Remote access without port forwarding

You want the shop PC or Pi from the couch — SSH, a local UI, a file share — without punching a hole in the router and hoping CGNAT doesn't already say no.

I've cleaned up "temporary" port-forwards that were still open two years later. Tailscale on a box you can install it on beats that whole parade.

Why WAN forwards rot

CGNAT, Starlink, or some cellular plans: you may not get a working forward at all.
Rules get forgotten: the next router swap, the next "quick test," the next admin UI left open to the public internet.
UPnP "just for a minute" rarely stays a minute.

The reach path here is: from your phone or laptop, open a service that lives on the always-on box, over Tailscale, with no new WAN-port rule.

Cloud cams aren't the box

Ring, Nest, and other vendor cloud cameras aren't the box — you can't install Tailscale on them, so they're the wrong target.

The box is something you admin: shop PC, Pi, NVR/PC. That's where Tailscale goes. Cameras on the LAN can come later, once the always-on node itself is solid.

Checklist: reach one thing on the box

Get the right box. Confirm you can install software on it, and give it a name you'll recognize in the Tailscale admin (use your real hostname).
Put Tailscale on the box and your phone/laptop. Same account. Sign in once on the box, and set it to start unattended so a reboot doesn't strand you (Tailscale after reboot).
Pick one on-box service. A local web UI, SSH to the box, a share you already use on the LAN. Write down how you open it on site today.
Open it over Tailscale. From a second device, use the Tailscale name or IP — still no WAN forward. If it works over LAN but not Tailscale, fix the bind or firewall on the box.
Prove it from elsewhere. Put your phone on cell data with Wi‑Fi off, and try the same path. Testing from inside the same building is a start; testing over cell is what you'll actually trust on a trip.
Write your break-glass pointers. Who can touch the box, where the secrets live — not the secrets themselves. For when travel goes sideways: away from home / break-glass.

What this does not fix

Sorting dead hardware from bad Wi‑Fi from broken auth — triage that first (when the box goes dark)
Knowing the box died at all — that's a separate heartbeat step (email when the box dies)
Cloud-only camera apps with nothing on your LAN to install on

What you'll write down

Your box's name, your own phone, and your service's name and port. Your Tailscale account. No shared secrets from me.

Access Pack ($99)

A printable checklist ZIP for always-on Tailscale and a dead-man email shout, on a box you admin. Your accounts.

Access Pack ($99)

ZIP. Your accounts. Not a managed service. Not 24/7. Tailscale stays yours.

Stephen · shoutfire.com