WireGuard on the router or Tailscale: why I ended up using both

I wanted to reach the 3D printer dashboard, the Raspberry Pi dashboard and my passwords from outside home. The rule I set was clear: no service port open to the Internet. Everything over VPN.

There are two very popular routes, and I ended up using both, each for its own purpose.

Option 1: WireGuard on the router itself

Many modern routers include a VPN server. Mine, a FRITZ!Box, includes WireGuard, which is fast, modern and built into the Linux kernel.

The idea: your phone connects to the router and, for all practical purposes, it’s inside your home network. Everything works just like on the sofa: local IPs, dashboards, the printer app in local mode…

First things first: do you have a public IP?

For your phone to reach the router from the Internet, the router needs a public IPv4. Many ISPs put customers behind CG-NAT: several homes share one public IP and none of them can be reached from outside.

How to check:

1. Look at the Internet IP your router reports (in its admin panel).
2. Look at the IP you see from outside (any “what’s my IP” website).
3. If they match, you have a public IP.
4. If they don’t, or the router’s starts with 100.64 to 100.127, you’re behind CG-NAT.

In Spain, if you’re behind CG-NAT, you can ask your ISP for a public IPv4; they usually give it for free. Check what applies in your country.

A fixed name

Your public IP also changes from time to time. If you set up the tunnel with today’s IP, it will stop working tomorrow. You need a name that always points to your current IP. On a FRITZ!Box that’s MyFRITZ!, which is included. On other routers it’s called dynamic DNS (DDNS).

Setting it up on a FRITZ!Box

1. Go to http://fritz.box → Internet → Permit Access → VPN (WireGuard) tab.
2. Add connection → Connect a single device.
3. Name the device and a QR code appears.
4. On your phone, WireGuard app → + → Scan from QR code.
5. If it asks which traffic to route, choose home network only.

Step 5 matters: your phone keeps browsing over its normal connection and only home-bound traffic goes through the tunnel. Faster and uses less battery.

Option 2: Tailscale

Tailscale also uses WireGuard underneath, but differently: instead of connecting to the router, you install Tailscale on each device (phone, PC, Pi) and they connect to each other in a private network.

Its advantages:

• Works behind CG-NAT. No public IP needed, no router changes.
• Names for each machine, like my-pi.your-net.ts.net.
• Automatic HTTPS certificates with Tailscale Serve. This is why I kept it.

Its downsides:

• It has to be installed on every device. A 3D printer or an old NAS can’t run it.
• You depend on an outside service to coordinate the network, even though traffic goes directly between your devices whenever possible.

Why I use both

Need	What I use
Reach the “whole house” from my phone (printer, router, NAS)	Router WireGuard
The password manager, which requires HTTPS	Tailscale Serve
PC-to-Pi access with a fixed name	Tailscale

My personal preference is the router’s WireGuard: it doesn’t depend on anyone else and covers every device. But for real HTTPS at home without buying a domain or opening ports, Tailscale is unbeatable. To drop it I’d need my own domain and a proxy with a certificate.

Quick decision guide

• Public IP and want to reach everything? WireGuard on the router.
• Behind CG-NAT or can’t touch the router? Tailscale.
• Need HTTPS for a home service? Tailscale Serve.
• Never open service ports? Both let you do that. That’s the important part.