Your Family Intranet: Tailscale VPN for a Mac Home Server // famstack.dev

What you’ll build: A family intranet: a private network that only your family’s devices can join. The photos, documents and family chat on your Mac become reachable from every family phone, wherever it is, and stay closed to everyone else. Many companies run one for their staff; this one is for your family. Tailscale is the VPN that builds it.

End state: The chat app, the photo app and the web pages of your home server work on mobile data the same way they work on the home wifi. Your router stays closed to the internet.

Prerequisites: A Mac that runs your services at home. If you haven’t set one up yet, start with Prepare your Mac as a home server. famstack is what I run on mine, but nothing here depends on it.

Since we set this up, our private conversations and family planning have moved off WhatsApp to our own Matrix server completely. Element is where we keep notes, bookmarks, files we send between our own devices, and a room per topic, from interior design to school.

#The goal: home from everywhere, closed to the internet

At home, every phone is on the same wifi as the Mac, so the apps simply find it. Leave the house and that stops: the phone is now on the internet, and the Mac sits behind your router, which keeps everything outside out. That’s good. It’s also why the photo app can’t reach home from the playground.

The goal of this guide: the family’s phones reach the Mac from anywhere, safely, while the Mac stays invisible to everyone else on the internet.

#Five words you’ll meet

Router. The box from your internet provider. Every device at home goes through it to reach the internet, and it blocks whatever comes in from outside unless you tell it otherwise. Think of it as the front door of your home network.

Address. Every device on your home network has a number, like 192.168.1.42. It works like a house number, but only inside your home: a phone outside can’t use it, because the internet doesn’t know your home’s house numbers.

Port. One device can run many services, and each one listens on its own port, like flats in the same building. On famstack, the chat server is at port 42031 of the Mac.

VPN. A private, encrypted connection that makes a device behave as if it were at home, wherever it really is. People also call it a tunnel.

Route. A note that tells a device which way to send traffic for a given address. In this guide, one route tells the phones: “the Mac’s home address is reached through the tunnel”.

#Why not just open a port on the router?

The quick fix you’ll find in forums is port forwarding: you tell the router to pass requests from the internet through to the Mac. That works, and it means the whole internet can now knock on that door, not only your family.

And the internet does knock. Automated scanners try every address, all day. A home server is built for a trusted home network: famstack, for example, starts with plain HTTP and simple first passwords. One forgotten update or one weak password is then enough for a stranger to get to your family’s photos and documents.

#How the family VPN works

A VPN gives each family device a private tunnel into your home network. Think of it as a house key that only the family’s phones carry: from the outside nothing is visible, but a phone with the key is simply “at home”, wherever it is.

Tailscale is the VPN this guide uses. Every family device runs the Tailscale app and logs in to the same private network, which Tailscale calls a tailnet. Tailscale’s servers only check who belongs to the family. Your photos and messages travel between your devices, encrypted with WireGuard: directly when possible, through a Tailscale relay otherwise. Tailscale can’t read them either way.

Because the phone and the Mac each start the connection from the inside, the router never has to let anything in. That is the difference to port forwarding.

  Phone, away from home                     Your home
 ┌─────────────────────┐                  ┌──────────────────────────┐
 │ chat and photo apps │  encrypted       │ Mac with Tailscale       │
 │ go to 192.168.1.42  ├──────────────────► shares 192.168.1.42      │
 │ just like at home   │  tunnel          │ through the tunnel       │
 └─────────────────────┘                  └──────────────────────────┘

One detail makes this pleasant for a family. The Mac tells the tailnet its home address (192.168.1.42 in this example), and the phones then reach that same address through the tunnel. Tailscale calls this a subnet route. So the apps keep the server address they were set up with at home, and the family doesn’t switch anything when leaving the house.

#Tailscale’s free plan

The free Personal plan allows up to six users and unlimited devices, which covers most families. Each family member logs in with their own account.

The self-hosted option. Tailscale’s servers that check who belongs to the family are a hosted service. If you’d rather run that part yourself too, headscale is an open-source replacement, and the Tailscale apps can log in to it. That’s what I run, on a small rented server. It’s one more server to keep updated, so start with the hosted service.

#Who does what

Steps 1 to 4 are for whoever looks after the Mac. They happen in the Terminal, the Mac app where you type commands (find it with Spotlight). Copy each command, paste it, press Enter.

The rest of the family only does Step 5: install an app, log in, flip one switch.

#Step 1: Give the Mac a fixed address

Your router hands out the addresses on your home network, and it can give the Mac a different one next week. The tunnel would then point at the wrong house number. So first, tell the router to always give the Mac the same address. Routers call this a DHCP reservation or “always assign the same IP address”.

Find the Mac’s current address:

ipconfig getifaddr en0

It prints something like 192.168.1.42. If it prints nothing, try en1 instead: Macs name their network connections en0 and en1, and which one is the cable and which is the wifi depends on the model.

Then open your router’s settings page, find the Mac in the list of devices, and reserve that address for it. Where exactly that setting lives depends on the router. Prepare your Mac as a home server covers this step in more detail.

#Step 2: Install Tailscale on the Mac

Tailscale offers three versions for the Mac. On a home server you want the one from Homebrew, a tool that installs programs from the Terminal. It is the only version that runs before anyone logs in, so the tunnel comes back by itself after a power cut. It has no icon in the menu bar; you control it with the tailscale command instead.

If you don’t have Homebrew yet, install it with the command on brew.sh. Then:

brew install --formula tailscale
sudo brew services start tailscale

The first line downloads Tailscale. --formula picks the command-line version, because Homebrew also has the menu bar app under the same name. The second starts it as a service: a program that runs in the background and starts again whenever the Mac boots. sudo runs the command with administrator rights, so the Mac asks for your password. Nothing shows while you type it. That’s normal.

Homebrew warns that it takes “root ownership” of the Tailscale files. That’s expected for a service started with sudo. One thing to remember for later: before you update Tailscale with brew upgrade tailscale, stop it with sudo brew services stop tailscale.

Don’t install the App Store version on the same Mac as well. Two Tailscale programs fight over the network settings.

This command connects the Mac to your tailnet and tells it to share the Mac’s home address with the family’s devices. Replace 192.168.1.42 with the Mac’s address from Step 1:

sudo tailscale up --advertise-routes=192.168.1.42/32 --accept-dns=false

It prints a web link. Open it, create a Tailscale account or sign in, and the Mac joins your tailnet. The account you use here becomes the family’s admin account.

What the parts of the command do:

tailscale up: connects the Mac to the tailnet.
--advertise-routes=192.168.1.42/32: offers the Mac’s home address to the family’s devices, as the route through the tunnel. The /32 means “only this one address”, not your whole home network. Your printer and TV stay out of it.
--accept-dns=false: DNS is the internet’s phone book, it turns names like apple.com into addresses. This option keeps the Mac on your router’s phone book instead of Tailscale’s, so the Mac’s own lookups never depend on the tunnel.

Check that the Mac is connected:

tailscale status

You should see the Mac in the list, with an address that starts with 100.. That is its address inside the tailnet.

#Step 4: Approve the route

Tailscale doesn’t use a shared address until you confirm it, so that no device can claim routes on its own. Open the admin console, Tailscale’s website for managing your tailnet, and go to Machines. The Mac shows a Subnets badge. Open the Mac, find its subnet section, choose Edit, tick 192.168.1.42/32 and save. (Tailscale’s subnet router docs have screenshots.)

#Step 5: The family’s phones

On each phone:

Install Tailscale from the App Store or Play Store.
Log in with the family member’s account.
Allow the VPN when the phone asks. A small VPN symbol then shows in the status bar while the tunnel is on.
Check that the shared address is on. On iPhone it’s Use Tailscale subnets in the app’s settings (the label is from the 1.102 app and has moved before). Android picks up the route by itself; if it doesn’t, look for the subnet setting in the app’s settings.

Nothing changes in the chat app or the photo app. They keep the server addresses from home, for example http://192.168.1.42:42031 for famstack’s chat server.

Element X warns that the connection isn’t HTTPS, the padlock kind of web connection. Confirm and continue. famstack uses plain HTTP because it trusts your home network. Away from home, the tunnel encrypts everything between phone and Mac anyway.

Laptops need the same setting: in the Mac and Windows apps, check that subnets are allowed; on Linux add --accept-routes to tailscale up.

#Step 6: Test on mobile data

Test away from the home wifi. At home everything works even without the tunnel, so a test there proves nothing.

Turn off wifi on the phone.
Open the Tailscale app and check that it says connected.
Send a message in Element X, open the Immich app.

If it doesn’t connect, check in this order:

The route is approved in the admin console (Step 4).
The shared address is turned on in the phone’s Tailscale app (Step 5).
The Mac is awake, and tailscale status on the Mac shows it online.
The Mac still has the same address. If the router handed out a new one, the route points at nothing. The reservation from Step 1 prevents that.

#Later: the grandparents

We haven’t done this yet, but the same setup is how the wider family would get in: their own login on the tailnet, the Tailscale app on their phone or tablet, and the Immich app pointed at the same address. Shared albums would then reach them without a cloud in between.

Two things to plan for. Each grandparent is a user, and the free plan stops at six. And someone has to help them install the app and keep it switched on.

#Checklist

The Mac always gets the same address (DHCP reservation on the router)
Tailscale installed from Homebrew and started with sudo brew services start tailscale
Mac connected with --advertise-routes=<mac-address>/32 --accept-dns=false
Route approved in the admin console
Tailscale on every phone, logged in, shared address turned on
Tested on mobile data, not on the home wifi

#Frequently asked questions

Do I need to open ports on my router? No. The phone and the Mac both connect outward, so the router never has to let anything in. If they can’t reach each other directly, traffic goes through Tailscale’s relay servers: slower, but still encrypted.

Is Tailscale free for a family? The Personal plan is free for up to six users with unlimited devices, as of October 2026. Check the pricing page, plans have changed before.

Does it work when the Mac restarts? Yes. The Homebrew version runs as a service and starts when the Mac boots, before anyone logs in.

Can Tailscale see my family’s messages and photos? No. WireGuard encrypts the traffic end to end, also when it passes through Tailscale’s relays. Tailscale’s servers see logins, device names and which devices connect. If that bothers you, headscale replaces them.

Do I need my own domain or HTTPS for this? No. The shared address makes the same home addresses work everywhere. A domain with HTTPS is only needed for extras like Element in a web browser on another computer.