Tailscale on Umbrel: Remote Access, Immich Backups, and Your Own VPN

This write-up follows the video walkthrough step by step. You'll install Tailscale on Umbrel, connect your phone and laptop, access your dashboard over mobile data, point Immich at your home server, and optionally enable Umbrel as a VPN exit node for safer browsing on public Wi-Fi.

What You Can Do With This Setup

• Remote Umbrel access: Open your Umbrel dashboard from a laptop or phone anywhere in the world.
• Home cloud backups: Run Immich (photos/videos) or Nextcloud (broader file sync) against your Umbrel over Tailscale.
• Personal VPN exit node: Route phone or laptop traffic through your home connection on sketchy public Wi-Fi - similar to a commercial VPN, but you control the server.
• Bitcoin node access: Reach services on your home network without exposing ports to the open internet.

Step 1: Install Tailscale on Umbrel

1. On your Umbrel, open the App Store and search for Tailscale.
2. Install the app and open it.
3. Press Login - this opens the Tailscale sign-in page in your browser.
4. Sign in with Google, GitHub, Microsoft, or another supported provider (I used GitHub in the video).
5. When prompted, approve connecting your Umbrel machine to your tailnet.

Back in the Umbrel Tailscale app you should see your node connected. Exit nodes will show as none until you configure that later.

Step 2: Add Client Devices

Visit login.tailscale.com to see your machines. The free tier is enough for personal use. Your Umbrel should appear in the device list with a 100.x.x.x Tailscale IP.

Install the Tailscale client on every device you want on the tailnet:

• Windows/Mac/Linux: Download from tailscale.com/download and sign in with the same account.
• Phone: Install Tailscale from the App Store or Google Play, open it, and connect with the same login.

If the Windows installer does not auto-prompt, open Tailscale from the system tray (hidden icons area) and complete login there.

Once connected, your admin console should list Umbrel, desktop, and phone - each with a connected status you can toggle on or off.

Step 3: Access Umbrel Remotely

1. In the Umbrel Tailscale app, copy the machine's 100.x address.
2. On a remote device with Tailscale enabled, paste that address into your browser.
3. You should land on your Umbrel login - even when you are not on your home LAN.

In the video I tested this on mobile data (not home Wi-Fi) and confirmed the dashboard loads. Traffic is encrypted through the Tailscale tunnel the whole way. That is your proof the remote path works.

Step 4: Connect Immich to Umbrel Over Tailscale

Immich is a self-hosted Google Photos alternative. To back up photos to your Umbrel instance while away from home:

1. On Umbrel, open the Immich app and copy its service URL (the address shown in the Umbrel app details).
2. On your phone, open the Immich app and sign out if already logged in.
3. Set Server endpoint to that Umbrel Immich URL (reachable because Tailscale is on).
4. Log in with your Immich credentials.
5. Take a test photo - you should see it queue to sync (e.g. "1 remaining") and upload to your home server.

The same pattern works for Nextcloud if you want broader file sync beyond photos and videos - install Nextcloud on Umbrel, grab its URL, and point the Nextcloud client at it while Tailscale is connected.

Step 5: Use Umbrel as a VPN Exit Node (Optional)

An exit node routes all internet traffic from your phone or laptop through your home Umbrel, then out through your home router. That is useful on airport or café Wi-Fi: encrypted tunnel to home, then normal egress from your trusted connection.

Enable exit node on Umbrel

1. Open Tailscale on your Umbrel instance.
2. Toggle Run as exit node.
3. Go to login.tailscale.com/admin/machines.
4. Find your Umbrel machine, open the three-dot menu → Edit route settings.
5. Enable Use as exit node and save.

Use the exit node on phone or laptop

In the Tailscale client on your remote device, select your Umbrel machine as the active exit node. While connected, browsing and apps route through home. Turn it off when you do not need it - your normal internet path is faster for everyday use when you are already on a trusted network.

This does not replace good security hygiene (HTTPS, updated apps, etc.), but it does reduce exposure to local network snooping on public Wi-Fi by keeping traffic encrypted to your home server first.

Quick Reference

• Same login everywhere: Umbrel, laptop, and phone must use the same Tailscale account.
• 100.x addresses: Use the Tailscale IP from the Umbrel app for remote browser access.
• Toggle connection: Tailscale can be switched on/off per device from the app or system tray.
• Free tier: Personal tailnets are free for typical home use; check Tailscale's current limits if you add many devices.

Security Notes

Tailscale avoids punching holes in your router firewall for every service - a big win over naive port forwarding. Still treat your tailnet like privileged access: use strong Tailscale account security (2FA on your Google/GitHub login), keep Umbrel updated, and only enable exit-node routing when you need it.

If you are also running a Bitcoin node on Umbrel, Tailscale lets you reach wallet and node tools remotely without exposing them publicly - pair that with proper wallet security and backups.

Watch the full tutorial: Tailscale on Umbrel (YouTube).