Your NAS, Everywhere: Secure Remote Access with Tailscale

Part 3 of building a self-hosted Google Photos for $100 — making the NAS accessible from anywhere in the world without opening a single port

At the end of Part 2, the NAS was working — but only at home.

Open the Owlfiles app on your iPhone while out on mobile data and the share isn’t there. Walk out of your apartment and your ¥17,987 server becomes a very expensive paperweight until you get back to your Wi-Fi.

The traditional solution to this is port forwarding — opening a hole in your router’s firewall and exposing the NAS directly to the internet. This works, but it’s also how NAS devices get compromised. Shodan, a search engine for internet-connected devices, indexes thousands of exposed Synology and QNAP boxes. Several major ransomware campaigns have specifically targeted home NAS devices exposed this way.

There’s a better way. It’s called Tailscale, and it’s what I should have started with.

What Tailscale Actually Is

Tailscale creates a private mesh network (called a “tailnet”) between your devices. Every device you add gets a 100.x.x.x IP address that's only reachable by other devices on the same tailnet — not by anyone else on the internet.

The key insight: nothing is exposed to the public internet. Your NAS doesn’t open any ports. Your router doesn’t need to be configured. Tailscale works by having each device make an outbound connection to Tailscale’s coordination servers, which broker a direct peer-to-peer connection between your devices using WireGuard encryption.

From the outside, your NAS is invisible. From your tailnet, it’s always reachable — at home, on mobile data, at a café in another country.

The free tier supports up to 3 users and 100 devices. For a personal home setup, it’s more than enough.

Installing Tailscale on the NAS

SSH into the NAS:

ssh root@(your-nas-ip)

Install curl if not already present:

apt-get install curl -y

Install Tailscale:

curl -fsSL https://tailscale.com/install.sh | sh

Start Tailscale and authenticate:

tailscale up

This prints a URL — open it in any browser, log in with your Tailscale account (or create one — it’s free), and the NAS joins your tailnet.

Confirm it’s working:

tailscale ip

The NAS’s Tailscale IP (100.x.x.x) — this address is now reachable from any device on your tailnet, anywhere in the world.

Auto-Start on Boot

The Tailscale installer registers tailscaled as a systemd service automatically. Verify it's set to start on boot:

systemctl status tailscaled

Look for two things: enabled (auto-starts on boot) and active (running). If it shows disabled, run:

systemctl enable tailscaled

This matters for a NAS: if the machine reboots after a power outage, Tailscale needs to come back up automatically without you manually reconnecting.

Installing Tailscale on Your Devices

Download Tailscale on every device you want to connect:

• Mac: Mac App Store → search Tailscale
• iPhone/iPad: App Store → search Tailscale
• Android: Play Store → search Tailscale

Log in with the same account on each. Within seconds, the NAS appears in each device’s Tailscale device list.

The NAS appearing in Tailscale on iPhone. Green dot means connected — this works on mobile data, home Wi-Fi, any network.

Testing Remote Access

With Tailscale installed and connected on your iPhone, try accessing the NAS while on mobile data (turn off Wi-Fi to force mobile data):

SMB share via Owlfiles File Explorer:

smb://100.x.x.x/nas-shared

OMV web UI in Safari:

http://100.x.x.x:8090

Accessing the NAS from mobile data via Tailscale. The Wi-Fi is off — this connection is going through the Tailscale tunnel over mobile.

Both should work. If they do, your NAS is now globally accessible — privately, securely, without any port forwarding or firewall changes.

Sharing Access with a Partner

Tailscale’s sharing model is worth understanding before you hand over access to someone else.

Full tailnet membership (invite via admin console → Users) gives the other person access to all devices on your tailnet — your Mac, your phone, everything. More than you want for “just access to the NAS.”

Get Harry’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Device sharing (share just the NAS) is the right approach:

Share just the NAS — not your whole tailnet. The reusable link option means your partner can add multiple devices (iPhone, iPad, Mac) without you generating a new link each time.

1. Go to login.tailscale.com/admin/machines
2. Find your NAS → click ... → Share
3. Choose Copy share link
4. Toggle Reusable on — this lets your partner accept on multiple devices (iPhone, iPad, Mac) using the same link
5. Send the link

When they click it and install Tailscale, the NAS appears in their device list. They can reach it via 100.x.x.x — but they cannot see your other personal devices.

MagicDNS: From IP Addresses to Friendly Names

Remembering 100.x.x.x is annoying. Tailscale's MagicDNS feature solves this by assigning human-readable hostnames to every device on your tailnet.

Enable it at login.tailscale.com/admin/dns:

MagicDNS enabled. The NAS is now reachable as ‘nas’ or ‘nas.tailXXXX.ts.net’ instead of a numeric IP.

Toggle MagicDNS on. The hostname comes from whatever you set during OMV installation — if you followed Part 2 and used nas as the hostname, your NAS becomes reachable as simply:

nas
nas.tail[xxxxx].ts.net

So instead of:

smb://100.x.x.x/nas-shared

You can use:

smb://nas/nas-shared

And the OMV web UI becomes:

http://nas:8090

Confirm the hostname on the NAS:

hostname

ping nas resolving correctly via MagicDNS — no IP address to remember.

A Note on Building Internet in Japanese Apartments

One Japan-specific issue worth mentioning: many Japanese rental apartments (マンション) come with building-managed internet — a direct LAN port in the wall that provides internet access without needing your own router.

This sounds convenient but creates a problem: building-managed networks typically have client isolation enabled, meaning devices on the same network cannot see each other. Your Mac and NAS both get internet, but they can’t communicate directly.

The solution is a personal router between the wall port and your devices. Our Buffalo router creates a private subnet (192.x.x.x) where all your own devices can freely communicate — and then Tailscale handles reaching the NAS from outside this private network.

If you’re on building-managed internet and your devices can’t see each other even on the same Wi-Fi, this is why. A personal router (~¥5,000 or ~$30 at Yodobashi) solves it.

Setting Pi-hole as Tailscale DNS (Ad Blocking Everywhere)

This is optional for Part 3 but we’ll cover Pi-hole in detail in Part 5. But if you already have Pi-hole running, here’s the one-step connection to Tailscale:

In the Tailscale admin DNS page, add a Custom Nameserver:

• IP: your NAS’s Tailscale IP (100.x.x.x)
• Toggle “Override local DNS” on

Now every device on your tailnet uses Pi-hole for DNS — meaning ad blocking follows you everywhere, on any network, even on mobile data. On your own home Wi-Fi the router handles it directly. Away from home, Tailscale routes DNS queries through the tunnel to Pi-hole on your NAS.

What’s Working Now

Immich accessible from iPhone via Tailscale — this connection works from anywhere in the world.

Let’s take stock of where we are after three parts:

• ✅ HP ProDesk 400 G5 Mini running as a home server (Part 1)
• ✅ OpenMediaVault installed, Samba shares accessible from Mac and iPhone (Part 2)
• ✅ Tailscale installed — NAS reachable globally via private tunnel (Part 3)
• ✅ MagicDNS configured — friendly hostnames instead of IP addresses
• ✅ Partner has shared access to NAS only, not to other personal devices

The NAS is now a proper remote-accessible server. But it’s still just storing files in a folder. In Part 4, we turn it into something that actually looks and feels like Google Photos — with Immich.

Quick Reference: Tailscale Troubleshooting

“Tailscale connected but can’t reach NAS” → Check systemctl status tailscaled on the NAS — is it actually running? If not: systemctl start tailscaled

“Works at home but not on mobile data” → Toggle Tailscale off and back on on your phone. If still failing, check the NAS is powered on and Tailscale is running on it.

“Partner can see my other devices too” → You invited them as a full tailnet member instead of sharing just the device. Revoke the membership in admin console and use device sharing instead.

“MagicDNS hostname not resolving” → Run hostname on the NAS and confirm it matches what you expect. Also confirm MagicDNS is toggled on in the admin console, not just saved.

“Building internet — devices can’t see each other” → You need a personal router. Connect wall LAN port → router WAN port → your devices via router Wi-Fi/LAN.

This is Part 3 of a series on building a self-hosted home server in Japan.

Part 1: I Built a Personal Google Photos for $100 — Here’s How

Part 2: From Windows Office PC to NAS: Installing OpenMediaVault (And Surviving the Chaos)

Tags: Tailscale, NAS, VPN, Self-Hosted, Home Server, Remote Access, WireGuard, Japan, Privacy, Network Security