Personal cloud at home without opening ports: RustDesk straight over Tailscale

The setup of a user who helps family with their computers over RustDesk changed recently: the public RustDesk server now requires a login, because that server was only ever meant for testing and demonstration, and growing botnet and scam abuse forced the gate. The handful of machines he connects to were already on his Tailscale network and could already reach each other, so the public server turned redundant; pointing RustDesk straight at a machine's Tailscale address cuts out the middleman. On the machine to be controlled, you open RustDesk, click the three-dot menu next to its ID, enter settings, unlock the Security section, and allow direct IP access. ^{[1] [2]}

I think the real story sits in that small checkbox in the three-dot menu: remote desktop no longer has to pass through a company's server; my network, my rules. For years we were taught that reaching a home machine from outside meant either opening a port or trusting someone else's relay; both reduced the owner to a guest. Direct IP access flips the equation: the cloud stops being the provider of the service and becomes the quiet background where my two machines find each other.

The setup has two more stops: a permanent password is set in the Security section, because otherwise RustDesk generates a rotating temporary password and reconnecting without someone sitting in front of the machine becomes impossible. Then the machine's stable address starting with 100 is taken from the Tailscale client's menu-bar icon or the machine list in the admin console and noted down next to the password; the address stays the same as long as the device remains part of the network. ^{[3] [4]}

To connect, the Tailscale address is pasted into the remote desktop box on the connecting machine, the permanent password is entered, and you are in. RustDesk warns at this point that the connection is direct and unencrypted, but since the traffic already flows inside the encrypted channel of the Tailscale tunnel, dismissing the warning is considered safe. The detail matters, because automated scanners, botnets, and targeted attackers routinely probe well-known ports on internet-facing addresses; what invites the uninvited guest is not how fast they knock, but whether the door faces the street. ^{[5] [7]}

The list of street-facing doors is short and memorizable: port 22 for SSH, 3389 for RDP, 23 for Telnet. Bound to internet-facing interfaces without adequate access controls, they become reachable from any machine on earth. RDP is cited as the primary initial access vector in a majority of enterprise ransomware incidents; with RDP access, attackers can switch off backups, encrypt data, and move laterally across the network. Opening a port is therefore not mere convenience; it sits in the same risk class as leaving the house key above the door. ^{[6] [8]}

The counter-view deserves a note too: not everyone has a machine to tend at home or a Tailscale network to manage; for one-off help, logging into a relay server is sometimes the more honest fix. Besides, dependence does not vanish in this arrangement, it only changes hands: instead of a relay company I now trust a mesh network provider, its account system, and its client. For someone unwilling to self-host a relay, the trade is sensible, provided it is remembered as a trade.

The question that intrigues me most is this: as the home computer quietly becomes the main machine again, what will the cloud's role shrink to? If my files, my backups, and occasionally the models I run sit at home while I drop by through my own tunnel from outside, what really distinguishes me from a rented monthly remote desktop? I do not know the answer, but I know what I will be watching in the coming months: how many of those who set this up are still connecting directly six months from now, and how many have quietly drifted back to the old relay. What endures will be the habit, not the setting.