How to Access Your PC Remotely with Tailscale

Tailscale can connect two devices through a private tailnet so Windows Remote Desktop can use a Tailscale IP address or approved name without forwarding TCP port 3389 from the public internet. Tailscale provides the network path; Windows edition, Remote Desktop settings, user permissions, firewall rules, and tailnet access controls still determine whether the session works.

Check the Windows host requirements

The computer you connect to must support hosting Remote Desktop. Microsoft’s current Windows guidance lists supported professional editions for the host; Windows Home can use a Remote Desktop client but does not provide the built-in RDP host. The host account must also be permitted to sign in remotely.

Install Tailscale on both devices

1. Install the official Tailscale client on the host and client devices.
2. Sign both into the intended tailnet.
3. Confirm both appear in the Tailscale admin console or client device list.
4. Note the host’s Tailscale IP address or MagicDNS name.

On a managed tailnet, device approval, key expiry, tags, grants, or access-control rules may require an administrator.

Confirm Tailscale connectivity before troubleshooting RDP

From the client, verify that the host is online. If the Tailscale CLI is available, a targeted check can help:

tailscale status
tailscale ping HOSTNAME-OR-TAILSCALE-IP

If this fails, fix the tailnet connection, device approval, login, access policy, or local network first. Changing Windows Remote Desktop settings will not repair a missing Tailscale path.

Enable Remote Desktop on the host

1. On the host, open Settings > System > Remote Desktop.
2. Turn on Remote Desktop and review the confirmation.
3. Open the user-selection control if a non-administrator account needs access.
4. Keep the host awake and connected when remote access is required.

Use a strong account password and follow the organization’s sign-in policy. A Windows Hello PIN used locally is not automatically the credential another RDP client expects.

Connect through the private Tailscale address

Open the Windows Remote Desktop client on the client device and enter the host’s Tailscale IP address or approved MagicDNS name. Use the authorized Windows account for the host.

Separate the common failure types

Review tailnet access instead of allowing everyone

A small personal tailnet may allow devices broadly by default, while an organizational tailnet can use grants or access rules. Limit RDP access to the users and devices that need it. Do not weaken a managed policy to solve a single connection without administrator review.

Windows firewall and third-party security

Enabling Remote Desktop normally configures required Windows rules, but third-party firewalls or security products can still block the session. Test narrowly and restore protections after comparison. Do not disable the firewall permanently.

When to stop and ask an administrator

• The device is company- or school-managed.
• Domain authentication or Kerberos restrictions are involved.
• Remote Desktop controls are locked.
• The tailnet uses centrally managed grants, tags, or device approval.
• Security software reports the connection as blocked by policy.

Completion checklist

• Both devices show online in the intended tailnet.
• The client can reach the host over Tailscale.
• The host supports and enables Remote Desktop.
• The specific user is authorized.
• No public RDP port forwarding is required.
• The connection works after a host restart and normal sleep/wake policy is understood.

Official references

• Access remote desktops using Windows RDP — Tailscale
• Install Tailscale on Windows
• How to use Remote Desktop — Microsoft Support