← Back to Projects
Complete
aiself-hostingtailscaleremote-accessvpncgnathomelab

Self-Hosted AI Stack — Part 6: Remote Access

Part 6 of the self-hosted AI stack series. Reach your stack securely from outside your home network — including from behind CGNAT, where traditional port forwarding isn't an option.

N
NOTE

Goal for this part: reach your stack securely from outside your home network — including from behind CGNAT, where a traditional port-forward isn't an option at all.

Why this isn't just port forwarding

If your ISP puts you behind Carrier-Grade NAT (CGNAT) — common on many mobile-carrier-based home internet plans — you don't have a public IP address to forward a port to in the first place. Even without CGNAT, opening ports directly to a self-hosted AI stack on your home network is a meaningfully larger attack surface than most people want to take on.

A mesh VPN sidesteps both problems: your devices reach each other over an encrypted private network regardless of what's happening at the ISP level, with nothing exposed to the open internet.

This series uses Tailscale, built on WireGuard, because it handles NAT traversal automatically and requires close to zero manual network configuration.

N
NOTE

If you're already running Tailscale on your Raspberry Pi home server (covered in the RPi5 series), the same Tailscale account works here — both machines appear in your tailnet and can reach each other.

Setting up Tailscale on the host

  1. Install Tailscale on your Windows host from tailscale.com/download
  2. Sign in and confirm the machine appears in your Tailscale admin console
  3. Note the machine's Tailscale hostname — you'll use it to reach your stack remotely instead of a local IP

Exposing Open WebUI specifically

Rather than exposing every service in your compose stack, expose just the one you actually want to reach remotely — Open WebUI, since it's your single unified entry point to chat, coding, and image generation.

From PowerShell on the Windows host:

tailscale serve https / http://localhost:3000

This reverse-proxies your Tailscale HTTPS endpoint straight to Open WebUI's local port. Once running, Open WebUI becomes reachable at:

https://<your-device-name>.<your-tailnet-name>.ts.net

From any other device signed into the same Tailscale network — phone, laptop, wherever.

T
TIP

Testing from another device on the same home Wi-Fi doesn't prove much, since local network access might work through other means. Test from a device on cellular data or a completely different network before considering this done.

W
WARN

Leave ComfyUI, Ollama's raw API, and SearXNG unexposed unless you have a specific reason to reach them directly from outside. Open WebUI already fronts the chat and image-generation experience, and every additional exposed service is one more thing to keep secured and updated.

Troubleshooting

Tailscale shows the device online but the .ts.net URL doesn't load

Confirm tailscale serve is actually still running — it doesn't persist as a background service by default on every setup, and a reboot or Tailscale update can drop it silently:

tailscale serve status

Re-run the serve command if it's not listed.

Works locally but not remotely

Confirm the remote device is signed into the same Tailscale account and tailnet — a common mistake is testing from a device that was never added to the tailnet.

Windows Firewall blocks the connection

Tailscale needs to be allowed through Windows Defender Firewall on both Private and Public profiles. Check Windows Security → Firewall & network protection if tailscale serve reports success but connections still fail.

Series Navigation