Remote Desktop Over Tailscale
Access your Windows desktop's full remote desktop from anywhere using Tailscale as the transport — encrypted, private, and with no port 3389 exposed to the internet. Covers setup, the firewall gotcha, and when RDP beats just browsing to a service directly.
What this covers. Securely accessing your Windows desktop's full remote desktop (mouse, keyboard, the actual screen) from anywhere, using Tailscale as the transport instead of exposing Remote Desktop to the public internet.
Why this combination, specifically
Remote Desktop (RDP) lets you control a Windows machine's actual desktop remotely — full mouse, keyboard, the works, as if sitting in front of it. The traditional way people set this up is forwarding port 3389 on their router directly to the internet, which is genuinely risky: RDP is one of the most commonly scanned and attacked services that exists, precisely because so many home setups have exposed it this way over the years.
Tailscale removes that risk entirely. The RDP connection never touches the public internet — it only exists between two devices already authenticated into your private tailnet, over an encrypted WireGuard tunnel. There's no public attack surface to find, because nothing is publicly exposed in the first place.
Prerequisites
- Tailscale already installed and signed in on the Windows host. If you haven't set up Tailscale yet, the Tailscale installation and sign-in steps in my ComfyUI remote access guide cover it.
- The device you'll connect from also signed into the same tailnet.
- A password set on the Windows account you'll connect with — RDP refuses passwordless accounts.
Check your Windows edition before starting. Remote Desktop hosting (being the machine that accepts the connection) requires Windows 10/11 Pro, Enterprise, or Education. It is not available on Home edition — Home can act as a client (connecting out to other machines) but can't be connected into. Check via Settings → System → About before going further.
Step 1 — enable Remote Desktop on the host
- Open Settings → System → Remote Desktop.
- Toggle Remote Desktop on.
This is the machine you'll be connecting to — the one whose desktop you want to see and control remotely.
Step 2 — connect from a remote device
The app you use depends on what you're connecting from:
- From another Windows machine: the built-in Remote Desktop Connection app
(search
mstscin the Start menu). - From a phone, Mac, or anything else: Microsoft's free Remote Desktop app (available for iOS, Android, and macOS).
In the "PC name" / "Computer" field, use your Tailscale hostname instead of a
local IP — the same address style as your .ts.net domain, just without the
https://, for example:
desktop.your-tailnet.ts.net(Substitute your own machine's MagicDNS name — find it with tailscale status or
in the Tailscale admin console.) The raw Tailscale IP (100.x.x.x) works
identically if you prefer it. Sign in with the Windows account's username and
password, and the actual desktop should load.
Troubleshooting
Remote Desktop is enabled, but the connection times out over Tailscale. Windows sometimes categorizes the Tailscale virtual network adapter as a "Public" network, and Windows Firewall's default Remote Desktop rule only allows connections on the "Private" profile. Check Windows Security → Firewall & network protection, find the network associated with Tailscale, and either mark it Private or explicitly allow Remote Desktop on the Public profile too. This is the single most common reason an otherwise-correct setup won't connect.
"Remote Desktop can't connect" or the toggle in Settings is greyed out. Almost always a Windows edition issue — confirm you're on Pro, Enterprise, or Education, not Home (see the warning above). Home edition cannot host RDP sessions at all, regardless of any other setting.
Connects, but the session feels laggy or unresponsive. Since traffic is routed through Tailscale's encrypted tunnel rather than a direct local connection, performance depends on both ends' actual internet connection quality, not just local network speed. Reducing the RDP session's color depth/resolution (in the Remote Desktop Connection app's display settings, before connecting) usually helps noticeably on a slower mobile connection.
Where this fits versus just browsing to a service directly
Not every remote task needs a full desktop session — for normal day-to-day use of
something like ComfyUI or Open WebUI, going straight to their Tailscale address in
a regular browser (http://<tailscale-hostname>:8188, or the tailscale serve
HTTPS URL) is lighter and simpler than opening a full remote desktop. That
browser-direct approach is covered in the
ComfyUI remote access guide.
RDP earns its place specifically for situations that need genuine troubleshooting rather than "just open the page" — reading logs, running diagnostic commands, restarting a stuck service, or anything else that needs actual back-and-forth on the machine itself. Having a full remote desktop session means being able to do all of that from a phone or laptop exactly as if physically at the machine, rather than being stuck until getting home.
| Task | Best approach |
|---|---|
| Generate an image, check on a running job | Browser → service's Tailscale address directly |
| Something's stuck / erroring, needs investigation | RDP → open a terminal, run diagnostics |
| Restart a container, check logs | RDP (or, if comfortable, SSH — see note below) |
| Routine daily use of a self-hosted app | Browser → service's Tailscale address directly |
A lighter-weight alternative for command-line-only tasks. If a task is
purely command-line (checking docker ps, restarting a service) and doesn't
need the actual visual desktop, enabling Windows' built-in OpenSSH Server and
reaching it over the same Tailscale connection is a lighter-weight alternative to
a full RDP session — worth exploring later if RDP starts to feel like overkill
for quick checks.