I Built a Free Private Network to Access My Home PCs From Anywhere, Because Vacation Isn't Escape

After a three-week, three-country vacation that was supposedly relaxing but actually involved work, I needed a way to reach the two PCs in my home lab. These machines run 24/7, hosting virtual machines with Windows 11 Insider builds and other business tasks. At my desk, I can use Remote Desktop clients like Microsoft's Windows App to connect directly. But away from home, my network is locked behind a router, and outside connections are a no-go.

For occasional access, I could use Chrome Remote Desktop or TeamViewer, but I wanted a secure way to use tools I already trust. Enter Tailscale, a free service that creates a secure private network between all my devices - PCs, Macs, and mobiles - allowing them to connect over the internet as if on the same local network, without touching router settings or firewalls.

The result? While out of the office, I clicked a shortcut in my Windows App and connected to a virtual machine back home. It worked effortlessly, even on a slow airplane connection or tethered to my phone on roaming.

Many remote-access and VPN services use a hub-and-spoke model, where encrypted packets flow through a central server, which is (a) expensive and (b) slower, adding latency. Tailscale, however, works as a peer-to-peer mesh. My office machines and my travel laptop run the lightweight Tailscale client, all authenticated via a secure identity service. I've tested it with GitHub and Microsoft Entra ID, but Google, Apple, or passkeys via 1Password, Bitwarden, or YubiKey also work.

Each device gets a private IP address and communicates over secure, encrypted tunnels using the respected WireGuard protocol. Tailscale acts like a secure directory service, introducing devices and then stepping aside. When I open a Remote Desktop connection, my laptop asks Tailscale where the device is, and Tailscale replies with the info needed to connect securely. The devices establish a direct, encrypted WireGuard connection whenever possible; if not, Tailscale relays encrypted traffic without being able to decrypt it.

The architecture is solid: end-to-end encryption, keys never leave the device, and authentication via trusted sources. Tailscale never sees your credentials or content. On my local network, Remote Desktop traffic uses TCP port 3389, but that port is blocked at the router for outside connections - an open door for attackers. Yet through the secure tunnel, connections work fine without worrying about port numbers, NAT traversal, or firewalls. Only machines I've added to the private network can connect.

The free Tailscale plan does everything I need, supporting up to six users across unlimited devices, with few limitations. The company promises it's 'free forever.' For a home lab or tiny office, that's plenty. If you grow beyond six users, paid plans start at $8 per user per month, and you can set up more than three Access Control List (ACL) groups. If you work with ephemeral resources like containers or Kubernetes, you'll hit the 1,000-minute monthly limit and need to pay up.

But most home users, hobbyists, consultants, and very small businesses can use the free plan indefinitely.

One travel discovery: many services don't work overseas due to regional restrictions. News sites and streaming services often block US-based customers abroad. The usual workaround is a VPN that routes traffic through servers to appear from the right region. With Tailscale, you can designate a device as an exit node, routing all your internet traffic through it. Normally, Tailscale only carries traffic to other devices in your tailnet; with an exit node, all web browsing and app traffic goes through that device.

I could use a home laptop as an exit node, but there's a cooler option: an Apple TV. Install the Tailscale app on it and set it as an exit node. All internet traffic then goes through your home connection, and websites see your home IP instead of the hotel, airport, or coffee shop Wi-Fi or roaming mobile IP. Apple TVs are always on, even in standby, so it acts as a personal VPN server on a device you own.

I'm heading back to Europe for nearly a month next year. Can't wait to test this feature.