Access Your Homelab Remotely without Port Forwarding (Bypass CGNAT with Tailscale)

📖 Original Reference: Originally published with zero-trust network topologies at alexmaina.dev/tailscale-pihole-homelab-cgnat.

With modern fiber (FTTH), cellular 5G, or Starlink connections, most ISPs place customer routers behind CGNAT (Carrier-Grade NAT).

Under CGNAT, you do not have a public IPv4 address, rendering classic port forwarding completely useless. Even if you have a public IP, opening ports (like port 22 or WireGuard port 51820) exposes your home router to 24/7 automated port scanners and brute-force attacks.

Here is how to set up a Tailscale Subnet Router with Pi-hole MagicDNS to gain zero-trust, encrypted remote access to every device on your home network without opening a single port.

Why a Subnet Router?

Instead of installing the Tailscale client on every single device (which is impossible for IoT gear, network printers, IP cameras, or legacy hardware), a Subnet Router acts as a secure gateway:

• One always-on Linux host (Raspberry Pi, mini PC, or VM) acts as the bridge.
• When you enable Tailscale on your laptop or phone while travelling, you can access 192.168.1.x IPs exactly as if you were on your home Wi-Fi.

Configure the Linux Gateway

SSH into your Linux machine and execute:

# 1. Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh

# 2. Enable IP packet forwarding in Linux kernel
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

# 3. Advertise your local subnet (adjust 192.168.1.0/24 to your LAN subnet)
sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-dns=false

Approve Subnet Routes in Tailscale Console

• Open the Tailscale Admin Machines Console.
• Locate your gateway device and look for the Subnets badge.
• Click the three dots (...) → Edit route settings...
• Check the box for your subnet (e.g. 192.168.1.0/24) and click Save.

Integrate Pi-hole for Global Ad-Blocking & Local DNS

If you have Pi-hole or AdGuard Home running in your homelab:

• In the Tailscale Admin Console, go to DNS.
• Under Nameservers, click Add nameserver → Custom...
• Enter your Pi-hole's local IP (e.g. 192.168.1.50) or Tailscale IP (100.x.y.z).
• Toggle Override local DNS ON.

The Result

• Seamless encrypted access to Proxmox, NAS storage, and local servers from anywhere.
• Network-wide ad-blocking and tracker filtering active on your phone and laptop wherever you travel.
• Zero ports forwarded on your home router.

Author: Alessandro Mainardi - Software Developer & Computer Engineering Student @ UniBo. Explore homelab setups at alexmaina.dev.