Tailscale VPN Setup on Raspberry Pi: Secure Home Networking

Have you ever faced a situation where you need to access something from your system at home while you are out? I work on many coding projects I would like to access from anywhere. To do this, you need to establish a connection between your systems.

Tailscale is a zero-configuration mesh VPN service that helps access a remote network. It can be installed on Raspberry Pi with a few simple commands and allows one-click connectivity for personal devices running the Tailscale application.

This tutorial will walk you through installing and configuring Tailscale on your Raspberry Pi. Then, I will also show you how to add your first device to the Tailscale VPN and test this newly established connectivity. But first, let’s start with a refresher on VPN and Tailscale.

If you’re new to Raspberry Pi or Linux, I’ve got something that can help you right away!
Download my free Linux commands cheat sheet – it’s a quick reference guide with all the essential commands you’ll need to get things done on your Raspberry Pi. Click here to get it for free!

Tailscale: An Introduction

Tailscale is a VPN service based on the WireGuard VPN protocol (check out the linked article to know more about what that is). One thing you will notice in that article is there’s a lot of setup needed to start a VPN on your Pi (managing config files, setting up security, etc.).

This is where Tailscale helps you, it makes these config steps easy by configuring everything for you. All you need to do is install its application and you are good to go! Now, back to the VPN stuff. To help you understand what Tailscale does, look at the image below.

It helps you “create your internet, where only your devices are present“. It takes care of all the security aspects which doesn’t allow other devices to access your network. Much easier to understand now, right? So, let’s discuss how this can be useful for our Pi.

Related: 14 Most Searched Raspberry Pi Project Ideas This Year

Why would it be useful for the Pi?

A Private Network of which our Raspberry Pi is a part can be very useful for several applications.

Talking from a personal standpoint, I do a lot of projects involving coding and using my Pi as a development device. If I have a VPN, I can connect to my Pi (which is at home) from anywhere with one click.

Apart from this, some popular use cases where this can be advantageous are:

• Secure remote access to your Pi.
• A private file storage solution for your devices,
• Private home automation (Like Homebridge, but on VPN).
• Private sedia server (Jellyfin on a Private Network!).

So, to conclude, you can use your Pi for existing applications but with much more security and peace of mind that only your devices can access your Pi’s services and not the whole Internet! Now that we know the basics, let’s get our hands dirty and start the tutorial.

Note: If you want to self-host your own VPN gateway, I have a video on this topic just for community members where I show you all the steps. Join here to watch, and get access to 30+ other lessons for Raspberry Pi along with many other benefits!

Hardware/Software Requirements

To follow along with me in this tutorial, you will need the following things:

• Raspberry Pi: I suggest using a Raspberry Pi 3 with 1 GB RAM at minimum. I recommend having a Raspberry Pi 4 with at least 2 GB RAM, which is what I am using.
• A computer with an SD card reader (can be a Raspberry Pi with Imager on it).
  You can use a cheap USB adapter if you don’t have one (like this one on Amazon).
• A micro-SD card to install the latest Raspberry Pi OS on the Raspberry Pi.
  Here is my current recommendation for the best performance, but any model will do for this tutorial as it aims to show you how to install and setup Tailscale on your Pi.
• A second hardware device like a laptop or PC to test that your Private network is working by installing the Tailscale client on it.

Do you have all that? Congrats, you can start with me!

Installing and Configuring Tailscale on Raspberry Pi

Installing Tailscale on your Pi is a fairly straightforward process, if you have a Pi with Raspberry Pi OS (preferably the latest version). In this section, we will do the following:

• Getting Pi Ready for Tailscale
• Tailscale Installation and First-Time Setup
• Basic Commands Walkthrough for Tailscale

So, let’s start by logging into our Pi (either remotely or through a monitor setup) and getting it ready for Tailscale.

Getting your Pi Ready For Tailscale

By default, you cannot use APT to install Tailscale. We will need to add the Tailscale repository to install Tailscale. Just follow the steps below to prepare your Pi:

• As always, before we begin anything, let’s update any out-of-date packages using these two simple yet effective commands:
  
  sudo apt update
sudo apt upgrade
  
• We will use the curl package to get some things for the Tailscale Repo and the apt-transport-https package so let’s check if we have those installed (we most probably would have them but it’s always good to check):
  
  sudo apt install curl apt-transport-https
  
• Next, we need a package signing key for the Tailscale Repository. It’s basically like a key that only opens a lock attached to Tailscale packages so the system knows what it’s installing is authentic. The following command helps us do that:
  
  curl -fsSL https://pkgs.tailscale.com/stable/raspbian/bullseye.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg > /dev/null
  
  
• Now that we have the key, we can finally add the Tailscale repository to our system with the following command:
  
  curl -fsSL https://pkgs.tailscale.com/stable/raspbian/bullseye.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
  
  
  Don’t worry about the Bullseye OS mentioned in the commands, I have tested it and it works for the latest Raspberry Pi OS versions perfectly.
  
• Finally, we need to run the update command once more so that the package manager refetches the repository list and finds the newly added Tailscale Repo.
  
  sudo apt update
  
  

Great! Our Pi is now ready to install the Tailscale package.

Tailscale: Installation and First-Time Setup

• Once you have the Tailscale repository configured for your package manager, installing it is as simple as installing any other package, with the following command:
  
  sudo apt install tailscale
  
  
  
  This will take some seconds to complete so be patient. Once the installation is complete, we can get started using Tailscale.
  
• To start the Tailscale service, you need to execute the following command on your terminal:
  
  sudo tailscale up
  
  This will start the VPN service on your Pi and provide you with a link to complete the first-time configuration, which involves creating or logging into a Tailscale account (this will be very useful later) and adding your Pi to this network. The link will look something like:
  
  To authenticate, visit: https://login.tailscale.com/a/xxxxxxxxxxxx
  
• Open this link in a new browser window on your Pi and you will see the following screen:
  
  
  
• As you can see, there are many to create a new account with Tailscale. Select your preferred method and create an account with them. Once you complete the sign-up process, you should see the following screen:
  
  
  Tailscale asks for permission to add your Pi to Tailscale’s tailnet network associated with your account. Press the Connect button to give the authorization and your Pi will be added.
  
  
  
• Perfect! Your Pi is now part of your Tailscale private network. You will be redirected to the dashboard, which will show your Pi with its username and an associated IP address (marked in the below image).
  
  
  The next step is adding a second device to your network and verifying this connectivity. However, before doing that, let’s go through some basic terminal commands for Tailscale to help you manage things.

Basic Getting Started Commands for Tailscale

Few commands are required to do things with Tailscale as its primary objective is to make these things simple for you. So, let’s start with the most basic commands:

• Up command: We already used this in the last section. It is used to start the Tailscale service on your Pi.
  
  sudo tailscale up
  
  Note that if you are doing this for the first time like above or you’ve deauthorized the device (command below), you will be prompted to log in as we did above.
  
• Down command: This command allows you to stop the Tailscale service (without deleting the authorization permissions).
  
  sudo tailscale down
  
  If you want to start the service again, execute the up command.
  
• Logout command: This command is used when you don’t want to use Tailscale on your Pi and want to disconnect it from your Tailscale network.
  
  sudo tailscale logout
  
• IP command: As the name suggests, this command retrieves your Pi’s unique IP address within your Tailscale network. You can also get this from your Tailscale dashboard as shown in the last section.
  
  tailscale ip
  
  It returns both the IPv4 and IPv6 address for your device. An example output for the above command looks like this:
  
  100.xxx.xxx.xxx # IPv4 address
fd7a:xxxx:xxxx::xxxx:9147 # IPv6 address
  
• Status command: When you want to check what devices are a part of your network, you can use this status command. It provides you with a list of devices in your network and their IP addresses (these are the addresses of your devices in your VPN).
  
  tailscale status
  
  

Those are all the commands you will need to manage your device and the Tailscale network it is part of. Now, let’s add a new device to our network and test how to establish a secure connection between them.

Adding another Device to your VPN

We will now install the Tailscale client on another personal device we own and see how we can add that device to our existing Tailscale network (tailnet) and how a VPN connection works between them.

Installing Tailscale on a Second Device

• First, let’s install Tailscale on another device. You can choose any device of your choice as Tailscale supports almost all major platforms but for this tutorial, I am using my personal computer, which is a MacBook. The software is available as an application on the App Store so it’s a one-click installation process.
  
  
  
• You can install it on any of your other devices as easily. Just follow this link and install it on the platform of your choice. Once you have it on your device, open the application and you will be prompted to log in to your Tailscale account.
  
  
  
• Log in to the same account we created in the last section when setting up things for our Raspberry Pi. Once you log in, you will be asked again if you want to add this device to your network. Again press on the Connect button and you are good to go!
  
  
  
• Great, we now have two devices in our Tailscale network. You can view them from the Tailscale Dashboard or by using the Tailscale status command on the Pi we learnt in the last section.
  
  

Perfect! Now that we have two devices in our network, let’s hop onto our Pi again and verify that we can connect to our second device.

Testing Network Connectivity Between Devices

To test the connectivity between our devices, we will use the terminal on our Pi and the ping command.

• First, open a new terminal window or tab on your Raspberry Pi. Note the IP address of your second device (which is my laptop) and then execute the following command in this new window:
  
  ping <second-device-ip> -c 4
  
  This command tries to connect to your device through your private network by sending and receiving small packages 4 times (that is what we configure with -c argument).
  
• As these devices are part of the same network (Tailscale’s private network), they will be able connect with each other and you will see the following output for your command:
  
  

Hence, we have verified that our devices are connected through the Tailscale network. This marks the end of our tutorial. If you followed through till now, Thank you for reading my article!

Conclusion and Next Steps

We learned a lot of things in this tutorial. Here is a summary of everything we did:

• First, we learned what a private network (VPN) is.
• Next, we covered what Tailscale is and how using it on the Pi can be useful.
• After that, we learnt how to install and configure Tailscale on our Raspberry Pi.
• Finally, we installed Tailscale on another device and showed how to connect with that device through our Tailscale private network.

This is just the first step you took towards familiarizing yourself with Tailscale. You can do more with this like setting up a subnet router or setting up more secure Access permissions.

Alternatively, if you want to use another service, there are more options when it comes to VPNs on the Raspberry Pi. Here are some of the options already covered by us which you can refer to:

• How to Install & Use WireGuard on GNU/Linux (Your VPN).
• How To Install & Use ProtonVPN On Raspberry Pi (GUI & CLI).
• If you want to set up your Pi as a VPN gateway: How To Set Up a VPN Gateway with Raspberry Pi: Easy Guide.

Whenever you’re ready, here are other ways I can help you:

Test Your Raspberry Pi Level (Free): Not sure why everything takes so long on your Raspberry Pi? Take this free 3-minute assessment and see what’s causing the problems.

The RaspberryTips Community: Need help or want to discuss your Raspberry Pi projects with others who actually get it? Join the RaspberryTips Community and get access to private forums, exclusive lessons, and direct help (try it for just $1).

Master your Raspberry Pi in 30 days: If you are looking for the best tips to become an expert on Raspberry Pi, this book is for you. Learn useful Linux skills and practice multiple projects with step-by-step guides.

Master Python on Raspberry Pi: Create, understand, and improve any Python script for your Raspberry Pi. Learn the essentials step-by-step without losing time understanding useless concepts.

You can also find all my recommendations for tools and hardware on this page.