How to Use Tailscale with Claude Code for Remote Access

The naive approach to remote Claude Code access is opening SSH to the public internet. Tailscale is the better option: it creates a private WireGuard-based mesh network between your devices, so SSH access to your server is private by default and requires no firewall rules. If you also want to monitor and control the session from your phone, Grass integrates directly with Tailscale via grass start --network tailscale.

TL;DR

• Tailscale creates a private network between your devices — no public ports required
• Install on server and laptop; SSH via the Tailscale IP (100.x.x.x) instead of the public IP
• The public SSH port (22) can remain closed via ufw — Tailscale handles the connection
• For phone access without SSH: install Grass, run grass start --network tailscale, scan QR code
• Tailscale is free for personal use (up to 100 devices)

Why Tailscale for Claude Code?

Claude Code runs on a server. To access it remotely, you need some way to reach that server from outside its local network. The default answer — open port 22 to the public internet — exposes the server to SSH brute-force attacks and requires careful key management.

Tailscale creates a private WireGuard overlay network (a "tailnet") across your devices. Once your server and laptop are on the same tailnet, they can reach each other's Tailscale IPs directly — as if they were on the same LAN. The public internet sees encrypted WireGuard traffic; your SSH session is never exposed.

For remote coding sessions running AI coding agents, this matters. Agents run for 20–45+ minutes, and per Anthropic's agent autonomy research, the 99.9th percentile Claude Code turn duration exceeded 45 minutes as of early 2026. You want remote access that's both reliable and not a security liability.

Part 1: Tailscale setup

Step 1: Create a Tailscale account

Sign up at tailscale.com. The free personal plan supports up to 100 devices and 3 users — more than enough for this setup.

Step 2: Install Tailscale on the server (Ubuntu)

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The terminal prints a URL. Visit it to authenticate the device to your tailnet.

Step 3: Install Tailscale on your laptop

macOS:

brew install tailscale
# Or download from tailscale.com

Authenticate the same way — visit the URL shown after tailscale up.

Step 4: Verify both devices are on the tailnet

On the server:

tailscale status

You should see both the server and your laptop listed with their Tailscale IPs (100.x.x.x format). Note the server's Tailscale IP — you'll use it for SSH.

Part 2: SSH over Tailscale

# Instead of: ssh user@public-ip
# Use:
ssh user@100.x.x.x

The connection goes through the private tailnet — no public ports involved.

Optional: close the public SSH port entirely

sudo ufw deny 22
sudo ufw allow in on tailscale0
sudo ufw enable

This blocks public SSH but allows all Tailscale traffic. Your server is now only accessible from devices on your tailnet.

Alternative: use Tailscale's SSH feature

Tailscale has a built-in SSH mode that replaces traditional SSH keys with Tailscale identity:

sudo tailscale up --ssh

With this enabled, ssh user@100.x.x.x uses Tailscale's authentication — no SSH key management required. See Tailscale SSH documentation for the full setup.

Part 3: Running Claude Code over Tailscale

# SSH in via Tailscale
ssh user@100.x.x.x

# Start a tmux session
tmux new -s claude

# Navigate to project and start Claude Code
cd ~/project
claude

# Detach
# Ctrl+B D

# Close SSH — Claude Code keeps running in tmux

Reconnect:

ssh user@100.x.x.x
tmux attach -t claude

If Claude Code exited, resume from transcript:

claude --continue

See the Claude Code CLI reference for session management options.

Connecting Grass to Claude Code over Tailscale

Once Tailscale is running on the server and your phone, Grass can connect to Claude Code without a terminal.

Step 1: Install Tailscale on your phone

• iOS: App Store
• Android: Google Play Store

Sign in with the same Tailscale account as your server. Verify the phone appears in tailscale status on the server.

Step 2: Install the Grass CLI on the server

npm install -g @grass-ai/ide

Step 3: Start Grass with the Tailscale network option

In the project directory (or a second tmux window):

grass start --network tailscale

Grass reads the server's Tailscale IP automatically and generates a QR code encoding the connection URL over the tailnet.

Step 4: Scan from the Grass app

Open the Grass iOS app (or Android PWA), tap the scan button, scan the QR code. The server is saved as a connection.

What you get: Mobile coding agent access to Claude Code — live output streaming, native permission modals for agent approval gates, file browser, diff viewer, and prompt input. No SSH client, no terminal, no public ports exposed. The connection runs entirely over the private Tailscale network.

Is Tailscale free for personal Claude Code use?

Yes. Tailscale's free personal plan supports up to 100 devices and 3 users. For a typical developer setup — server, laptop, phone — that's well within the limit. No credit card required to start.

Frequently asked questions

How do I set up Tailscale on a Linux server?

Run curl -fsSL https://tailscale.com/install.sh | sh && sudo tailscale up. Visit the authentication URL shown in the terminal. The server joins your tailnet and gets a private IP in the 100.x.x.x range.

How do I SSH over Tailscale?

Instead of ssh user@public-ip, use ssh user@tailscale-ip where the Tailscale IP is visible in tailscale status. No firewall changes required — Tailscale handles the routing.

Is Tailscale free for personal Claude Code use?

Yes. Tailscale's free plan covers up to 100 devices and 3 users — sufficient for any personal developer setup. Sign up at tailscale.com, no credit card required for the free tier.

How do I access my home machine running Claude Code from outside my network?

Install Tailscale on your home machine and your travel device (laptop or phone). Once both are on the tailnet, SSH to the home machine's Tailscale IP from anywhere. No router port forwarding, no dynamic DNS, no public IP management needed.

Do I need to open firewall ports to use Tailscale with Claude Code?

No. Tailscale handles NAT traversal — you don't need to open any ports on the server's firewall. In fact, you can close port 22 on the public interface and rely entirely on Tailscale for SSH access, which is a better security posture.

What is the difference between Tailscale and a VPN for remote Claude Code access?

A traditional VPN routes all traffic through a central gateway — it's a hub-and-spoke model. Tailscale is peer-to-peer: your devices connect directly to each other over WireGuard, without traffic bouncing through a central server. This means lower latency for SSH and Grass connections. Tailscale also handles key distribution automatically; traditional VPNs require manual certificate management.

How do I connect Grass to Claude Code over Tailscale?

Install Tailscale on both the server and your phone (same account). Install Grass on the server: npm install -g @grass-ai/ide. Run grass start --network tailscale in the project directory. Scan the QR code from the Grass app. The connection uses the server's Tailscale IP — private, no public ports required.