How to create a family VPN with Tailscale to connect multiple households

¿How to create a family VPN with Tailscale for multiple households? Setting up a family VPN that connects multiple homes is no longer just for network geeks or system administrators. Thanks to Tailscale, you can have an "extended home private network" where the living room PC, your parents' NAS, and your brother's mobile phone appear as if they're all connected to the same router.

With Tailscale and its integration with WireGuard You can access your files, NAS, IP cameras, multimedia services, VPS, or even your home router without opening ports, dealing with your ISP's CG-NAT, or complicated configurations. Let's see, step by step and with plenty of examples, how to use this to create a family VPN for multiple households, remote work, and all sorts of everyday uses.

What is Tailscale and why is it ideal for a family VPN?

Tailscale is a near-zero configuration mesh VPN. which relies on WireGuard to encrypt traffic. Instead of setting up a large central server with open ports, you install a small client on each device, and they all connect to each other via a virtual private network called tailnet.

The magic is in that You don't need to open any ports on your router or manually set up VPN servers.Tailscale is responsible for discovering direct routes between devices and, if this is not possible due to NAT or firewalls, it sends the traffic through its DERP nodes as a relay, maintaining end-to-end encryption.

This architecture allows you Connect computers, mobiles, tablets, NAS, servers, Raspberry Pi and even cloud machines (AWS, Azure, Google Cloud, Hetzner, Oracle Cloud, etc.) under a single private network. Perfect for connecting multiple family homes, a home office, and one or more VPSs.

Each device you add to your tailnet receives a static private IP address within the Tailscale networkThis address doesn't change whether you connect via Wi-Fi, cable, or from another house. This makes it very easy to point to a NAS, media server, or Docker container, because you'll always be using the same internal Tailscale address.

Tailscale security: modern encryption and total control

One of the service's strengths is that Tailscale uses WireGuard as its VPN engineWireGuard is a modern, lightweight protocol known for offering strong security and excellent performance, ideal for streaming, remote control, and online gaming within your home VPN. Browse securely with a VPN.

Connections are established point-to-point between devicesTherefore, traffic is not decrypted on Tailscale servers. Its nodes can act as a relay (DERP) when a direct route is not possible, but the content is always encrypted using WireGuard's Noise protocol.

In addition, the system implements automatic key rotation (typically on an hourly and daily basis), which reduces the risk of an outdated or compromised key being reused. Every connection is centrally logged and can be audited from the web panel or API, which is very useful if you also use it for remote work.

For authentication, Tailscale It integrates with SSO and MFA.You can log in with Google, Microsoft, GitHub, Okta, SAML SSO, and more, and protect access with two-step verification. If someone leaves the group (for example, a family member you no longer want on the network or an employee who departs), you can revoke their team or user access from the dashboard in seconds.

Real-world use cases for a family VPN with Tailscale

The theory is fine, but where Tailscale truly shines is in everyday practice. Set up a family VPN between multiple households It allows you to cover a lot of useful scenarios without any headaches.

Imagine that in your house you have a NAS with backups and a couple of IP cameras. You install Tailscale on the NAS or on a Raspberry Pi that shares the subnet (subnet router), register your mobile phone and your partner's, and then you can access the NAS folders and the cameras from anywhere, as if you were connected to your home Wi-Fi, but without opening a single port on the router.

Another typical case is the Secure remote work from your parents' house or on vacationYou install Tailscale on your office PC and your laptop, designate the office computer as the exit node, and all traffic from your laptop is routed through it. This allows you to access internal company resources or remote servers with an encrypted connection without exposing anything directly to the internet.

If what you want is a family network shared between several homesYou create an account (the free plan is more than enough for home use), invite your family members by email or link, and register their mobile phones, tablets, and computers. From the administration panel, you decide which devices can see which resources: shared NAS, printers, folders, multimedia services, etc.

Nor should we forget its use with VPS and self-hosted servicesMany users set up Docker containers with various commercial VPN providers and Tailscale on top, and then share the outgoing IPs of those containers with friends or family without revealing credentials. It's a very flexible way to "share VPN" with a virtually unlimited number of clients.

Tailscale plans and pricing: which one to choose for your family

Tailscale offers several plans, but for a VPN between multiple homes, the most interesting option is usually the one... Free Personal planwhich allows up to 100 devices and 3 users. Each of those devices can be a PC, a mobile phone, a Raspberry Pi, a NAS, etc.

This free plan includes End-to-end encryption, DNS support, access sharing with friends and family and community support. If you want to add more devices beyond the included allowance, they can be paid for individually.

Above it is Personal PlusIt maintains the staff functions but expands to up to six users for just a few dollars a month. Ideal if you have a large family and want each person to have their own separate user account without any hassle.

If we jump to the professional field there Starter and Premium plansThese add advanced access control, identity- and role-based ACLs, route management, Okta integration, multiple administrators, email support, and more devices per user. They are designed for teams and small businesses that want to extend the same "simple VPN" philosophy to their corporate network.

Finally, large companies have a Enterprise plan With customized pricing, deep IoT integration, audit monitoring, and dedicated support. A family VPN typically doesn't require any of this, but it's good to know that the platform scales from home use to very large environments.

Key advantages of Tailscale over other VPNs

Although Tailscale can also route all your traffic through an exit node, It's not a typical commercial VPN like NordVPN or ExpressVPN.Its main objective is to connect your devices and networks to each other, not to provide massive anonymous nodes to the general public.

In a commercial VPN, All traffic goes through the company's servers And you choose countries to bypass geographical restrictions. In Tailscale, by default, traffic goes directly between your machines, and only passes through an exit node if you choose. This reduces latency, improves performance, and gives you complete control over where your traffic goes out to the internet.

Furthermore, the fact that you don't have to open ports on the router This makes it ideal in complicated environments: connections behind CG-NAT, routers that you change often, environments where the router is constantly being restarted, or VPSs where you don't want to expose WireGuard/OpenVPN ports.

Compatibility is another strong point: Tailscale runs on Windows, Linux, macOS, Android, iOS, and ARM devices like Raspberry PiThis means that virtually any device you have at home can participate in the VPN, either directly or through a subnet router.

Added to all this is the ease of Transfer files between Tailscale devices, support for custom DNS (including Pi-hole and AdGuard Home) and the ability to configure partial or full routing depending on what you want to send through the VPN.

How to register your account and explore the Tailscale dashboard

To begin you need Create an account on TailscaleGo to the official website, click on “Get Started” or the login link, and choose to sign in with Google, Microsoft, GitHub, or another supported provider. If you have a corporate email address and want to use it, this will usually lead you to paid plans geared towards businesses.

Once authenticated, you arrive at the main administration panelHere you'll find several key sections. "Machines" lists all the devices connected to your tailnet: PCs, servers, mobile devices, Raspberry Pi, etc. Each one appears with its name, operating system, and assigned Tailscale private IP address, which is static unless you explicitly change it.

In the “External” tab you can invite friends or family members to use their machines so they can connect to your network. This way you can set up a family VPN where you control the tailnet, but other family members contribute their own devices.

The “Services” section allows see which services are exposed by each machine within the Tailscale network. It's useful for quickly locating a home web server, a NAS panel, or a media service without having to remember ports.

In “Access Control” you define your access control lists (ACLs) in JSON formatHere you decide which users or groups can communicate with which machines and ports. It's very powerful, so it's advisable to read the official documentation to avoid mistakes when writing the rules.

The “DNS” section is used to activate Magic DNS and configure the nameserversMagic DNS lets you access devices by name instead of by IP address (for example, nas-casa instead of 100.xyz). You can also force all VPN DNS requests to resolve to specific servers.

In “Features” and “Settings” you will see Beta features, data collection options, and advanced features which you can activate or deactivate. “Billing” is reserved for payment plans and billing information.

Finally, “Auth-Keys” and “API Key” allow you to Register machines without manually logging in (for example, headless servers or containers) using single-use or multi-use keys, and access the Tailscale API for more advanced integrations.

Download the client and register your devices

The next step is to install Tailscale on the computers you want to connect. You can do this from the "Download" section of the control panel, or from the public website. Download the client for your operating system: Windows (7 or higher), macOS, Linux, Android, iOS or ARM architectures such as Raspberry Pi.

On a Windows PC, for example, you run the installer, follow the wizard, and when finished, double-click the Tailscale icon in the taskbar. The client opens the browser so that Log in with the same account you used on the panelOnce you accept, the equipment appears in the "Machines" list and becomes part of your tailnet.

The client displays useful information such as Tailscale's private IP address, sent and received traffic, connect/disconnect options, automatic startup, view all devices on the network, and switch accountsFrom the web panel you can rename the host, share it with other users, adjust routes and remove it from the VPN whenever you want.

On Android and iOS mobile devices, you install the app from their respective stores. Configure VPN on your Android phoneYou authenticate with the same account and grant permissions to manage VPN connections. From there, a tap on the app's switch connects or disconnects the device from your family VPN.

If you have a Raspberry Pi or a Linux server, installation is usually done via a repository. On Debian or Raspbian, for example, you install the HTTPS transport packages, add the Tailscale repository, update, and install the package. Then you run tailscale upYou visit the URL I indicate in the browser and the node will be authenticated.

Create a subnet router to access the entire local network

One of Tailscale's most powerful tricks for a family VPN across multiple households is to use routers with VPN client functionality or subnet routers. Instead of installing Tailscale on every device on your LAN (NAS, TV, printer, etc.), you install the client on a single machine—for example, a Raspberry Pi—and have it advertise the entire home subnet.

This way, you can be outside your home access any device on your local network (NAS, cameras, router, media server, home automation…) as if you were sitting on the sofa connected to Wi-Fi. You just need at least one device on that network to have Tailscale and act as a gateway.

In Windows, IP forwarding is enabled using PowerShell in administrator mode, with commands such as Set‑NetIPInterface -Forwarding Enabled on the correct interface, and then it runs tailscale set –advertise-routes=192.168.1.0/24 (adapting the subnet to that of your house).

In Linux, the following is enabled: IP forwarding in sysctl, adding the relevant lines for IPv4 and IPv6 in /etc/sysctl.conf and applying the changes, and then it calls tailscale set –advertise-routes=192.168.1.0/24 or it is launched tailscale up with the parameters –advertise-routes suitable.

After announcing the subnet from the machine, you log into the Tailscale web panel, go to “Machines”, open the options for the device that should be the subnet router, and You enable the advertised routes in “Route settings”. From there, the other devices in your tailnet will be able to reach any IP address in that subnet as long as their ACLs allow it.

Use an exit node to browse as if you were at home

For many families who live in different countries or who travel often, it is extremely useful use an exit nodeAn exit node is a device in your tailnet through which you route all your internet traffic, similar to a classic VPN server.

If you configure, for example, your home Raspberry Pi as an exit node, when you are abroad you will be able to browse using your home IP address, avoiding geographical restrictions on streaming services or online banking, and adding a layer of security when you connect to public Wi-Fi.

In Linux, in addition to enabling IP forwarding, you start Tailscale with –advertise-exit-nodeThen, in the web panel, go to “Machines”, locate that machine, click on “Edit route settings” and select the “Use as exit node” option.

From your mobile phone or laptop, within the Tailscale app, you choose use that specific equipment as an output nodeFrom that moment on, all traffic will go out to the Internet through your home: browsing, applications, streaming... everything travels encrypted between your client and the exit node.

If you also combine the exit node with a subnet router, you kill two birds with one stone: You browse using your home IP address and at the same time you can reach any device on your home LANFrom a NAS to a Jellyfin server, without installing extra clients.

Route only part of the traffic and take advantage of filtered DNS

It's not always desirable to send all traffic through the VPN. Tailscale allows you to... partial routing or “split tunneling”This ensures that only traffic destined for specific IPs or domains uses the VPN, while all other traffic uses the regular local connection. This is the default configuration when using subnet routers without an exit node.

This is ideal if you want, for example, that only access to the NAS or home server goes through TailscaleHowever, general navigation should not be affected. From the routes panel and ACLs, you can adjust exactly which destinations pass through your tailnet.

In the DNS section, Tailscale lets you define global DNS servers for the entire network or by specific domains. A very common option in family environments is to use Pi-hole or AdGuard Home as a DNS server within the home network and have all VPN DNS requests go through it.

In the DNS tab, you configure the IP address of Pi-hole or AdGuard Home (either the Tailscale IP address of the server itself or the local IP address advertised via subnet routing) and enable the option to overwrite local DNSFrom that moment on, mobiles and computers connected to Tailscale will use that filtered DNS, blocking a large part of the advertising and trackers even when browsing from outside the home.

You also have the option to define DNS by domainso, for example, everything that ends in .hogar.lan It is resolved with an internal server, while the rest continues to use public DNS or your usual provider.

Tailscale performance and latency in practice

Although Tailscale is heavily focused on simplicity, its performance is more than respectable. Being based on WireGuard, achieves high speeds and low latency provided there is a reasonably good direct path between devices.

In real-world tests with two PCs connected to the same FTTH connection (one by cable and one by Wi-Fi), the ping between them on Tailscale shows low and stable medium latencieseven if the first packet takes a little longer while the encrypted channel is established.

In terms of speed, it's common to see sustained transfer speeds of tens of Mbps within the VPN, which is sufficient for video streaming, incremental backups, remote desktop access, and large file transferThe exact figure will depend on the quality of the connections in each home and whether the route is direct or passes through a DERP relay.

The decentralized architecture itself, combined with data compression techniques and route optimizationThis allows most users to have a smooth experience. However, it's still advisable to test it in your specific environment because your network configuration, NAT, and firewalls can affect performance.

In any case, if you have already tried WireGuard "manually", Tailscale's behavior will seem familiar: It's basically WireGuard with an automation and management layer on top.so you hardly have to deal with keys, ports, firewall rules, or custom scripts.

Basic step-by-step usage in a real-world scenario

To put all of the above into perspective, imagine that you want Access from your Android mobile to a web service running on a Raspberry Pi at home (for example, FileBrowser on port 8080), and also join another family home to the same VPN.

You install Tailscale on the Raspberry Pi by adding the official repository, updating and installing the package, and then running sudo tailscale upThe terminal gives you an authentication URL; you open it in the browser, log in with your Tailscale account, and the Pi is registered.

On your Android mobile device, download the Tailscale app from Google Play. You authenticate with the same account and activate the VPN. In the device list, you'll see the Raspberry Pi with its Tailscale IP address (for example, 100.91.114.77). To access FileBrowser, simply open your mobile browser and visit 100.91.114.77:8080.

If you also want the mobile route all your traffic through the Raspberry PiYou enable IP forwarding on the Pi, and you start Tailscale with the option –advertise-exit-nodeYou activate “Use as exit node” in the web panel and, from the Tailscale app on Android, select that Pi as the exit node. From then on, everything will be encrypted on-premises.

To involve another household, for example your parents', all you do is Invite your devices to your tailnet From the control panel (via email or link), they install the client on their PC or mobile device, accept the invitation, and then they can access the resources you allow: NAS, media server, printers, etc. If they also want to share their entire home LAN, you can set up another Raspberry Pi there, configure it as a subnet router, and thus have your two homes connected as if they shared the same internal network.

With this combination of clients, subnet routers, and exit nodes, plus fine-grained control of DNS and ACLs, You can set up a very complete family private network without extensive networking knowledge, avoiding CG-NAT, without exposing ports to the outside, and with the flexibility to grow to VPS, cloud services, or more professional environments if you ever need to.

This entire ecosystem makes Tailscale a particularly convenient solution for those who want to connect multiple households, maintain a personal cloud spread across home and remote servers, share resources with family, and work remotely, combining simplicity, performance, and a level of security far exceeding what is typically seen in makeshift home setups.