Remote Access Without Port Forwarding: Tailscale vs Cloudflare Tunnel vs WireGuard
How to securely access your homelab from anywhere without opening ports
Remote Access Without Port Forwarding: Tailscale vs Cloudflare Tunnel vs WireGuard
Last issue covered NAS storage options. Now the follow-up question everyone asks: how do I access my homelab when I'm not home?
Three solutions dominate — and the right one depends on what you're trying to do.
Why Not Just Open Ports?
The traditional answer is port forwarding: tell your router to send traffic on port 8096 to your Jellyfin server, and you can reach it from anywhere. It works, but it exposes that service directly to the internet. One unpatched vulnerability, and anyone can attack it.
Modern alternatives use encrypted tunnels so nothing is exposed. Your homelab stays invisible to the internet; only authenticated users can connect.
Tailscale: The Easiest Setup
Tailscale creates a private mesh network between your devices. Install it on your homelab server and your phone/laptop, and they can talk to each other — no port forwarding, no firewall rules, no static IP.
Install on your server:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
Then install the Tailscale app on your phone. Both devices appear in your Tailscale dashboard and can talk to each other via their Tailscale IPs (100.x.x.x range).
The free plan covers 3 users and 100 devices — plenty for a personal homelab. Access Jellyfin athttp://100.x.x.x:8096from anywhere in the world, with no ports open.
Best for: personal access to your own homelab. Especially good if you use multiple devices (phone, laptop, tablet) and want them all connected.
Cloudflare Tunnel: For Sharing With Others
If you want to share a service with family or make it accessible via a clean URL, Cloudflare Tunnel is the better option. It creates an outbound connection from your server to Cloudflare — no inbound ports needed — and routes traffic from your-service.domain.com back to your homelab.
Basic setup after installing cloudflared:
cloudflared tunnel create my-homelab
cloudflared tunnel route dns my-homelab jellyfin.yourdomain.com
Then in your tunnel config, mapjellyfin.yourdomain.comtolocalhost:8096. Anyone with the URL (or you restrict it to specific emails) can access the service via a clean HTTPS URL.
Best for: services you want to share with others, or that need a public-facing URL. The free plan includes unlimited bandwidth for personal use.
WireGuard: Full Control, Full Complexity
WireGuard is a VPN protocol you run yourself. It gives you a full VPN — all your homelab devices appear on a single private network accessible from anywhere. More powerful than Tailscale, more complex to set up.
For most homelab beginners, wg-easy simplifies this significantly. It's a Docker container with a web interface for managing WireGuard clients:
services:
wg-easy:
image: ghcr.io/wg-easy/wg-easy
container_name: wg-easy
environment:
- WG_HOST=your.ip.or.domain
ports:
- "51820:51820/udp"
- "51821:51821/tcp"
restart: unless-stopped
cap_add: [NET_ADMIN, SYS_MODULE]
Requires opening one UDP port (51820) on your router — the attack surface is minimal, but it's the one tradeoff vs Tailscale/Cloudflare.
Best for: users who want full LAN-level access (not just specific services) and prefer to own the infrastructure.
Quick Decision Guide
Just you, accessing your own services→ Tailscale (5 minutes, no maintenance)
Sharing with family via a URL→ Cloudflare Tunnel
Full VPN access to everything→ WireGuard + wg-easy
Best setup for most homelabs→ Tailscale for personal + Cloudflare Tunnel for shared services
Next issue: Keeping your homelab healthy — automated monitoring with Uptime Kuma, health checks, and how to know when something breaks before your family notices.
What services are you trying to access remotely? Reply and let me know what's working (or not).