Reach your Mac from anywhere with Tailscale and Screen Sharing

By Frank Gasparovic · November 12, 2026

Screen Sharing on the Mac works great on your own Wi-Fi and not at all once you leave the house. That's on purpose. It only listens on your local network, and you really don't want to change that by forwarding a port on your router, because then anyone on the internet can knock on it.

Tailscale is the fix I use. It puts your Mac and your iPhone on a small private network of their own, wherever they are, so the phone can reach the Mac the same way it does at home. It's free for personal use, there's no port forwarding, and it takes about ten minutes to set up. Here's the whole thing, including the two gotchas that catch most people the first time they're actually away.

What you need

A Mac running macOS 13 Ventura or later (Tailscale's minimum) with Screen Sharing turned on.
An iPhone or iPad with the Tailscale app and a Screen Sharing client. I build Twinpane, so that's what I'll show, but any client that connects to the Mac's built-in Screen Sharing will work the same way over Tailscale.
A free Tailscale account. As of November 2026 the Personal plan is free for non-commercial use and covers up to 6 users with unlimited devices (tailscale.com/pricing).

1. Turn on Screen Sharing

On the Mac, open System Settings › General › Sharing and turn on Screen Sharing. Click the ⓘ next to it and make sure your user is allowed. If Screen Sharing is greyed out, Remote Management is on in the same list, and that already includes screen sharing.

Try it at home first. If you can't connect on the same Wi-Fi, Tailscale won't fix that, and it's much easier to sort out with the Mac in front of you. My step-by-step for the home setup covers it.

2. Put Tailscale on the Mac

Tailscale has three versions for the Mac, and which one you pick matters later. Their own comparison page (checked November 12, 2026) lists:

Standalone app from Tailscale's site. This is the one they recommend.
Mac App Store app. Same idea, sandboxed.
tailscaled, the open-source command-line version with no menu bar app.

For most people the Standalone app is the right call. Install it, sign in, and approve the system extension and VPN prompts macOS shows you. When it's connected, the Mac shows up in the Tailscale menu with a name like studio, and a full name like studio.your-tailnet.ts.net. That's MagicDNS, and it's on by default for any tailnet made since October 2022, so you can connect by name instead of remembering an IP address.

3. Put Tailscale on the iPhone

Install Tailscale from the App Store, sign in with the same account, and turn it on. iOS will ask to add a VPN configuration. That's how Tailscale works on the phone, it isn't routing all your traffic somewhere, it just adds a route to your own devices.

Now the phone can reach the Mac from anywhere: hotel Wi-Fi, cellular, a coffee shop. To check, turn off Wi-Fi on the phone and open the Tailscale app. The Mac should be listed as connected.

4. Connect with Screen Sharing

In your Screen Sharing client, add a Mac using its Tailscale name (studio or the full .ts.net name) and sign in with your Mac's user name and password, the same as at home. That's it. You're on your desktop over cellular.

In Twinpane there's a shortcut. Go to Settings › Tailscale and paste a Tailscale API access token, which you make in the Tailscale admin console under Settings › Keys. The Macs in your tailnet then show up on the home screen, ready to add with a tap, and you can see which ones are online. Tailscale makes those tokens expire after 1 to 90 days (you pick), so when it runs out, make a new one and tap Update Token.

Gotcha 1: the Mac has to stay awake

A sleeping Mac isn't on your tailnet. Wake for network access (under System Settings › Energy on a desktop Mac) is worth turning on, but it works through your local network, so don't count on it to wake the Mac for a connection coming in over Tailscale.

If you'll need the Mac while you're away, keep it from sleeping. On a desktop Mac, turn on Prevent automatic sleeping when the display is off in the same Energy settings. The display can still turn off, which is fine, Screen Sharing doesn't need it. On a laptop, leave it plugged in with the lid open, or plan around it.

Gotcha 2: after a reboot, nothing connects until someone logs in

This is the one that bites people on a trip. A macOS update or a power cut restarts the Mac, and suddenly you can't reach it. Two separate things are going on.

FileVault. If FileVault is on (it usually is on newer Macs), a restarted Mac waits at a startup unlock screen before macOS has really started. No networking, no Screen Sharing, no Tailscale. Somebody has to type the password on the Mac itself.

Tailscale's app only runs once you're logged in. Tailscale's own comparison table says neither the Standalone nor the App Store version runs before login. So even without FileVault, a Mac sitting at the login window isn't on your tailnet. Only the tailscaled command-line version runs before login, and Tailscale only recommends it for experienced Mac admins doing unattended installs. If you go that route, don't also install one of the apps on the same Mac.

What I'd actually do before a trip:

Install pending macOS updates before you leave, so the Mac doesn't restart itself while you're gone.
If it's a desktop Mac, put it on a small UPS so a short power blip doesn't reboot it.
Have a plan B for a reboot, like someone at home who can type the password.

A locked screen is a different story, by the way. If the Mac is logged in and just locked, Tailscale is still running and Screen Sharing connects fine. You'll see the lock screen and can type the password there. Twinpane can do that part for you, unlocking from the password in your Keychain, behind Face ID if you want.

Gotcha 3: Tailscale keys expire

Every device on a tailnet has a key, and by default those expire after 180 days. When the Mac's key runs out, it drops off your tailnet until you log it in again, which is a hassle from 2,000 miles away. For a Mac you want to reach remotely, open the Machines page in the Tailscale admin console, click the menu at the end of the Mac's row and choose Disable Key Expiry (Tailscale's docs on key expiry).

Why not just forward the port?

Screen Sharing speaks VNC on port 5900, and that port gets scanned nonstop on the open internet. Even with a strong password you're relying on one login prompt to hold off everyone. With Tailscale the Mac is only reachable from your own devices, and nothing on your router changes. If you'd rather not use Tailscale, an SSH tunnel is the other safe option (turn on Remote Login in the same Sharing settings). Twinpane supports both.

Twinpane is free to download with a 7-day free trial, then $2.99 a month in the US. It lists the Macs in your tailnet for you, and there's nothing to install on the Mac.