What you're setting up

Tailscale builds a private network between your devices. Each one gets a stable address in the 100.x.y.z range and a name, and traffic between them is encrypted end to end with WireGuard. Your computer never gets a public port; the phone reaches it because both are on the same private network, wherever they physically are. SSH then runs over that link exactly as it would at home.

1. Install Tailscale on the computer

Mac: install from the Tailscale site or the Mac App Store, open it, sign in, and allow the VPN configuration when macOS asks. The menu bar icon shows your Mac's Tailscale address.

Linux: curl -fsSL https://tailscale.com/install.sh | sh, then sudo tailscale up. It prints a sign-in link; open it on any device. tailscale ip -4 shows the address afterwards.

2. Turn on SSH

Mac: System Settings › General › Sharing › Remote Login. Turn it on and, under the info button, make sure your user is allowed. That's Apple's built-in OpenSSH server.

Linux: most servers already run it. On a desktop: sudo apt install openssh-server (Debian, Ubuntu) or the equivalent for your distribution.

Check from the computer itself: ssh localhost should ask for a password or key, not refuse the connection.

3. Install Tailscale on the phone

Install the Tailscale app for iOS or Android, sign in with the same account, and turn the connection on. Your computer should now appear in the phone's device list with its address.

4. Use a key, not a password

Passwords over SSH work but are the wrong default: they're phishable, and Macs will happily accept a weak login password. Keys are better, and the private half should never leave the phone.

Good SSH apps generate a key on the phone. You then add its public half to the computer, in ~/.ssh/authorized_keys. The manual way, from a terminal on the computer:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'ssh-ed25519 AAAA… melta-iphone' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Replace the quoted line with the public key your phone app shows. Permissions matter: SSH ignores the file if it's writable by other users. Melta's setup command does this step for you and prints the address to enter.

Alternative: Tailscale SSH. On Linux, sudo tailscale set --ssh lets Tailscale handle authentication itself, with no keys to manage; access is controlled from the Tailscale admin console. Per Tailscale's docs it's supported on Linux and on macOS only with the open-source command-line build, not the App Store app, so most Mac users stick with keys.

5. Connect

In your SSH app, add the computer with its Tailscale address (100.x.y.z) or, better, its name. Tailscale's MagicDNS is on by default for new networks, so ssh alex@macbook works as well as the IP and keeps working if the address ever changes. User name is your login name on the computer; whoami prints it.

The first connection shows the computer's host key fingerprint and asks you to trust it. That's normal. If it ever asks again for the same computer, stop and check: either the computer was reinstalled or something is in the middle.

6. Keep the computer reachable

  • Sleep. A sleeping Mac disappears from the network and nothing can wake it remotely. Turn on Prevent automatic sleeping on power adapter when the display is off (System Settings › Battery › Options on a laptop, or Energy on a desktop; under Displays › Advanced on Ventura) and keep it plugged in. Linux desktops: disable suspend in power settings. More in how to keep a Mac awake for SSH.
  • Tailscale must be running on both ends. On the Mac it starts at login; on Linux tailscaled runs as a service.
  • Keep a multiplexer (tmux or Herdr) between you and long-running work, so a dropped phone connection never kills anything. See tmux vs Herdr.

Common questions

Can you SSH from an iPhone to a Mac? Yes. The Mac needs Remote Login on and Tailscale running; the iPhone needs Tailscale and any SSH app. Same for Android.

Does this work for a Raspberry Pi or a Linux server? Yes, identically: install Tailscale and openssh-server on it. Tailscale has a package for Raspberry Pi OS.

Do I need port forwarding or a static IP? No. Tailscale connects the devices directly without opening anything on your router.

Troubleshooting

Connection refused. SSH isn't running (Remote Login off) or you have the wrong port. Timed out. Tailscale is off on one side, or the computer is asleep. Permission denied (publickey). The key isn't in authorized_keys, the file's permissions are wrong, or the user name is wrong. Host key changed. See above. The full list is in Fix SSH from your phone.

Sources