Remote access without port forwarding

You want the shop PC or Pi from the couch (SSH, a local UI, a file share) without punching a hole in the router and hoping CGNAT didn’t already say no.

I’ve cleaned up “temporary” port-forwards that were still open two years later. Tailscale on a box you can install it on beats that parade.

Why WAN forwards rot

CGNAT / Starlink / some cellular: you may not get a forward that works at all.
Rules get forgotten: next router swap, next “quick test,” next forgotten admin UI on the public internet.
UPnP “just for a minute” rarely stays a minute.

Reach path here means: from your phone or laptop, open a service that lives on the always-on box, over Tailscale, with no new WAN port to box rule.

Cloud cam ≠ the box

Ring, Nest, and other vendor cloud cameras are not the box. You can’t install Tailscale on the camera. Wrong target.

The box is something you admin: shop PC, Pi, NVR/PC. That’s where Tailscale goes. Cameras on the LAN may come later (subnet router territory), only after the always-on node itself is solid.

Checklist: reach one on-box thing

Right box. Confirm you can install software. Name it something you’ll recognize in Tailscale admin (placeholder: always-on-box; use your real hostname).
Tailscale on that box + your phone/laptop. Same account. Sign in once on the box. Set unattended so reboot doesn’t strand you (Tailscale after reboot).
Pick one on-box service. Local web UI, SSH to the box, a share you already use on the LAN. Write how you open it on site today.
Open it over Tailscale. From a second device: Tailscale name or Tailscale IP. Still no WAN forward. If LAN works but Tailscale doesn’t, fix bind/firewall on the box.
Prove from elsewhere. Phone on cell data (Wi‑Fi off). Same reach path. Same-building-only prove is a start; cell prove is what you trust on a trip.
Write break-glass pointers. Who can touch the box, where secrets live, not the secrets themselves. When travel goes sideways: away from home / break-glass.

What this does not fix

Dead hardware vs flaky Wi‑Fi vs auth: triage first (when the box goes dark)
Email when the box dies: that’s a heartbeat, separate step (email when the box dies)
Cloud-only camera apps with nothing on your LAN to install on

Placeholders you’ll fill in

always-on-box, owner-phone, your service name and port. Your Tailscale account. No shared secrets from me.

Access Pack ($99)

Same reach path in the Access Pack: Tailscale on a box you control, no WAN port-forward, Healthchecks email when it’s gone, prove-it unplug, break-glass notes.

Access Pack ($99)

ZIP. Your accounts. Not a managed service. Not 24/7. Tailscale stays yours.

Stephen · shoutfire.com