How I Access My Cybersecurity Homelab From Anywhere
No port forwarding, no exposed Proxmox, no exposed SSH. Just Tailscale, RustDesk, and a lesson I learned in a hotel room in D.C.
I was heading to D.C. for a cybersecurity conference (more on that another time), and I knew, before I even packed a bag, that I’d want access to my homelab while I was gone. Yep, this one:
So before I left, I made sure Tailscale was already installed and running across the homelab: the Proxmox host, my laptops, all of it.
That one decision ended up being the whole point of this issue. Because once I was actually in D.C., sitting on hotel WiFi with zero trust in that network, I got to see firsthand just how powerful that setup really is.
So this issue is about showing that off: how I access my entire cybersecurity homelab from anywhere, without exposing Proxmox, SSH, or remote desktop services directly to the internet, and why setting it up before you need it is the move.
The two tools doing all the heavy lifting: Tailscale and RustDesk.
Watch the full walkthrough here:
Why I Set This Up Before I Ever Needed It
Here’s the thing about homelabs: the second you want to reach them from outside your own network, you’re one bad decision away from turning a learning environment into a real liability.
Port forward SSH to the router and you’ve got a service sitting on the open internet getting hammered by scanners or unrelentless AI agents within hours. Expose the Proxmox web UI the same way, and you’ve basically hung a sign that says “management plane, please attack me.”
I never even considered either of those routes. I wanted something that felt like I was still on my home network, no matter where I actually was, and I wanted it working well before I needed it under pressure.
That’s the whole premise of Tailscale: a mesh VPN built on WireGuard that quietly stitches all your devices into one private network (a “tailnet”), with no ports opened on your router at all.
How Tailscale Connects My Homelab Devices
The setup is almost anticlimactic in how simple it is. Install the Tailscale client on a device, authenticate, and it joins the tailnet. That’s it. No firewall rules, no static IP requirements, nothing crazy.
I’ve got it running across the homelab: the Proxmox host, individual VMs, my laptops, even devices that aren’t normally reachable from outside the house.
Once everything’s on the same tailnet, they can all talk to each other using stable, private IP addresses (or MagicDNS names, if you want something more human-readable). It doesn’t matter if I’m on hotel WiFi in D.C. or on my phone’s hotspot. As far as the network is concerned, I’m home.
Configuring and Using Exit Nodes
This is where it goes from “nice remote access” to genuinely useful: exit nodes.
An exit node lets you route your device’s entire internet traffic through another machine on your tailnet, in my case, a node sitting at home. Flip it on, and suddenly all my traffic looks like it’s coming from my home network, encrypted the whole way there.
Practically, that means I can be anywhere, connect through my home exit node, and get the same network posture I’d have sitting on my couch. For a security engineer who’s paranoid about hotel and conference WiFi (rightfully so), that’s a real upgrade over hoping a commercial VPN is trustworthy.
Remotely Accessing Machines With RustDesk and Tailscale
SSH gets you a terminal. Sometimes you need a screen or GUI.
That’s where RustDesk comes in, an open source remote desktop tool that I’m running entirely over the Tailscale network rather than exposing it to the open internet. Since RustDesk traffic rides on top of Tailscale’s already encrypted mesh, I get full remote desktop access to my homelab machines without opening a single port.
This combo (Tailscale for the private network, RustDesk for the actual screen access) means I can pull up a full desktop session on any lab machine from basically anywhere, and the attack surface stays exactly where I want it: nowhere on the public internet.
Using Tailscale SSH Across My Tailnet
Once devices are on the tailnet, Tailscale can also handle SSH directly, no separate key management, no exposed port 22, no fumbling with .ssh/config across a dozen machines.
Access control lives in Tailscale’s ACLs instead of a patchwork of firewall rules. Want to restrict which devices can SSH into which lab machines? That’s simple a policy.
For a homelab where I’m constantly spinning things up and tearing them down, this alone saves a meaningful amount of friction.
Secure File Sharing With Taildrop
Small feature, genuinely useful: Taildrop.
It lets me send files directly between devices on the tailnet, no cloud upload, no USB drive, no janky SCP command with a path I always mistype. Need to grab a config file off my macbook host onto my Proxmox while I’m out? Taildrop handles it, encrypted, peer-to-peer, done.
It’s not the headline feature, but it’s the kind of quality-of-life addition that makes the whole setup feel less like a workaround and more like an actual system.
Security Considerations for Remote Homelab Access
I’d be doing you a disservice if I didn’t call out the tradeoffs, because there always are some.
Tailscale and RustDesk dramatically shrink my attack surface compared to port forwarding, but they don’t eliminate risk. A few things I’m keeping in mind:
Identity is the new perimeter. Tailscale ties device access to your identity provider. If that account gets compromised, the blast radius is your entire tailnet. Multi-factor authentication on that identity provider isn’t optional.
ACLs need actual attention, not defaults. It’s tempting to let every device talk to every other device once it’s all “private” anyway. Don’t. Scope access the same way you would on any internal network. I’ll make a future issue on that.
RustDesk still needs auditing. Remote desktop access is powerful, which means it’s also exactly the kind of access an attacker wants if something upstream goes wrong. I’m treating it the same way I’d treat any privileged access path in production: logged, reviewed, with MFA and not left on indefinitely.
None of this is a reason to avoid the setup. It’s a reason to run it the way I’d want anyone on my team running similar access in a real environment.
What I’m Taking Away From This
Setting it up before you need it is clutch. The whole reason this trip went smoothly is that Tailscale was already running when I needed it. If I’d waited until I was in a hotel room trying to configure a VPN for the first time, this story would read very differently.
Convenience and exposure aren’t the same tradeoff you think they are. I assumed secure remote access meant sacrificing convenience. Tailscale proved that wrong. The private mesh is often more convenient than the “exposed” version ever was.
Identity-based access beats network-based access almost every time now. Instead of asking “what can reach this port,” I’m asking “who is this device, and should it be allowed to talk to that other device?” That mental shift matters more than any specific tool.
The best security fix is usually the one that removes the exposure entirely, not the one that adds another layer on top of it. Zero open ports beats a hardened open port every time.
What’s Next
Now that I’ve seen how well this held up under real-world conditions, I want to push further into how I segment the tailnet itself: tighter ACLs between the Wazuh manager, the endpoints reporting to it, and everything else in the house.
If something in this house misbehaves while I’m three states away, I want to still catch it. If it breaks, I want to know why, from wherever I happen to be.
The homelab keeps getting more capable. Let’s see where it goes next.
Interested in sponsoring Cyberwox?
Sponsoring Cyberwox helps me continue creating practical cybersecurity education, labs, and industry analysis while connecting your brand with a trusted multi-platform audience of 120,000+ cybersecurity practitioners, engineers, students, founders, and technology leaders across the global cyber community on our YouTube, LinkedIn, X, & Substack 🌎
Until Next Time
That’s it for this one.
As always, keep learning, keep building, and keep thinking deeply about the systems we’re trusted to defend.
See you in the next one.
~ Day 💙