Written 5 Sep 2026. This is a how-to, not a product card.

SSH from away

Reach the old PC from a coffee shop or cellular without opening port 22. Put Tailscale on the computer and on your laptop. Free personal plan is enough.

Haven't got SSH working on the house network yet? Start with SSH from the couch. Phone on house Wi-Fi only? That quieter walk is SSH from a phone. This note is different: you leave the house on purpose, and you still refuse to forward SSH on the router.

Skip until house SSH works

If a laptop on house Wi-Fi cannot log in yet, fix that first. Tailscale will not repair a broken OpenSSH install, a wrong password, or a computer that is asleep. Prove ssh you@192.168.x.x once from the couch. Keep the computer awake overnight if that is still shaky: is it still on?. Don't open port 22 on the router "just to test."

What this is

Tailscale builds a small private network between devices you own. Each device gets a stable Tailscale address. Your laptop at the coffee shop reaches the old PC at home over that private path. SSH stays on port 22 on the computer. The public internet never gets a forwarded port. Free personal accounts cover a handful of devices. You don't need WireGuard configs by hand, a cloud VPS, or a new firewall appliance tonight.

Step 1: make a Tailscale account

On a laptop browser, open https://login.tailscale.com/start. Sign up with Google, Microsoft, GitHub, or an email passkey flow — pick one login you already trust. Personal / free is enough for one house computer, one laptop, and a phone. Skip Teams / business plans for this job.

Step 2: install Tailscale on the computer

SSH into the old PC from the house network first. On Ubuntu Server or Debian, follow Tailscale's apt steps for your release on https://pkgs.tailscale.com/stable/ (pick Ubuntu or Debian, then your version). The pattern is: add their signing key, add their apt source, then:

sudo apt-get update

sudo apt-get install tailscale

Want the one-page installer instead? Tailscale documents Install Tailscale on Linux — same package at the end. Bring the computer onto your tailnet:

sudo tailscale up

It prints a login URL. Open that URL on a phone or laptop browser that is already signed into the same Tailscale account. Approve the computer. Back on SSH:

tailscale status

tailscale ip -4

Write down the 100.x.y.z address. That is the number you will SSH to from away. Leave MagicDNS off until this address works once.

Step 3: install Tailscale on your laptop

Install the client for your laptop OS from https://tailscale.com/download. Sign in with the same account. Wait until the laptop shows Connected, and until the old PC appears in the client or at Machines.

Optional phone: install Tailscale from the App Store or Google Play, sign in, turn the VPN toggle on. Same account. You can keep Termius for the SSH session: SSH from a phone still applies, but the address becomes the Tailscale number instead of the house 192.168….

Step 4: SSH over Tailscale from the house first

Still on house Wi-Fi, from the laptop:

ssh you@100.x.y.z

Use the same Linux username and password (or key) that already worked on the house address. First connect may ask you to trust a host key again — that is normal when the address string is new. Run hostname, then exit.

If this fails while house 192.168… SSH still works, check tailscale status on both ends. Both must show online on the same account. ufw on the computer usually does not need a new hole for Tailscale's own interface once the package is installed; if you locked SSH to one house subnet earlier, allow Tailscale's interface or the Tailscale IP the same way you already allow OpenSSH: turn on a simple firewall without locking yourself out.

Step 5: prove it from away

Leave house Wi-Fi. Join coffee-shop Wi-Fi, or turn Wi-Fi off and use cellular on the phone hotspot. Confirm the laptop Tailscale client is Connected. Then:

ssh you@100.x.y.z

Same prompt, same home computer. That is the whole job. When you are back on the couch, house SSH with the old number still works. Keep both.

If it fails only away from home

Coffee-shop captive portals sometimes block this traffic until you accept the terms in a browser. Sign into the portal first, then retry Tailscale. Some networks are rude to UDP; Tailscale can fall back, but it may take a minute. On the phone, the Tailscale VPN toggle must be on before Termius connects. If house SSH also fails, the computer slept or lost power — that is is it still on? and when SSH won't connect, not a Tailscale bug.

What this is not

This is not forwarding port 22 on the router. It is not a reason to put Pi-hole admin or Samba on the public internet. It is not an exit node, a subnet router, or "expose the whole house LAN" on day one. It is not WireGuard you hand-configure tonight. Stay on the free personal plan until you actually need more devices.

What next

Prefer keys over typing the password every time: log in with a key, not the password every time. Keep SSH off the public internet on purpose: keep it on the house network. Phone on house Wi-Fi without Tailscale is still SSH from a phone. House SSH still broken? When SSH won't connect.

Optional: jot which devices you put on the tailnet in Lab plan — username + passkey, no email. Skip if you just want to keep reading.

Skip

• Skip this until house SSH already works once.
• Skip forwarding port 22 on the router.
• Skip exit nodes and subnet routers on day one.
• Skip putting Samba or Pi-hole admin on a public port.
• Skip a paid Tailscale plan for one PC and one laptop.
• Skip this if you never leave the house and couch SSH is enough.