DEV Community

Cover image for Access Your Homelab Remotely without Port Forwarding (Bypass CGNAT with Tailscale)
Alessandro Mainardi
Alessandro Mainardi

Posted on Originally published at alexmaina.dev

Access Your Homelab Remotely without Port Forwarding (Bypass CGNAT with Tailscale)

#tailscale #homelab #networking #security

๐Ÿ“– Original Reference: Originally published with zero-trust network topologies at alexmaina.dev/tailscale-pihole-homelab-cgnat.

With modern fiber (FTTH), cellular 5G, or Starlink connections, most ISPs place customer routers behind CGNAT (Carrier-Grade NAT). Under CGNAT, you do not have a public IPv4 address, rendering classic port forwarding completely useless.

Even if you have a public IP, opening ports (like port 22 or WireGuard port 51820) exposes your home router to 24/7 automated port scanners and brute-force attacks.

Here is how to set up a Tailscale Subnet Router with Pi-hole MagicDNS to gain zero-trust, encrypted remote access to every device on your home network without opening a single port.

1. Why a Subnet Router?

Instead of installing the Tailscale client on every single device (which is impossible for IoT gear, network printers, IP cameras, or legacy hardware), a Subnet Router acts as a secure gateway:

  • One always-on Linux host (Raspberry Pi, mini PC, or VM) acts as the bridge.
  • When you enable Tailscale on your laptop or phone while travelling, you can access 192.168.1.x IPs exactly as if you were on your home Wi-Fi.

2. Configure the Linux Gateway

SSH into your Linux machine and execute:

# 1. Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh

# 2. Enable IP packet forwarding in Linux kernel
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

# 3. Advertise your local subnet (adjust 192.168.1.0/24 to your LAN subnet)
sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-dns=false
Enter fullscreen mode Exit fullscreen mode

3. Approve Subnet Routes in Tailscale Console

  1. Open the Tailscale Admin Machines Console.
  2. Locate your gateway device and look for the Subnets badge.
  3. Click the three dots (...) โ†’ Edit route settings...
  4. Check the box for your subnet (e.g. 192.168.1.0/24) and click Save.

4. Integrate Pi-hole for Global Ad-Blocking & Local DNS

If you have Pi-hole or AdGuard Home running in your homelab:

  1. In the Tailscale Admin Console, go to DNS.
  2. Under Nameservers, click Add nameserver โ†’ Custom...
  3. Enter your Pi-hole's local IP (e.g. 192.168.1.50) or Tailscale IP (100.x.y.z).
  4. Toggle Override local DNS ON.

The Result:

  • Seamless encrypted access to Proxmox, NAS storage, and local servers from anywhere.
  • Network-wide ad-blocking and tracker filtering active on your phone and laptop wherever you travel.
  • Zero ports forwarded on your home router.

Author: Alessandro Mainardi โ€” Software Developer & Computer Engineering Student @ UniBo. Explore homelab setups at alexmaina.dev.

Top comments (1)

Collapse
 
yehechuhai profile image
้‡Ž้นค •

Using one subnet router so you don't have to install the Tailscale client on every device โ€” especially IoT gear โ€” is the real win here. I also like the Pi-hole MagicDNS combo: network-wide ad-blocking that follows you while traveling is something most VPN setups don't give you. And the reminder to actually approve the subnet routes in the admin console is worth highlighting, since that's the step most tutorials gloss over.