The traditional homelab remote access story is painful: dynamic DNS, port forwarding, firewall rules, a dedicated VPN appliance, or all of the above. Tailscale replaces all of it with a zero-config mesh VPN, and its subnet router feature means you only need to install it on one machine to make your entire lab reachable from anywhere.
How subnet routing works
The key insight: you don’t install Tailscale on every container and host. One node (pvelab04 in my setup) advertises the lab subnet, and any Tailscale client that accepts that route gets full access to everything on 10.25.144.0/24.
Task 1: Set up the subnet router on pvelab04
curl -fsSL https://tailscale.com/install.sh | sh
Subnet routing requires the Linux kernel to forward packets between interfaces:
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' >> /etc/sysctl.d/99-tailscale.conf
sysctl -p /etc/sysctl.d/99-tailscale.conf
tailscale up --advertise-routes=10.25.144.0/24
This opens a URL — visit it in a browser to authenticate to your Tailscale account.
Open login.tailscale.com/admin/machines. Find pvelab04, click the three-dot menu → Edit route settings, and enable the 10.25.144.0/24 subnet.
Tailscale on Linux has a known performance regression with UDP Generic Receive Offload enabled on the tailscale0 interface. Fix it with a persistent systemd service:
cat > /etc/systemd/system/tailscale-gro-fix.service {'<<'} 'EOF'
[Unit]
Description=Disable UDP GRO on Tailscale interface
After=tailscale.service
[Service]
Type=oneshot
ExecStart=/usr/sbin/ethtool -K tailscale0 rx-udp-gro-forwarding on rx-gro-list off
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
EOF
systemctl enable --now tailscale-gro-fix.service
Task 2: Connect your laptop or phone
- Linux (openSUSE Tumbleweed):
sudo zypper install tailscale - macOS: Download from the Mac App Store
- iOS/Android: Download Tailscale from the App Store / Play Store
- Windows: Download the MSI from tailscale.com
sudo systemctl enable --now tailscaled
sudo tailscale up --accept-routes
On macOS/iOS/Android, the “Accept subnet routes” toggle is in the Tailscale app settings after connecting.
# Ping the cluster manager
ping 10.25.144.73
# Open Proxmox web UI (works even on the road)
# → https://10.25.144.73:8006
# SSH to any node
ssh root@10.25.144.70
# Access Grafana
curl http://10.25.144.68:3000
Every container IP in the 10.25.144.0/24 subnet is now reachable directly — no port forwarding, no tunnels, no extra configuration per container.
Key configuration reference
| Setting | Where | Value |
|---|---|---|
| Key expiry — pvelab04 | Tailscale admin → pvelab04 | Disabled |
| Key expiry — laptop | Tailscale admin → elitebook | Disabled |
| Subnet route approval | Tailscale admin → pvelab04 | 10.25.144.0/24 approved |
| IP forwarding | /etc/sysctl.d/99-tailscale.conf | ipv4 + ipv6 forwarding = 1 |
| GRO fix | /etc/systemd/system/tailscale-gro-fix.service | ethtool override on boot |
Tailscale’s default key expiry is 180 days — after which pvelab04 will disconnect and your entire lab goes dark remotely. Disable expiry on the subnet router node in the admin console. You can leave it enabled on mobile devices.
What this unlocks
With the subnet router running, your entire homelab becomes accessible from anywhere Tailscale reaches — your phone on cellular, a coffee shop, a remote office. No VPN software to manage, no firewall rules to punch, no split DNS to configure.
The full list of services now reachable remotely without changing anything:
- Proxmox web UI:
https://10.25.144.73:8006 - Grafana dashboards:
http://10.25.144.68:3000 - Open WebUI (Ollama):
http://10.25.144.69:8080 - Hermes Agent:
http://10.25.144.250 - Wiki.js:
http://10.25.144.76:3000
Next up: deploying Hermes Agent — a self-hosted AI agent that runs tool calls, browses the web, and delegates tasks back to the cluster.