Tailscale: How I Reached My Mac mini Without Exposing a Single Port

For years, the standard way to reach a machine at home from the outside world meant one of two uncomfortable choices: forward a port on your router and pray nothing on the internet found it, or stand up a full VPN server and babysit its configuration. I recently wanted remote access to a Mac mini sitting on my home network, and I didn't want to do either. Tailscale let me skip both — no ports opened, no firewall rules, no static IP. This post is what it is, how it works, how to set it up, and the exact problem it solved for me.

What Tailscale Is

Tailscale is a mesh VPN built on top of WireGuard, the modern open-source VPN protocol prized for being fast and cryptographically simple. Where a traditional VPN funnels every device through one central server, Tailscale instead connects your devices directly to each other in a peer-to-peer mesh. That private network of your devices is called a tailnet.

The pitch is deceptively simple: install the client on each device, sign in with an identity you already have (Google, Microsoft, GitHub, Okta, and so on), and those devices can suddenly see each other on a private 100.x.y.z address — as if they were all plugged into the same LAN, no matter where they physically are.

How It Actually Works

A few pieces do the heavy lifting:

• WireGuard for the tunnels. Every connection between two devices is end-to-end encrypted with WireGuard. Tailscale handles the key exchange and distribution for you, so you never touch a config file.
• A coordination server for setup, not traffic. Tailscale runs a control plane that helps your devices find each other and exchange public keys. Crucially, your actual data does not flow through Tailscale's servers — once two devices know how to reach each other, they talk directly.
• NAT traversal. This is the magic. Most home and office networks sit behind NAT, which normally blocks unsolicited inbound connections. Tailscale uses techniques like STUN-style hole punching to establish a direct peer-to-peer path through both firewalls — without any port forwarding. If a direct path genuinely can't be made, it transparently falls back to relaying through its encrypted DERP relays so the connection still works.
• MagicDNS. Instead of memorizing IP addresses, each device gets a friendly name. I reach my Mac mini at macmini rather than a numeric address.
• ACLs and Tailnet Lock. Policy rules govern which devices may talk to which, and Tailnet Lock prevents anyone from quietly adding a rogue device to your network.

What People Use It For

• Remote access to home or lab machines — the classic "reach my desktop / NAS / home server from a coffee shop" case.
• Replacing a legacy corporate VPN with identity-based, zero-trust access that doesn't bottleneck through one gateway.
• Connecting cloud and on-prem — wiring together servers across AWS, a homelab, and a laptop as if they shared one network.
• Securing CI/CD and Kubernetes workloads that need private connectivity between environments.
• Subnet routers and exit nodes — expose an entire home subnet through one device, or route all your internet traffic out through a trusted node.

Setting It Up: A Quick Walkthrough

The whole point of Tailscale is that there's barely anything to configure. Here's the end-to-end flow to get two devices talking.

1. Create your tailnet. Sign up at tailscale.com using an identity provider you already have (Google, Microsoft, GitHub, etc.). The first sign-in creates your tailnet automatically.

2. Install the client on your first device. Tailscale ships native apps for macOS, Windows, Linux, iOS, and Android.

• macOS / Windows / mobile: install the app from the App Store, the Microsoft Store, or the Tailscale download page, open it, and click Log in.
• Linux: one command does the install and a second brings the device online:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

That tailscale up prints a login URL — open it, authenticate, and the device joins your tailnet.

3. Install the client on your second device and sign in to the same account. That's the only requirement for two devices to find each other — same tailnet, both authenticated.

4. Confirm they can see each other. The admin console at login.tailscale.com/admin/machines lists every device with its tailnet IP (a 100.x.y.z address) and its MagicDNS name. From a terminal you can check the same thing locally:

tailscale status        # list peers and their IPs
tailscale ip -4         # show this device's tailnet IP
ping macmini            # reach a device by its MagicDNS name

5. Connect to a service. Once the devices are on the tailnet, use them exactly as you would on a LAN — point SSH, screen sharing, a web app, or a file share at the device's MagicDNS name:

ssh you@macmini

Optional — Tailscale SSH. If you'd rather not manage SSH keys at all, enabling Tailscale SSH lets your tailnet identity authenticate the connection and encrypts it through WireGuard:

sudo tailscale up --ssh

That's genuinely the whole setup. No port forwarding, no certificates, no VPN server to maintain.

My Use Case: The Mac mini, No Ports Opened

Here's the concrete thing I wanted. I have a Mac mini at home that I use as an always-on machine, and I wanted to reach it from my laptop wherever I happened to be. The traditional answer — forward SSH or screen-sharing ports on my router to that Mac — is exactly the kind of internet-facing attack surface I didn't want to maintain.

With Tailscale, the setup was almost anticlimactic — the same steps above:

• Installed the Tailscale client on the Mac mini and signed in.
• Installed it on my laptop and signed in to the same account.
• That's it. Both devices joined my tailnet and could reach each other directly.

From anywhere, my laptop now reaches the Mac mini over an encrypted WireGuard tunnel using its tailnet name. SSH, file transfer, screen sharing — all of it works as if I were sitting on the same home network. And the part that matters most: my router's firewall is still completely closed. There is no forwarded port, no service listening on a public IP, nothing for a scanner on the open internet to find. Access is gated by my identity and my tailnet's access rules, not by a port that's either open to everyone or no one.

That's the shift Tailscale represents — instead of poking holes in your perimeter and hoping, you get private, authenticated, encrypted connectivity between your devices, and the public internet simply never sees them.

The Takeaway

If you've ever hesitated before forwarding a port just to reach a machine at home, Tailscale removes the dilemma entirely. It's free for personal use, takes a few minutes to set up, and turns "expose a service to the internet" into "let my own devices talk to each other privately." For a single Mac mini or a fleet of servers, the model is the same — and it's a genuinely better default than the port-forwarding habits many of us grew up with.

Source: What is Tailscale? — Tailscale Docs