Port forwarding is the part of homelab networking that trips up almost everyone. You want to check on your Proxmox VMs from a coffee shop, or grab a file off your NAS while you're at work, and suddenly you're reading forum threads about router firmware, dynamic DNS, and why opening port 8006 to the internet is a genuinely bad idea. There's a much simpler way to do this, and it runs happily in a tiny LXC container on your Proxmox host.
That tool is Tailscale. It builds a private network between your devices using WireGuard under the hood, but it skips almost all the manual configuration WireGuard normally demands. No port forwarding, no static IP requirement, no fiddling with firewall rules on three different networks. You install it, log in, and your devices can see each other as if they were on the same LAN — even when one is in your basement and the other is on a hotel Wi-Fi network.
This guide walks you through setting up Tailscale inside an unprivileged LXC container on Proxmox VE, which is the cleanest way to run it if you don't want to install extra software directly on the Proxmox host itself.
What You Will Learn
By the end of this tutorial you'll know how to:
- Create a small, dedicated LXC container for Tailscale
- Install and configure Tailscale inside that container
- Grant the container access to the TUN network device it needs (this is the part that trips people up)
- Verify the connection is actually working from another device
- Fix the handful of errors that show up most often
What Is This Feature?
Tailscale is a mesh VPN service built on top of WireGuard, an open-source VPN protocol known for being fast and lightweight compared to older options like OpenVPN. WireGuard by itself still requires you to manually exchange keys, assign IP ranges, and usually open a port on your router. Tailscale automates that whole process using a coordination service that helps your devices find each other, even when they're both behind NAT (the address translation your router does that normally makes incoming connections hard).
An LXC container, if you haven't used one before, is a lightweight form of virtualization built into Proxmox VE. Unlike a full virtual machine, an LXC container shares the host's Linux kernel instead of running its own, which means it starts in a couple of seconds and uses a fraction of the RAM and disk space a VM would need for the same job. Tailscale barely needs any resources to run, so a container is a much better fit than spinning up an entire VM just to host one background service.
Put those two together and you get a small, always-on container that quietly joins your private Tailscale network and lets you reach your Proxmox host, your VMs, and any other Tailscale-connected device from anywhere.
Why Would You Use It?
The obvious reason is remote access without exposing anything to the public internet. If you've ever forwarded port 8006 so you could reach the Proxmox web UI from outside your home, you've opened a door that anyone scanning the internet can find. Tailscale closes that door entirely — there's nothing listening on your router for the outside world to discover.
It's also just less annoying day to day. Once it's running, your container gets a stable Tailscale IP address (something like 100.x.x.x) that never changes, regardless of what your ISP does to your home IP address. SSH into your Proxmox node, open a VM's web interface, or reach a Samba share on your NAS, all through that same private network, from your phone, your laptop, wherever you are.
Is it the only way to do this? No — you could set up WireGuard by hand, or run something like OpenVPN. Tailscale just gets you there in about ten minutes instead of an afternoon, and it handles the annoying NAT traversal problem for you. For a homelab, that trade-off is usually worth it.
Prerequisites
Before you start, make sure you have:
- A working Proxmox VE 8.x or 9.x installation with access to the web interface
- At least one LXC container template downloaded (Debian 12 or Ubuntu 24.04 both work well — grab one under local storage > CT Templates > Templates if you don't have one yet)
- A free Tailscale account (sign up at tailscale.com with a Google, Microsoft, GitHub, or email login — no credit card needed for personal use)
- Root or admin access to the Proxmox web UI, or SSH access to the host
- About 15 minutes
You don't need a public IP address, a domain name, or any router configuration. That's the whole point of this setup.
Step-by-Step Tutorial
Step 1: Create the LXC Container
In the Proxmox web interface, click Create CT in the top right corner. Give it a hostname like tailscale and set a root password.
On the Template tab, pick Debian 12 or Ubuntu 24.04. On Resources, this container barely needs anything — 1 CPU core, 512 MB of RAM, and an 4 GB disk is more than enough. On Network, DHCP is fine unless you already assign static IPs to your infrastructure containers.
Leave everything else at the defaults and finish the wizard. Don't start the container yet — there's one setting worth checking first.
Step 2: Enable Nesting and Keyctl Features
Tailscale needs two container features that aren't on by default in an unprivileged container. Select your new container, go to Options, double-click Features, and check both Nesting and keyctl.
Nesting allows certain kernel namespace operations Tailscale relies on internally, and keyctl grants access to the kernel's key management facility. Without these two, tailscaled (the background service that does the actual networking) will fail to start with a permission error.
You can do the same thing from the shell on the Proxmox host, if you'd rather use the command line:
pct set 105 --features keyctl=1,nesting=1Replace 105 with whatever container ID Proxmox assigned yours — you'll see it in the left-hand tree.
Step 3: Give the Container Access to /dev/net/tun
This is the step almost everyone misses the first time. Tailscale needs a TUN device to create its virtual network interface, and unprivileged LXC containers don't have one by default for security reasons.
On recent Proxmox VE releases, the easiest way is through the GUI. Go to your container's Resources tab, click Add, and choose Device Passthrough. Enter /dev/net/tun as the device path and save.
If you don't see that option (it depends on your exact Proxmox VE version), you can add it manually via the command line instead:
pct set 105 --dev0 /dev/net/tunOr edit the container's config file directly at /etc/pve/lxc/105.conf and add these two lines:
lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=fileEither method works. Once it's set, start the container.
Step 4: Update the Container and Install Tailscale
Open the container's console from the Proxmox UI (or SSH into it once it has an IP) and update the package list first:
apt update && apt upgrade -yThen install curl if it isn't already there, and run Tailscale's official install script:
apt install -y curl
curl -fsSL https://tailscale.com/install.sh | shThat script detects your distribution automatically, adds Tailscale's package repository and signing key, and installs the tailscale and tailscaled packages. If you'd rather not pipe a script straight into a shell — a fair instinct — you can open the URL in a browser first and read exactly what it does before running it.
Step 5: Bring Up the Tailscale Connection
Start the service and connect:
systemctl enable --now tailscaled
tailscale upYou'll get a URL printed in the terminal. Copy it into any browser (on your phone is fine) and log in with the same account you created earlier. Approve the new device, and within a few seconds the container joins your Tailscale network.
Back in the terminal, confirm it worked:
tailscale statusYou should see your container listed with a 100.x.x.x address, along with any other devices you've already connected. That's it — from any device signed into the same Tailscale account, you can now reach this container directly.
Step 6 (Optional): Route Traffic to Your Whole Home Network
By default, Tailscale only gives you access to the container itself. If you want to reach other devices on your home network too — your Proxmox host's regular LAN IP, other VMs, a NAS — you can turn this container into a subnet router.
First, enable IP forwarding inside the container:
echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding = 1' | tee -a /etc/sysctl.conf
sysctl -pThen advertise your LAN's subnet when bringing Tailscale up:
tailscale up --advertise-routes=192.168.1.0/24Swap in your actual home network range. You'll still need to approve this route in the Tailscale admin console under Machines — it's a manual step on purpose, so a container can't silently expose a network without you noticing.
Commands Explained
| Command | What It Does |
|---|---|
| pct set 105 --features keyctl=1,nesting=1 | Enables the two container features tailscaled needs to run inside an unprivileged LXC container |
| pct set 105 --dev0 /dev/net/tun | Passes the host's TUN device through to the container so it can create a virtual network interface |
| curl -fsSL https://tailscale.com/install.sh | sh | Downloads and runs Tailscale's official install script, which adds their repo and installs the client |
| systemctl enable --now tailscaled | Starts the tailscaled background service immediately and sets it to start automatically on every boot |
| tailscale up | Authenticates the device and connects it to your Tailscale network; add flags like --advertise-routes or --ssh to change its behavior |
| tailscale status | Lists every device currently on your Tailscale network along with its assigned IP and connection state |
Common Errors
A few messages come up often enough that they're worth calling out by name.
"open /dev/net/tun: no such file or directory" — the container doesn't have the TUN device passed through yet. Go back to Step 3, add the device passthrough, and restart the container.
tailscaled fails to start, journalctl mentions a permission or capability error — almost always means nesting or keyctl isn't enabled. Double-check both boxes are ticked under the container's Features, then restart the container (a service restart alone isn't enough here, the container itself needs to reboot).
The login link in the terminal has expired — these links are only valid for a few minutes. Just run tailscale up again to get a fresh one.
The container connects but nothing outside it responds, even with subnet routing set up — the route almost certainly hasn't been approved yet. Log into the Tailscale admin console, go to Machines, find your container, and approve the advertised subnet manually.
Troubleshooting
If something isn't working, check the service status first:
systemctl status tailscaledand look at the logs if it isn't happy:
journalctl -u tailscaled -n 50If the container itself won't even boot after you've added the device passthrough, check /etc/pve/lxc/<CTID>.conf on the Proxmox host for a typo — a missing colon or wrong device number in the cgroup line will stop the container cold.
Tailscale also ships a built-in diagnostic tool that's genuinely useful:
tailscale netcheckIt reports which relay servers (Tailscale calls them DERP servers) your container can reach and how fast, which helps if connections feel slow rather than broken. Most home networks connect device-to-device directly once the handshake completes, so DERP is mainly a fallback for tricky NAT situations.
Best Practices
Keep this container unprivileged. There's rarely a good reason to run Tailscale in a privileged LXC container, and privileged containers have direct access to the host's kernel in ways that make a compromise much more serious.
Give it a sensible hostname before you bring Tailscale up — renaming a device after the fact means logging into the admin console and doing it manually, which is easy to forget.
If you're going to use this as a subnet router, tag the machine in the Tailscale admin console and set up an access control list (ACL) rather than leaving every device with unrestricted access to everything else. It only takes a few minutes and it's worth doing before you forget the network even has this exposure.
Update the container occasionally. Tailscale ships frequent client updates, and apt update && apt upgrade inside the container keeps both the OS and the tailscale package current.
Frequently Asked Questions
Do I need a static public IP address for this to work?
No. Tailscale is specifically built to work behind NAT and dynamic IPs, which covers almost every home internet connection.
Is Tailscale actually free?
Yes, for personal use. The free tier covers up to 100 devices and 3 users, which is more than enough for a homelab.
Do I still need port forwarding on my router?
No — that's the entire reason to use it. Nothing needs to be opened on your router for this to work.
Should I run this instead of a WireGuard server I set up manually?
They solve the same basic problem, but Tailscale trades a little bit of control for a lot less setup work and automatic NAT traversal. If you already have a manual WireGuard setup running fine, there's no urgent reason to replace it.
Can I run Tailscale directly on the Proxmox host instead of in a container?
You can, but a container keeps it isolated from the host OS and makes it trivial to back up, move, or destroy and recreate without touching your hypervisor.
Conclusion
Once this container is running, remote access to your homelab stops being something you have to think about. No dynamic DNS, no port forwarding rules to maintain, no worrying about what's exposed to the open internet. You get a private, always-available path back into your Proxmox environment from wherever you happen to be.
It's a small container doing a fairly unglamorous job, but it's the kind of unglamorous job that saves you a genuinely annoying evening the first time you're away from home and need to check on something.