Remote Access the Safe Way — Tailscale & WireGuard

The Goal: Reaching Home From Away

Let us start with what you actually want. You are not at home, and you want to reach something on your server - a file, a photo, an app's web page. That is the whole goal.

There are safe ways and risky ways to do this. The risky way opens your server to the entire internet. The safe way lets only your own devices in, through a private tunnel. This guide is all about the safe way.

• Grab a document or photo off a share while traveling.
• Check an app running on the server, like a media library.
• Peek at the web page to make sure everything is healthy.

Why Port-Forwarding the Web Page Is Dangerous

Somewhere online, someone will tell you the "easy" way is to port-forward the web page on your router. Please do not. Here is what that really does.

A port-forward opens a hole in your router and points the whole internet at your server's login page. Within minutes, automated bots find it and start trying passwords - thousands of guesses, around the clock, forever. It only takes one weak spot for them to get in.

• Your files could be copied, deleted, or locked for ransom.
• The server could be used to attack others, without you knowing.
• A single unpatched flaw becomes a wide-open door.

What a VPN Tunnel Is, in Plain Words

VPN stands for virtual private network. Forget the letters. Picture a private, locked hallway between your phone and your home, that no one else can see into or walk through.

Normally, when you are away, your phone and your home are strangers on the internet. A VPN tunnel builds a private connection between them. Your phone acts as if it is plugged into your home network - even though you are miles away.

• Only devices you approve can use the tunnel.
• Nothing new is exposed to the general internet.
• The connection is scrambled, so no one in between can read it.

Tailscale - An Easy Private Network

Tailscale is the friendliest way to build that private tunnel. It handles the hard parts for you, so there is very little to configure. For most home users, this is the one I recommend.

You install Tailscale on your server and on each device you want to connect - phone, laptop, tablet. They all sign into the same account and quietly form your own private network, called a "tailnet." After that, your devices can reach the server from anywhere.

• No router changes and no port-forwarding at all.
• You sign in on each device, and they find each other automatically.
• It works even when your home internet has an awkward setup.

Installing Tailscale on Unraid and Your Devices

Setup has two halves: put Tailscale on the server, and put it on the devices you will use from away. Set aside twenty unhurried minutes.

• Open the web page and go to the Community Applications area.
• Search for Tailscale and install the app.
• Open its settings and follow the link to sign in to your Tailscale account.
• Approve the server in your Tailscale account so it joins your network.

Connecting and Reaching Your Server

Once the server and your phone are both signed in, connecting is almost nothing - you just make sure Tailscale is turned on. Then you reach the server by its Tailscale address.

That is it. Whether you are on hotel Wi-Fi or your phone's cellular data, the tunnel makes your device act as if it is home. Turn Tailscale off when you do not need it, on when you do.

• Open the Tailscale app on your phone and switch it on (it shows connected).
• Find your server's Tailscale address or name in the app's device list.
• Type that address into your browser to reach the web page.
• For files, use that same address as the server name in your file browser.

WireGuard - Built Into Unraid

WireGuard is the other good option, and it comes built into Unraid already. It is a bit more hands-on than Tailscale, but it keeps everything on your own gear with no outside account.

Both create the same kind of safe, private tunnel. Choose Tailscale if you want the simplest path, or WireGuard if you prefer to keep everything in-house and do not mind one careful router step.

Setting Up a WireGuard Tunnel

Unraid has a built-in tool for WireGuard, often shown as VPN Manager. It walks you through creating a tunnel and generating the settings your phone will need.

Unraid generates a configuration, usually as a QR code, for each device. Because WireGuard needs that single router port, follow Unraid's guidance closely - it forwards only the tunnel port, never the web page.

• In the web page, find the VPN Manager (WireGuard) section in settings.
• Create a new tunnel; Unraid fills in most of the technical details for you.
• Add a "peer" for each device you want to connect, like your phone.
• Open the one required port on your router so the tunnel can reach in.

Connecting From Your Phone

With the tunnel made, connecting your phone to WireGuard is quick - you scan a code once, then flip a switch whenever you want in.

From then on, you do not scan again. You just open the WireGuard app and switch the tunnel on when you are away, and off when you are home. It is the same idea as Tailscale, with a code instead of a shared account.

• Install the WireGuard app from your phone's app store.
• In the app, choose to add a tunnel by scanning a QR code.
• Scan the code Unraid generated for that device.
• Toggle the tunnel on - your phone is now inside your home network.

Reaching Shares and App Pages

Once the tunnel is up - either tool - reaching your things works exactly as it does at home. You use the same names and addresses; the tunnel makes the distance disappear.

The trick that trips people up: while connected, use the server's private (home) address, not some public one. With Tailscale you use its Tailscale name; with WireGuard you use the server's home network address. Save those in your phone so you do not have to remember them.

• File shares - open your files using the server's name or address.
• App pages - visit an app's web page by its address and port.
• The web page - manage the server just like you do at home.

Reverse Proxies (Advanced)

You may hear about a "reverse proxy" for reaching apps by a friendly web name. It is a real tool, but it is an advanced topic - and it does not replace the safety of a tunnel.

For most home users, a tunnel like Tailscale or WireGuard is all you need, and it is safer. If you ever do want a reverse proxy, treat it as a project to do carefully - or one to do together with someone who has set one up before.

• It is a helper that sits in front of your apps and routes web requests to them.
• People use it to reach several apps by name instead of remembering port numbers.
• Done wrong, it can expose apps to the internet - so it needs real care.

Dynamic DNS, Briefly

Your home's internet address can change over time. Dynamic DNS is a small service that keeps a fixed name pointed at your changing address, so you always know how to find home.

If your WireGuard tunnel sometimes stops working after your internet provider changes your address, dynamic DNS is the fix. Many routers can set it up for you in a few clicks. It is a convenience, not a security feature.

• It matters mostly for WireGuard, which connects to your home address.
• A dynamic-DNS name gives you a steady label instead of a shifting number.
• Tailscale users usually do not need it - Tailscale handles this for you.

The Official "My Servers" Option

Unraid offers its own official remote-access feature, part of what has been called "My Servers" (now part of Unraid Connect). It is the maker's own way to reach your server from away.

This is a legitimate, first-party option. Features and names do change over time, so check Unraid's own current documentation for exactly what it offers today. Whichever route you choose, the rule holds: reach in through a supported, private path - never a raw port-forward of the web page.

• You link your server to an Unraid account.
• It offers a supported path to reach the web page remotely.
• It also backs up your flash-drive configuration to the cloud for safekeeping.

Keeping Your Keys and Logins Safe

A tunnel is only as safe as the keys and logins that open it. A few simple habits keep that private door truly private.

If someone got your account login or a config file, they could reach your server just like you can. That is why the same care you give a house key applies here. Store any backup copies somewhere safe and private.

• Protect your Tailscale (or Unraid) account with a strong password and two-factor.
• Treat WireGuard QR codes and config files like house keys - do not share them.
• Do not email or text a config file to yourself in the clear.
• Keep your phone locked with a PIN or fingerprint, since it holds the tunnel.

Removing Access for a Lost Device

Phones get lost, laptops get replaced. The moment a device is gone, you want to cut off its access so it can never reach your server again. This is quick, and it is why we gave each device its own key.

Because each phone and laptop has its own separate access, you can remove just the missing one without disturbing the others. Do this the same day a device goes missing - it takes two minutes and closes the door for good.

• Tailscale - sign in to your account and remove or disable that device.
• WireGuard - in Unraid's VPN Manager, delete that device's peer.
• Once removed, that device's key no longer opens the tunnel.

Testing That It Works

Do not wait until you are stranded in a hotel to find out your remote access does not work. Test it while you are still home, where fixing it is easy.

Using cellular data mimics being away, since your phone is off your home network. If it works on cellular at your kitchen table, it will work from across the country.

• On your phone, turn OFF home Wi-Fi so it uses cellular data instead.
• Turn on your tunnel (Tailscale or WireGuard).
• Open the server's address and confirm the web page loads.
• Open a file share and confirm you can see your files.
• Turn the tunnel off and confirm the server is no longer reachable that way.

Troubleshooting a Connection

If the tunnel will not connect, do not panic. The cause is almost always one of a short list of things. Work through them in order.

Restarting the tunnel app, and restarting your phone, clears up a surprising number of glitches. If your home internet address changed, that is where dynamic DNS (page 14) comes in for WireGuard users.

• Is the tunnel actually on? Open the app and confirm it shows connected.
• Same account? For Tailscale, be sure every device uses the same login.
• Right address? Use the server's private name, not a public one.
• Server awake? A sleeping or rebooting server cannot answer.
• WireGuard port? Confirm the one router port is still forwarded.

A Simple Recommendation

You have seen the options. Here is the plain advice I would give a friend at the kitchen table, so you do not have to weigh it all yourself.

Set it up once, test it on cellular, save the address on your phone, and you are done. From then on, reaching your server from anywhere is a single tap - safe, private, and yours alone.

• Start with Tailscale. It is the easiest, needs no router changes, and just works.
• Prefer to keep it all in-house? Use the built-in WireGuard instead.
• Either way - never port-forward the web page. The tunnel is the whole point.

What's in the 27-page PDF

• Why port-forwarding the web page is dangerous
• What a VPN tunnel is, in plain words
• Tailscale - an easy private network, step by step
• WireGuard - the option built into Unraid
• Connecting from your phone and reaching your files
• Removing access for a lost device, and a simple recommendation

Why I wrote this

I write these as printable handouts because a guide you can keep in a drawer beats a web page you have to find again. No jargon, no judgment, no rushing. If you'd rather have someone sit beside you and go through it together, that's a flat $99 first visit with the 30-day follow-up included — serving Portage County from Atwater, Ohio. — Bill