Tailscale vs WireGuard vs StartTunnel vs Tor: reaching your home node from away

A wallet that talks to your own node tells nobody else which addresses are yours. That only holds on the road if the connection to the node is private. Sparrow can connect to a Bitcoin Core node on another machine over RPC with a username and password, and its docs show how to allow a local network range to connect. Never forward that port to the internet.

A private network fixes this. Your phone or laptop joins a tunnel, the node answers only inside it, and the router forwards nothing for RPC or Electrum. StartOS describes the idea as giving authorized devices a key to the doors they need without opening them to the public internet. Signing still happens on the hardware wallet next to your laptop; the tunnel only carries Sparrow's connection to the node. If you have not picked node software yet, start with my Start9 vs Umbrel comparison.

Tailscale builds a private network, called a tailnet, out of your devices using the open WireGuard protocol. Devices connect directly where they can, with no port forwarding. Umbrel's docs recommend Tailscale for most users, and its page walks through installing it on the node and your devices.

Tailscale runs a coordination service. It holds device and network metadata: IP addresses, client versions, operating systems, geographic location, public keys, and endpoint information used to connect devices. Tailscale says it routes no traffic through that service. When two devices cannot connect directly and you have set up no peer relay, traffic goes through a DERP relay that Tailscale runs, which forwards packets it cannot decrypt. Tailscale's connection page says DERP relays are generally slower than direct connections and may offer lower maximum throughput. Its docs do not say what a relay can observe beyond that, such as timing or which devices talk, so I would assume it can see that two devices are exchanging packets.

The Personal plan costs $0 with up to 6 users and unlimited user devices, and it is for non-commercial use only. Standard is $8 per user per month. Clients exist for Linux, macOS, Windows, iOS, Android, and more.

Headscale is an open-source, BSD-3-Clause server that replaces Tailscale's coordination service, so you hold the metadata yourself. It supports a single tailnet and needs a server with a public IP address serving HTTPS. I would only run it if the coordination metadata bothers you and you are happy maintaining a public server.

WireGuard is the tunnel protocol Tailscale builds on. It sends IP packets over UDP and identifies each peer by a public key. The project says key distribution is out of scope, so you copy keys between devices yourself. There is no company, account, or coordination server. Apps exist for Windows, macOS, iOS, Android, Linux, FreeBSD, and OpenBSD.

The catch is reachability. WireGuard's overview says a client config holds an initial endpoint for the server, an IP address and UDP port, and that peers send encrypted packets straight to each other's endpoint. The home end therefore has to accept UDP packets from the internet. My reasoning from that, not a line in the docs: either your router's own VPN server listens on the port, or a WireGuard box at home does and you forward the port to it on the router. StartOS also recommends dynamic DNS, because a change to your home IP disconnects every VPN client until you re-download its config. StartOS says a router with a VPN server is usually the preferred method, and warns that it will not work if your ISP uses CGNAT, because your router cannot accept inbound connections. If you do forward a port, it is for the tunnel only. Never forward Bitcoin RPC or Electrum.

Setup is one config file per device, and WireGuard's quickstart covers it.

StartTunnel is Start9's own tool. Its docs call it a virtual private router that runs on a VPS instead of in your house. It creates private networks, assigns IP addresses to devices, hands each one a WireGuard config, and can forward ports to the public internet. Start9 says it has no coordination server, no telemetry, and no account.

Your node and your phone both connect out to the VPS, so it works behind CGNAT and needs no open port at home. Start9's FAQ says StartTunnel assumes a VPS with a dedicated public IPv4 address, so pick a plan that includes one. Installing means renting a VPS and running Start9's installer; its docs have the current steps. Start9 puts VPS cost at roughly $5 to $10 a month, so check your provider's own pricing.

The trade-off is that you now rent and maintain a server, and your traffic crosses it. Start9 says no third party sits in the data path because you own the VPS. Each device's WireGuard tunnel ends at the VPS, which passes traffic from one tunnel into the other, so only what an app encrypts itself, such as HTTPS, stays encrypted end to end. The VPS provider still hosts the machine, so pick one you are comfortable with. On the StartOS side, the docs list StartTunnel next to a router VPN as the two ways to set up a VPN. Umbrel's remote access page does not mention it.

An onion service is reachable only over Tor and, per the Tor Project, needs no public IP address or open ports. Traffic between the two ends is end-to-end encrypted, and six relays sit in the path, which hides both locations.

On StartOS you install the Tor service and add an onion address to each interface you want to reach, and Start9 says that if you keep the address secret it works as a private tunnel. Anyone who learns the address can still reach the login page, so treat it like a password. umbrelOS has Tor built in and calls the connections noticeably slower while recommending Tailscale for most users.

For wallets, Sparrow lets you set a Tor proxy and uses it for Bitcoin Core only when the server URL is a .onion address. Its docs call Tor connections to Bitcoin Core fairly slow and suggest a private Electrum server if you connect over Tor. Tor suits a node you rarely use remotely. If you are wary of Tor in general, my Tor Browser safety guide covers what it does and does not hide.

I would pick Tailscale for most Bitcoin node owners. It works through CGNAT, needs no forwarded port, takes a few minutes, and the free plan is plenty for one person. The cost is trust in Tailscale's coordination service, which sees which devices you own, their IP addresses, and their location, but not your wallet traffic.

I would pick plain WireGuard if your router has a VPN server and your ISP gives you a real public IP. It has the fewest parts and no third party at all. I would pick StartTunnel if you run StartOS, sit behind CGNAT, and want no company coordinating your devices, accepting a small monthly VPS bill. I would keep Tor as a fallback or for a rarely used node, because of the speed.

Whichever you pick, keep the node's RPC and Electrum ports off the internet. My node guide covers the node itself.