your server, from the internet’s perspective, stays basically invisible. From your phone’s perspective, it’s right there, like it never left the room.

🔧 Technical note: Under the hood, Tailscale is built on WireGuard, a modern VPN protocol that’s popular precisely because it’s lean — a small, auditable codebase instead of decades of accumulated legacy complexity that older VPN protocols carry. What Tailscale adds on top of raw WireGuard is the genuinely hard, fiddly part: automatically handling key exchange and NAT traversal (the technical headache of getting two devices, each behind a different home router, to find each other at all) via a small coordination server Tailscale runs. That coordination server just helps the introduction happen — once your devices know how to reach each other, your actual traffic flows peer-to-peer, directly between them, not through Tailscale’s servers.

Okay, But How Does It Actually Work

No magic, I promise — just clever plumbing.

1. You install the Tailscale app on every device you want in this private club. Server, phone, laptop, whatever.
2. Each device logs in once — Google, Microsoft, GitHub, email, whatever you’ve got — and joins what Tailscale calls your “tailnet.” Think of it as your own personal, invisible network that exists no matter where the devices physically are.
3. Every device gets handed a private address starting with 100. — and unlike your home IP, this one follows the device around. Doesn't matter if your server's in your bedroom or your phone's in another country; the address stays the same.
4. From then on, any device on your tailnet can just talk to any other device on it, using that address, like they’re in the same room.

🔧 Technical note: That 100.x.y.z range isn't random — it's CGNAT address space (100.64.0.0/10), a block specifically reserved for this kind of carrier-grade private networking. It's deliberately chosen so it won't collide with the 192.168.x.x addresses your home router hands out, meaning your home LAN and your tailnet can coexist without ever getting confused about who's who.

Actually Setting This Up

Alright, story time’s over — let’s get our hands dirty.

Step one: get it onto your server.

Most Linux machines, this is almost suspiciously easy:

curl -fsSL https://tailscale.com/install.sh | sh
tailscale up

Run that second command and it spits out a login link. Click it, sign in, and that’s it — your server just joined the tailnet. No reboot, no drama.

🔧 Technical note: If your server runs things through Docker — common on container-first home server platforms (CasaOS, Unraid, and similar) — you might have Tailscale running inside a container rather than installed directly on the host. In that case, grab its assigned address with:

*docker exec -it tailscale tailscale ip -4*

That’s the address you’ll actually use to reach it from outside.

Step two: get it onto your phone (and laptop, if you want).

This part’s almost anticlimactic — just a normal app store download. Install it, log into the same account, and your phone’s now a citizen of the same private network as your server. No further config needed.

Step three: find out your server’s new secret address.

Pop open the Tailscale admin console in any browser, and it lays out every device on your tailnet next to its assigned address, something like:

my-server     100.81.6.70    ← example only, yours will be different
my-phone      100.92.4.13    ← example only, yours will be different

Quick but important note: those numbers above are made up, purely to show you the shape of what you’ll see. Your actual tailnet will hand out completely different digits. Use yours, not mine.

Step four: the payoff — actually reaching it from anywhere.

Say your server runs some web dashboard on port 8097. Now, from literally anywhere — that train, a hotel wifi in another city, your friend’s couch — you just go to:

http://100.81.6.70:8097

(swap in your server’s real Tailscale address from step three, obviously)

And there it is. Same dashboard, same speed almost, like you never left home.

A Few Honest Things to Know Before You Trust It With Everything

• It’s not totally decentralized. Tailscale’s coordination server is a company’s infrastructure, not yours. They broker the introduction between your devices but never see your actual traffic — still, if “zero third parties involved, ever” is a hard requirement for you, there’s an open-source self-hosted alternative called Headscale that replaces just that coordination piece, while using the same Tailscale client apps. Worth knowing it exists, even if you don’t need it day one.
• Anyone you invite onto your tailnet can potentially reach what’s on it. If you ever add a friend or family member, Tailscale lets you scope what they can see — don’t just hand out blanket access by default.
• Turn on MagicDNS. One toggle, and suddenly you can type my-server instead of memorizing strings of numbers. Future-you will thank present-you.
• It’s free for personal use, generously so — plenty of device slots for a server, your phone, and a laptop or two, without paying anything.

Where This Leaves Us

So that’s the fix to the train-platform panic: your server wasn’t dead, it was just never supposed to be reachable like that in the first place — and now it actually can be, safely, quietly, without you becoming an unpaid security guard for your own house.

This matters more than it might seem, because the next two things in this series — Jellyfin, your own private Netflix, and Immich, your own private Google Photos — both get dramatically more useful once you can reach them from anywhere. Every time those guides would normally say “open a port to access this remotely,” you get to skip that part entirely. You’ve already solved it.