I built my own secure network in the cloud to access my home PCs remotely, for free
Mid-trip I needed dependable remote access to two home-lab PCs without exposing RDP to the public internet. Instead of a commercial VPN or a screen-sharing service, I created a private tailnet with Tailscale so my travel laptop and those machines acted like they were on the same LAN, even across continents and flaky airplane Wi-Fi.
Why this approach matters
Remote access tools usually do one of two things: expose a single machine to the internet, which is risky, or route sessions through a third-party server you do not control, which can be slow and raise privacy concerns. Tailscale gives a third option for personal and small-team use: identity-backed peer-to-peer tunnels over WireGuard and a cloud control plane that only introduces devices. For casual remote work, hobbyist home labs, and tiny teams this is a practical sweet spot: low setup effort, strong encryption, and limited exposure.
How it works, control plane vs data plane
Think of Tailscale as two cooperating systems.
- Control plane (the directory): devices authenticate using an identity provider (I tested GitHub and Microsoft Entra ID. Tailscale also supports Google, Apple, and passkeys via 1Password, Bitwarden, or YubiKey). Each device registers with Tailscale’s control servers, which know public node IDs, public IPs, and how to reach devices. Tailscale documents this model in its whitepaper, “How Tailscale works” (whitepaper and privacy pages, checked August 2026).
- Data plane (the tunnels): when two nodes want to talk, they try to form a direct WireGuard tunnel (peer-to-peer). If NATs or carrier restrictions prevent a direct path, Tailscale falls back to encrypted relays (DERP). Those relays forward encrypted packets but do not terminate your WireGuard session.
Put simply, the control plane introduces peers and the data plane carries encrypted traffic. Private keys stay on endpoints to perform WireGuard encryption. The control plane facilitates introductions and exchanges public key material (Tailscale documentation, checked August 2026).
Costs, limits and what “free” actually means
Tailscale’s pricing separates features by tier. As of August 2026, the company advertises a free plan (presented as “free forever” on its pricing page, checked August 2026) and paid plans that start at $8 per user per month. The free tier works well for individual users and small home labs, but it has limits you should know before relying on it for production use:
- Free tier: supports up to six users (with an unlimited number of registered devices under those users, per Tailscale’s pricing page, checked August 2026).
- Ephemeral resource limit: short-lived cloud resources (containers, cloud VMs, Kubernetes workloads) on the free plan are capped. Tailscale documents a 1, 000-minute/month limit in its plan details as of August 2026. Heavy ephemeral usage will require a paid plan.
- ACL and enterprise features: the free plan has limits on Access Control List (ACL) group configuration and lacks the audit and compliance features available on higher tiers.
If you need more granular access controls, centralized logging for audits, or large ephemeral compute time for CI/CD, evaluate a paid tier or consider self-hosted control-plane alternatives such as headscale for complete ownership.
What I actually did on the trip (short recipe)
- Created a Tailscale account and invited one extra user (the free plan supports up to six users).
- Installed the Tailscale client on my travel laptop (Windows) and both home-lab PCs.
- Authenticated devices using GitHub for the personal account (Entra ID works, but tenant admins may need to allow Tailscale SSO in enterprise tenants).
- Used Windows Remote Desktop to connect to the tailnet IP of the home PC, no port forwarding on the home router was required.
- Tested an exit node by enabling an always-on home device to route outbound web traffic through my home public IP.
Result: responsive Remote Desktop sessions during real travel conditions. These were anecdotal tests, I didn’t run a systematic throughput benchmark, but I handled text editing, terminal work, and occasional GUI tasks over both airplane Wi-Fi and mobile tethering. When a direct WireGuard path was not available, connections fell back to Tailscale’s DERP relays and remained encrypted end-to-end.
About using an Apple TV as an exit node (a caution)
I experimented with an Apple TV as the home exit node because it stays in standby and provides a persistent public IP for outbound traffic. Your mileage may vary, consumer devices differ by model and firmware, and some do not preserve networking in standby. For a reliable, low-power exit node I recommend a small Linux device, a Raspberry Pi, Intel NUC, or a home router that supports Tailscale unless you can confirm your Apple TV model and tvOS behave as needed for your setup.
Security reality check
Tailscale is designed so private keys stay on endpoints. The control plane exchanges public keys and the relays (DERP) forward encrypted packets. That design reduces exposure compared with opening RDP (TCP 3389) to the internet, a configuration repeatedly flagged by security researchers (see reporting from Huntress and other security outlets on RDP risks).
But design is not a guarantee. Practical points to keep in mind:
- The control plane necessarily sees metadata required to broker introductions, such as node IDs, public IPs, and timestamps. Review Tailscale’s privacy docs to understand retention and scope (privacy page, checked August 2026).
- DERP relays forward encrypted payloads but will see connection endpoints and timing metadata.
- Application-level security still matters: keep RDP behind Network Level Authentication (NLA), enforce strong account passwords, and use 2FA where possible.
When a tailnet is a good fit and when it isn’t
Good fit:
- Personal home labs and single-owner servers where you want private, identity-backed access without opening ports.
- Small teams that need simple access controls and fast setup with SSO.
- Individuals who want a personal VPN (exit node) to make remote traffic appear to originate from their home IP.
Not a fit (without extra planning):
- Large enterprises that need full auditability, centralized compliance posture, or SOC2-grade logging, these features live on paid tiers or require different tooling.
- Workflows that will exceed ephemeral minute caps (CI pipelines, heavy container usage).
- Use cases that require absolute control of metadata and retention; consider a self-hosted control plane for that level of ownership.
Operational notes for anyone who wants to try this
- If you use Microsoft Entra ID, tenant admins may need to approve Tailscale SSO in your Azure AD app gallery. For personal use, GitHub or Google often require less admin work.
- Headless servers can use Tailscale’s CLI auth key flow. Register once via a browser token and the device stays connected.
- Test whether devices negotiate a direct WireGuard path or fall back to DERP. The client UI or logs will report the route type. Direct peers give lower latency when available.
- For reliable exit nodes prefer a low-power Linux box or a router with Tailscale support rather than a consumer streaming device unless you confirm its standby networking behaviour.
Risk checklist for business use
- Confirm company policy on employee-run VPNs or personal exit nodes.
- Review SSO app approvals required by your identity provider (Entra/G Suite/GitHub).
- Enable RDP Network Level Authentication and strong account controls before exposing desktops to any remote access tool.
- Decide on audit and logging needs, if you require enterprise logs, evaluate the paid tiers or self-hosted alternatives.
- Check ISP terms and jurisdictional implications before routing traffic through a home IP.
Key takeaways: quick questions
- Can I really get remote access for free?
Yes. Tailscale offers a free tier (advertised as “free forever” on its pricing page, checked August 2026) that is practical for personal use and small home labs; it supports up to six users under that plan. Expect limits on ACL groups and ephemeral resource minutes.
- Is it secure to run Remote Desktop over Tailscale?
Generally yes, Remote Desktop traffic runs over WireGuard tunnels authenticated by your identity provider and private keys remain on devices. But the control plane sees metadata and DERP relays see endpoint/timing information, so keep application-level protections (NLA, strong credentials, 2FA).
- What happens when devices can’t form a direct connection?
Tailscale falls back to its DERP relays which forward encrypted traffic. The data remains encrypted end-to-end; metadata and connection endpoints are still visible to the control and relay systems.
- When should I pay for Tailscale?
If you need more ACL granularity, extensive ephemeral compute time, enterprise auditing, or compliance features, upgrade to a paid plan (starting at $8/user/month as of August 2026) or consider a self-hosted control plane for full metadata control.
- Can I use a home device as a VPN exit node?
Yes. Configuring an always-on home device as an exit node routes remote traffic through your home IP. For reliability, choose a purpose-built always-on device (small Linux box or compatible router) rather than assuming every consumer device will behave the same way in standby.
Last thought, practical and opinionated
A tailnet is a pragmatic answer for people who want secure remote access without juggling port forwarding or trusting a third-party session broker for every connection. It’s not a replacement for enterprise network architecture, formal compliance tooling, or exhaustive threat modeling. But for getting real work done from an airplane seat or a café, with minimal setup and stronger protections than exposing RDP to the internet, it’s an elegant option worth trying.
Next step if you want to test: create a free Tailscale account, add two devices, confirm a direct WireGuard path, then try a Remote Desktop session over both wired and mobile links. Capture ping and responsiveness as your baseline and enable RDP’s NLA before connecting.