The whole point of running a home server is being able to reach your files, media, dashboards, and other self-hosted services whenever you need them.Unfortunately, the easiest way to use remote access is also the riskiest one: through port forwarding.But does remote access need to equal exposing your most vulnerable files to the internet at large? Port forwarding turns a private service into a public one That obscure port number isn't as secret as you think Close Port forwarding, port forwarding ...
What is it exactly? It's one of the simplest ways to reach a home server from outside your network.You choose a port on your router, point it at the local IP address of your server, and tell the router which internal port should receive the traffic.From then on, anyone who connects to your public IP address on that port is sent straight to the service running inside your home.
That could be a Plex server, your NAS login page, Home Assistant, a remote desktop tool ...you get it.It's easy to see why port forwarding sounds good.
It's built into nearly every router, it costs nothing, and it often works with applications that were never designed around modern private networking tools.You may also need it when sharing a service with people who can't use a VPN client, or when hosting something that's genuinely meant to be public, like a gaming server.But the problem (because of course there is one) is that your router can't discern between you, your friends, an automated scanner, or someone actively looking for vulnerable servers to exploit.
It just says yep, let's go for it, and lets the connection through.That means the application itself becomes responsible for keeping attackers out, and small problems like a weak password become gargantuan as they can let an attacker through.Using an unusual external port can cut down on obvious attempts, but it doesn't make your service entirely invisible; internet-wide scanners test huge ranges of addresses and ports automatically.
Once they find your server, they'll keep coming back.Related Stop port forwarding your NAS: The safer way to access files remotely This is the one NAS security feature most people still ignore Posts 5 By Monica J.White A mesh VPN gives you remote access without publishing the server Your approved devices join the same private network The TL;DR so far is that you don't want to expose your server to an endless list of possible attackers (who may find the door wide open).
This is where tools like Tailscale come in.Tailscale is a mesh VPN, meaning it creates a private network between your server and the devices you approve, even when they're connected to completely different networks.Alternatives like ZeroTier, NetBird, and a regular WireGuard VPN can do similar jobs, but I'm picking Tailscale here because it's particularly easy to set up and handles the annoying networking parts for you.
Install it on your server and, say, your laptop, and both devices join the same private network, known as a tailnet.Tailscale then tries to establish a direct, end-to-end encrypted connection between them without making you port forward or set up a traditional VPN server.Replace the forwarded port without breaking remote access Install Tailscale, test the private route, and close the old one Let's say you're using Tailscale (I did).
Start by installing it on the home server and every device you'll use to reach it remotely.Then, sign in with the same account everywhere.Once they're all part of the same tailnet, Tailscale gives the server a stable private IP address and, with MagicDNS, a readable device name.
You can then open the service using that address followed by its usual port, such as homeserver:8096 for Jellyfin.The app itself doesn't move or change ports.You're just finding it through Tailscale's private route instead of your (uncomfortably public) IP address.
All done? Not so fast -- don't delete the existing port forwarding rule just yet.First, disconnect your laptop or phone from your home Wi-Fi and confirm that you can still reach the server over mobile data or another outside network (very important).Worked fine? Log in to your router and remove the forwarding rule, along with any matching rule created automatically through UPnP.
Finally, test both routes one last time.The service should still work through its Tailscale address, but connecting through your public IP and old forwarded port should lead you nowhere.Don't recreate a flat home network inside Tailscale Limit access to what and who really needs it Yes, Tailscale closes the door to the wider internet, but that doesn't mean you should trust every device inside your tailnet without any questions.
By default, your approved devices may be able to communicate quite freely, which is convenient ...until something goes wrong, that is.Compromised devices still equal a compromised network if you don't limit things at the source.
So, use Tailscale's access controls to decide which users and devices can reach the server, then limit them to the services they genuinely need.Your phone might need Jellyfin, for example, but probably doesn't need SSH access or permission to open your server's admin dashboard.No thanks.
Be extra careful with subnet routing, which lets Tailscale reach devices across your wider home network even when those devices don't run the app themselves.It can be useful, but advertising your entire LAN can recreate the same flat, overly trusting network you were running away from in the first place.Related What’s the deal with Benchy, the unofficial mascot of 3D printing? The little boat that could.
Posts By Tim Brookes Keep private services private Some services really are meant to be public, such as a website or a game server for people outside your household.Fair enough.But treat them as exceptions instead of the rule, and keep the important stuff behind a mesh VPN to keep your network safe first and foremost.
Read More
