For most Raspberry Pi owners, Tailscale is the easiest way to reach a Pi from outside the home, while plain OpenSSH is still the best choice on a trusted local network. OpenSSH is built in, fast, and standard. Tailscale adds private remote access without router changes, port forwarding, or exposing SSH to the public internet.

TLDR: OpenSSH works well when the Raspberry Pi and laptop are on the same Wi Fi network, such as ssh pi@raspberrypi.local. Tailscale is better when the Pi sits at home and the user is 20 miles away at work, because it creates a secure private network between devices. In many home setups, Tailscale can cut remote setup time from 30 minutes of router fiddling to under 10 minutes. The catch is that it adds another account and service to manage.

What SSH access means on a Raspberry Pi

SSH lets a person control a Raspberry Pi from another computer through a terminal. It is used to update packages, restart services, edit files, run Python scripts, check logs, and manage self hosted tools. No monitor, keyboard, or mouse is needed once SSH is working.

On Raspberry Pi OS, the SSH server is usually OpenSSH. It listens for login requests and gives a remote shell after authentication. Tailscale does not replace SSH itself in most setups. Instead, it creates a private network path so an SSH connection can reach the Pi safely from almost anywhere.

Option 1: SSH with OpenSSH on the local network

OpenSSH is the classic method. It is free, trusted, and widely documented. For a Raspberry Pi on the same LAN as the admin’s laptop, it is usually the cleanest answer.

SSH can be enabled from the Raspberry Pi desktop under Preferences > Raspberry Pi Configuration > Interfaces. It can also be enabled from the terminal:

sudo systemctl enable ssh
sudo systemctl start ssh

After that, the admin can connect with:

ssh username@raspberrypi.local

If local name resolution does not work, the Pi’s IP address can be used instead:

ssh username@192.168.1.42

Honestly, it feels like local hostnames fail at the worst possible moment. One laptop finds raspberrypi.local in two seconds. Another sits there for 20 seconds, then gives up. In that case, checking the router’s client list or running a network scanner is often faster.

OpenSSH strengths

  • Simple on a LAN: No outside account is needed.
  • Fast: Traffic stays inside the local network.
  • Standard: It works with Linux, macOS, Windows Terminal, PuTTY, VS Code, and many admin tools.
  • Script friendly: Backups, deployments, and cron jobs work well over SSH.

OpenSSH weaknesses

  • Remote access is harder: A user usually needs port forwarding, a VPN, or another tunnel.
  • Public SSH can attract bots: An open port 22 on the internet may see login attempts within minutes.
  • Home IP addresses change: Dynamic DNS may be needed for access from outside.

Making OpenSSH safer

If OpenSSH is used beyond the local network, security matters. Password login should be avoided where possible. SSH keys are better because they are harder to guess and easier to restrict.

A key can be created on the client machine:

ssh-keygen -t ed25519

The public key can then be copied to the Pi:

ssh-copy-id username@raspberrypi.local

After key login works, password login can be disabled in /etc/ssh/sshd_config by setting:

PasswordAuthentication no

Then SSH should be restarted:

sudo systemctl restart ssh

Other sensible choices include changing the default username, installing security updates, and using a firewall. These steps are not glamorous, but they prevent a lot of avoidable pain.

Option 2: SSH through Tailscale

Tailscale creates a private mesh network using WireGuard. Each approved device receives a Tailscale IP address. The Raspberry Pi, laptop, phone, and server can act as if they are on the same private network, even when they are in different places.

For a Raspberry Pi, Tailscale is useful because it avoids router port forwarding. That matters for users behind carrier grade NAT, apartment networks, mobile hotspots, or locked down ISP routers. Expect to waste time on those routers. Some hide port forwarding three menus deep, and some never make it work at all.

Tailscale can be installed on Raspberry Pi OS with:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The command prints a login URL. After authentication, the Pi appears in the Tailscale admin panel. The admin can then connect from another Tailscale device:

ssh username@100.x.y.z

Many users prefer Tailscale MagicDNS, which allows a name such as:

ssh username@raspberrypi

Tailscale also has its own SSH feature, called Tailscale SSH. It can manage SSH access through Tailscale identities and access rules. Some teams like this because it reduces key sharing. For a single hobby Pi, classic OpenSSH over the Tailscale IP is often simpler.

Tailscale strengths

  • No open SSH port: The Pi does not need to expose SSH to the public internet.
  • Works away from home: The admin can reach the Pi from a cafe, office, or hotel network.
  • Good for awkward networks: It helps when port forwarding is blocked or unreliable.
  • Device based control: Access can be removed by disabling a device in the Tailscale admin panel.

Tailscale weaknesses

  • Requires a Tailscale account: That may not suit every project.
  • Depends on another service: If login or coordination has trouble, setup can stall.
  • Another layer to debug: SSH, Linux users, keys, Tailscale ACLs, and device approval can all affect access.

OpenSSH vs Tailscale: which one fits?

OpenSSH alone fits best when the Raspberry Pi stays on the same local network as the admin. It is also the right base skill to learn. Almost every Linux server uses SSH, so the knowledge carries over.

Tailscale plus OpenSSH fits best when remote access is needed from outside the home. It is also a strong pick when the user does not control the router. A student in a dorm, a renter with a locked ISP router, or a hobbyist using a 5G modem may have a much easier time with Tailscale.

A practical setup often uses both. OpenSSH runs on the Pi. Tailscale provides the private route. The admin connects through the Tailscale address instead of a public IP. This keeps the workflow familiar while cutting out the mess of router rules.

Image not found in postmeta

Recommended setup for most users

The best general setup is simple: enable OpenSSH, use SSH keys, install Tailscale, and avoid public port forwarding. This gives local access at home and private remote access elsewhere.

  1. Install Raspberry Pi OS and create a regular user.
  2. Enable SSH with sudo systemctl enable --now ssh.
  3. Create an SSH key on the client computer.
  4. Copy the key to the Pi with ssh-copy-id.
  5. Install Tailscale on the Pi and the client device.
  6. Connect over the Pi’s Tailscale IP or MagicDNS name.
  7. Disable password SSH login after key login is confirmed.

For local-only projects, Tailscale is optional. For remote projects, it is usually worth it. A weather station in a shed, a Pi camera at a family member’s house, or a small home server all benefit from private remote access.

FAQ

Can a Raspberry Pi be accessed by SSH without Tailscale?

Yes. OpenSSH works on its own, especially on the same local network. Remote access from outside the network usually needs port forwarding, a VPN, or another secure tunnel.

Is Tailscale a replacement for OpenSSH?

Not usually. Tailscale provides the private network path. OpenSSH still provides the terminal session, unless Tailscale SSH is enabled and configured.

Is it safe to expose SSH to the internet?

It can be done, but it raises risk. Key based login, disabled passwords, updates, firewall rules, and rate limiting are strongly recommended. Many users are better served by Tailscale instead.

Why does raspberrypi.local not work?

Local name discovery can fail because of router settings, client OS behavior, or missing multicast support. Using the Pi’s IP address or Tailscale MagicDNS is often more reliable.

Which is faster, OpenSSH on LAN or SSH through Tailscale?

OpenSSH on the same LAN is usually fastest. Tailscale is still quick enough for terminal work, file edits, service restarts, and common admin tasks.

What is the best choice for beginners?

Beginners should learn basic OpenSSH first, then add Tailscale for remote access. That combination is practical, secure, and less annoying than fighting a home router for port forwarding.