Tailscale plus RustDesk: a personal cloud without opening ports

Reaching a home computer, a vacation-house camera, or a backup box in another city sounds like a simple wish, yet the mechanics behind it are surprisingly tricky. Open the wrong door and your home network is exposed to strangers; pick the corporate route and you end up wrestling with expensive boxes and licenses. In this video the host proposes a third path: a free, end-to-end encrypted personal cloud built on a mesh network . Tailscale carries the connectivity layer, while RustDesk handles desktop control.

The most common mistake at home is enabling port forwarding on the router. Exposing port 3389 for remote desktop, 22 for SSH, or 554 for camera streams is effectively waving at automated scanners. According to Sensagraph, services such as RDP and SSH left facing the open internet are discovered by mass scans within hours, and weakly protected systems fall shortly after. The host is blunt: never open these doors directly to the internet.

On the corporate side the picture is different but equally awkward for home use. Companies hand remote workers a central box; you sign in through an app and funnel traffic through it. That design is one-directional and breaks down in a distributed home setup, where you may need to reach a vacation camera from home and a home server from the road. Hardware and license costs add an unjustified burden for a household or a small business. The host argues these legacy designs are both costly and fragile for personal use.

Why mesh networks behave differently

The mesh idea is disarmingly simple. Every machine with the Tailscale client joins the mesh as soon as it finds internet access and receives a stable address in the 100.x.x.x range. Wherever you are, your machines look as if they share one local network. A coordination server sits at the heart of this: each machine dials outward, so home firewalls rarely stand in the way. According to Tailscale, clients consult the coordination server for address resolution and then attempt a direct peer-to-peer tunnel. Outbound-first connections are a lifesaver behind address translation.

When a direct tunnel cannot be established, the system falls back to relay servers called DERP. That sounds alarming, but the risk is nil because traffic travels encrypted end to end under the WireGuard protocol; relays only forward sealed packets. According to Tailscale, roughly ninety percent of typical home setups connect peer to peer without any relay. The encryption layer is installed automatically, so users never need to master protocol details. Even relayed traffic stays unreadable to everyone in the middle.

The real privacy debate sits at sign-in. Tailscale stores no passwords at all; identity comes from Google, Microsoft, Apple, GitHub, or an OpenID provider. That means no password database to steal, but it ties your identity to a large provider. The host, uneasy with that trade, tried running the open-source Headscale project on his own server and found the setup buggy and unstable. The Headscale repository on GitHub documents the OpenID wiring in detail, yet the maintenance burden should not be underestimated. The host settled on his existing GitHub account as the least bad option and notes he barely sees a login screen after initial setup.

The free tier and the business behind it

The free tier is generous: a single user can attach up to 100 machines to one mesh and share access with two extra users through link sharing. That scale covers even a small business fleet with room to spare. When several people must administer a mesh under their own identities, paid tiers take over at 6 dollars per user per month up to 18 dollars for enterprise use. According to XDA-Developers, the personal plan's sharing arrangement makes pooling a home lab with friends noticeably easier. According to SiliconAngle, the company raised 160 million dollars in April 2025 at a 1.5 billion dollar valuation. The host reads that rapid rise, shortly after its founding around the pandemic years, together with the generosity of the free tier.

Installation is genuinely short. On Linux a single pasted command installs the client, one more command brings it up, and the printed link finished in a browser completes the enrollment. Over SSH to a distant box, opening that link on your local machine works just as well. On Windows you download the installer after signing in; on Android the store app does the job. Once enrolled, every machine appears on the Tailscale admin panel with its stable address. Different operating systems meet on the same mesh; Ubuntu, Pop OS, Proxmox, Windows, and Android run side by side. Reaching any of them takes nothing more than its address.

For full desktop control the host recommends RustDesk. SSH and file-transfer tools serve Linux users well, but a smooth desktop experience across mixed operating systems calls for a shared client. RustDesk fills that gap with Windows, Linux, and mobile builds; server and client are the same application. According to RustDesk, enabling a permanent password with direct IP access makes connections fast and stable. According to DavidWinter, running RustDesk over Tailscale keeps latency low and stays fluid at 1080p resolution. Saving the machine identity with its password removes any need to memorize directions.

Advanced use and the personal cloud

The advanced payoff is larger still. Once Proxmox hypervisors and cloud machines join the mesh, every publicly open door for SSH, admin panels, and hypervisor interfaces can be closed. Everything looks like one local network, so the security layout simplifies dramatically; a single door kept for one emergency address is enough. Reaching a home backup box without touching the vendor's cloud is a natural extension of the same mesh. The mesh stays always on with no switch to flip; while your machines run, your personal cloud runs.