Transparency note: This article is based on my own professional deployments and currently contains no paid or affiliate links. If that changes, this notice and the affiliate disclosure will say so.
Starlink has been a genuine breakthrough for the remote sites I manage — places where fibre will not arrive for years and mobile data is too unreliable to run a business on. But the first time you try to reach a Starlink site from outside — an RDP session, a camera NVR, a file server — you discover the catch: you cannot connect in.
Why you can’t reach a Starlink site from outside
Standard Starlink plans put you behind carrier-grade NAT (CGNAT). Your dish shares a public IP address with many other customers, that address changes without notice, and there is no port forwarding — the Starlink app simply has no such setting.
Everything that depends on inbound connections breaks: remote desktop and SSH into the site, NVR and camera mobile apps, a self-hosted VPN server waiting for incoming tunnels, and dynamic DNS — which is pointless here, because the public IP was never yours to begin with.
The classic fixes don’t work here
Port forwarding: impossible on CGNAT. Dynamic DNS: tracks an address that dozens of other customers share. A real public IP: Starlink reserves that for its Priority plans, which are hard to justify for a small organization that just needs administrative access to its own equipment.
How Tailscale gets through
Tailscale sidesteps the problem instead of fighting it: both ends dial outward. Your laptop and the machine at the Starlink site each make outbound connections; Tailscale’s coordination service introduces them, NAT traversal punches a direct, end-to-end encrypted WireGuard tunnel between them, and when CGNAT is too strict for a direct path, traffic falls back to Tailscale’s DERP relays — higher latency, but the connection always establishes.
No ports opened. No static IP. No changes on the Starlink router — there is nothing to change.
What this looks like in a real deployment
In the multi-site networks I manage — including healthcare sites where Starlink is the only viable uplink — the pattern is consistent. Devices join the tailnet and become reachable by name within minutes. Sessions survive Starlink’s IP changes, because access is tied to device identity rather than to an address. And when the direct path fails, the relay keeps backups and monitoring alive at the cost of some latency — degraded is very different from down.
Setting it up (about 15 minutes)
Install Tailscale on the machine at the Starlink site and on your own laptop, and sign both into the same tailnet. That is genuinely the whole basic setup — they see each other immediately.
For devices that cannot run the client (NVRs, printers, controllers), make one machine at the site a subnet router:
tailscale up --advertise-routes=192.168.1.0/24
Then approve the route in the admin console, and the whole site LAN becomes reachable through that one machine.
Before handing access to anyone else, lock it down: ACLs so each user reaches only the devices they need, and key expiry so a lost laptop ages out of the network on its own.
Costs and limits, honestly
The free Personal plan covers up to six users — genuinely enough for many small organizations. Beyond that it is seat-based: Standard at $8 per user per month, Premium at $18. The trade-offs are real: you depend on Tailscale’s coordination service being up, relayed traffic adds latency when direct traversal fails, and per-seat pricing grows with headcount.
If those trade-offs bother you and you want full control, the alternative is self-hosting a WireGuard hub on a small VPS. I compare both approaches — including when paying for Tailscale is the smarter call — in WireGuard vs Tailscale for Small Business.
Frequently asked questions
Do I need port forwarding on Starlink for Tailscale? No — that is the entire point. Every connection is outbound; there is nothing to open.
Will connections break when Starlink changes my IP address? No. Access follows device identity, not addresses, so IP changes are invisible to your sessions.
Can Tailscale read my traffic when it goes through a relay? No. Encryption is end-to-end WireGuard; DERP relays forward ciphertext they cannot decrypt.
Is the free plan enough for a small business? For up to six users, yes — and the tools behind this site are listed, with their limitations, on the Tools page.