How to VPN into Home Network?

What can you access via home VPN?

• File shares: SMB/AFP shares on your NAS or computer.
• Media libraries: Plex, Jellyfin, or Kodi running at home.
• Printers and scanners: AirPrint or shared office printers.
• Smart home: Home Assistant, security cameras, smart switches.
• Internal sites: Routers, NAS admin panels, dev servers.

Method 1: Tailscale (easiest, no router config)

Tailscale is built on WireGuard but handles all the hard parts (key exchange, NAT traversal) automatically. No port forwarding required.

1. Install Tailscale on a device at home (Mac, Windows, Linux, Raspberry Pi, NAS — anything).
2. Sign in with a Google, Microsoft, or GitHub account.
3. Install Tailscale on your phone or laptop (wherever you want to connect from).
4. Sign in with the same account. The two devices now see each other on a private 100.x.x.x network.
5. Open Finder (Mac) or Explorer (Windows) and connect to your home computer's Tailscale IP. Files appear as if you were on the same LAN.

Method 2: WireGuard on a router (most flexible)

Best when you want every device on the remote network to be on the home LAN. Requires a compatible router (OpenWrt, AsusWRT-Merlin, GL.iNet).

1. Log in to your router's admin panel (e.g. 192.168.1.1).
2. Install the WireGuard package (most AsusWRT-Merlin and OpenWrt routers have it built in).
3. Generate a key pair for the router and a key pair for your client device (phone or laptop).
4. Add a peer entry on the router pointing to the client's public key, and vice versa.
5. Configure the client's WireGuard app with the router's public key and the home subnet (e.g. 192.168.1.0/24).
6. Enable port forwarding on the router: UDP port 51820 → WireGuard's listen port.

Method 3: OpenVPN on a Raspberry Pi (DIY)

Best for users who want full control and don't mind a little terminal work.

1. Install PiVPN on your Raspberry Pi: curl -L https://install.pivpn.io | bash
2. Choose WireGuard (faster) or OpenVPN during setup.
3. After install, run pivpn add to create a client profile.
4. Download the .conf file (or scan the QR code with the WireGuard app).
5. Forward UDP 51820 (WireGuard) or UDP 1194 (OpenVPN) on your router to the Raspberry Pi's local IP.
6. Set up a dynamic DNS (DuckDNS, No-IP) so your home's changing IP is always reachable.

How to set up a dynamic DNS (free)

Your home IP changes periodically (unless you pay for static IP). Dynamic DNS keeps a hostname pointed at your current IP:

1. Sign up at duckdns.org or no-ip.com (both free).
2. Choose a hostname (e.g. myhome.duckdns.org).
3. Install the DDNS client on your router or Raspberry Pi. Most routers have a built-in DDNS settings page.
4. Point your VPN client at the hostname instead of the raw IP address.

Common issues and fixes

• "Connection refused": Router's firewall or port forwarding not configured. Double-check the port and IP.
• "Handshake does not complete": Public keys mismatched between client and server. Regenerate and re-copy.
• Can connect but can't see devices: AllowedIPs on WireGuard doesn't include the home subnet (e.g. 192.168.1.0/24).
• Slow speeds: Your home upload speed is the bottleneck (most ISPs have 5-20 Mbps upload).