6. Access From Anywhere

The problem

On the same Wi-Fi, Your-MacBook.local works. Away from home it doesn't: your home router doesn't accept incoming connections, and your Mac's address isn't reachable from the internet.

Why a normal privacy VPN doesn't solve this

Consumer VPNs (ExpressVPN, NordVPN, Surfshark, ...) send each device's traffic to their servers to hide your IP. Your iPhone and Mac both reach the internet, but they still can't reach each other.

You need a mesh VPN, which connects your own devices privately. Keep your privacy VPN too; they solve different problems.

Options compared

Tailscale wins for this use case: no router changes, a stable IP per device, WireGuard encryption, and it works through almost any network.

Tailscale setup

Step 1: Account

Sign up at https://tailscale.com with Google, GitHub or Microsoft.

Step 2: Mac

brew install --cask tailscale

Open the Tailscale app from Applications, sign in, and allow the VPN configuration.

Get the Mac's addresses:

/Applications/Tailscale.app/Contents/MacOS/Tailscale ip -4      # 100.x.x.x
/Applications/Tailscale.app/Contents/MacOS/Tailscale status

(If you installed the CLI separately, plain tailscale ip -4 works.)

Also available in the Tailscale menu bar icon. With MagicDNS on (default), you can use the machine name, e.g. your-macbook.

Step 3: iPhone

App Store → Tailscale → sign in with the same account → allow the VPN profile → toggle Connected.

Step 4: Point Termius at Tailscale

Edit the host in Termius: - Hostname: the Mac's 100.x.x.x address (or MagicDNS name)

Or keep two hosts: Mac (home) with .local, Mac (anywhere) with the Tailscale address.

Step 5: Test away from home

1. Turn off Wi-Fi on the iPhone (cellular only)
2. Tailscale on
3. Connect in Termius → ts03-health

✅ Works on cellular = works anywhere.

Using Tailscale alongside ExpressVPN (or similar)

iPhone: iOS runs one VPN at a time. Switch as needed: - Need your Mac → Tailscale on (privacy VPN off) - Browsing on public Wi-Fi → privacy VPN on

A Shortcut can flip both in one tap: Shortcuts → Set VPN (Tailscale → Connect) + Set VPN (ExpressVPN → Disconnect). Name it "Mac mode".

Mac: both can usually run together. If Tailscale stops reaching devices while the privacy VPN is on, exclude Tailscale's range (100.64.0.0/10) or the Tailscale app via the privacy VPN's split-tunnelling settings.

Keep the Mac reachable

SSH fails if the Mac is asleep.

System Settings → Battery → Options (wording varies by macOS version): - Prevent automatic sleeping on power adapter when the display is off: ON - Wake for network access: ON

Keep awake on demand: - Amphetamine (free, Mac App Store): start an indefinite session, allow the display to sleep. - Built-in caffeinate: bash caffeinate -dimsu & # until you kill it or log out

Laptops: a closed lid on battery sleeps. Leave it plugged in, lid open, or use an external display setup.

Security notes

• Every device joins by signing in to your Tailscale account.
• Traffic is end-to-end encrypted (WireGuard).
• Lost phone: Tailscale admin console → Machines → remove it. Access ends immediately.
• Keep SSH key-only (Guide 5, hardening). Tailscale adds a network layer; it doesn't replace SSH auth.
• Only add devices you own. For friends, share the sheet, not your Mac (Guide 9).

➡️ Next: 7. Troubleshooting