Tailscale SSH: reach your dev machine from your phone

What Tailscale and Tailscale SSH are, how to set them up on Linux, macOS or Windows, connect from iPhone or Android, write access rules, and keep sessions alive with tmux.

7 minutes Matěj Žalmánek 2026-10-26

Your dev machine is at home, behind a router, with an address that changes. You are somewhere else with a phone. Port forwarding is risky, a classic VPN is work. Tailscale makes the two devices see each other as if they were on the same network, and Tailscale SSH lets you log in without managing SSH keys. Here is how to set it up and reach your computer's terminal from your phone in about ten minutes.

1. What is Tailscale

Tailscale is a mesh VPN built on WireGuard. Every device you sign in joins your private network — a tailnet — and gets a stable address (100.x.y.z) and a name. Devices connect to each other directly where possible, through NAT and firewalls, without opening ports on your router.

The free Personal plan covers up to 6 users with unlimited personal devices, and includes basic Tailscale SSH for a limited number of hosts — plenty for one developer. (Plans change; check tailscale.com/pricing.)

2. What Tailscale SSH adds

You can use plain SSH over Tailscale — your normal sshd and keys, just reachable from anywhere. Tailscale SSH goes one step further: the Tailscale daemon itself answers SSH connections that arrive over the tailnet and decides who may log in based on your Tailscale identity, not on SSH keys.

no authorized_keys to copy to every device;
host keys are distributed automatically;
access is controlled centrally in your tailnet policy;
optional check mode asks you to re-authenticate (with your identity provider's MFA) before a session.

It does not touch your sshd_config or authorized_keys, so ordinary SSH keeps working alongside it.

3. Set up Tailscale SSH on your dev machine

Install Tailscale on the computer and sign in.
Turn on Tailscale SSH — once per machine:
```
sudo tailscale set --ssh
```
Check the machine is online and note its name:
```
tailscale status
```

Which systems can be the SSH server: Linux, and macOS only with the open-source tailscale + tailscaled command-line variant. The App Store and standalone Mac apps cannot act as a Tailscale SSH server — on those, enable macOS Remote Login and use ordinary SSH over the Tailscale address instead. The same works on Windows with the OpenSSH server.

4. Connect from your phone

Install the Tailscale app on the phone and sign in to the same tailnet.
Install an SSH client — Termius (iOS and Android), Blink Shell (iOS), or Termux on Android.

Connect to the machine's name or Tailscale IP:

ssh you@dev-machine
# or
ssh you@100.101.102.103

Tailscale SSH always uses port 22. If your client insists on a password even though Tailscale SSH does not need one, the Tailscale docs suggest appending +password to the user name and typing anything.

5. Access rules: who can SSH where

Your tailnet policy must allow both the network connection and SSH. A rule in the ssh section looks like this:

"ssh": [
  {
    "action": "check",
    "src": ["autogroup:member"],
    "dst": ["autogroup:self"],
    "users": ["autogroup:nonroot"]
  }
]

This lets members SSH into their own devices as any non-root user. "accept" lets an already signed-in user straight in; "check" asks for a fresh sign-in, by default every 12 hours. For a machine with your code and credentials on it, check is worth the extra tap.

6. Keep sessions alive with tmux

Phone SSH clients drop the connection as soon as the app goes to the background. Run your work inside tmux on the computer and reattach when you come back:

tmux new -s work      # first time
tmux attach -t work   # every time after

That is also how people run AI coding agents “from the phone” over SSH: the agent lives in a tmux session on the computer, the phone just attaches to it.

7. Is a terminal on your phone enough?

For restarting a server, checking a log or running a quick command — yes, and Tailscale SSH is one of the cleanest ways to do it. For real work, the limits show quickly:

a six-inch terminal is hard to read, and diffs even more so;
the soft keyboard covers half the screen;
nothing notifies you when a long command finishes or a program waits for input.

If what you want is to steer an AI coding agent from your phone, an app built for that fits better than a terminal. We compared the options in Claude Code on mobile; our own, coden, finds your computer behind NAT without a VPN and gives you notifications, approvals, diffs and test results instead of a raw terminal.

Do you see it differently? Write to support@coden-app.com.