How to SSH With Raspberry Pi: OpenSSH vs Tailscale for Remote Access

Published On -

Sophia Willson blog

Use Tailscale if you want safe SSH access to a Raspberry Pi from outside your home with minimal router work. Use plain OpenSSH if you are staying on the same local network, using a VPN you already trust, or you know how to harden an exposed SSH service. Both methods can be secure, but they solve different problems.

TLDR: OpenSSH is the standard SSH server on Raspberry Pi OS and is excellent for local access, scripting, and direct administration. Tailscale creates a private mesh VPN, so you can SSH into the Pi without opening port 22 on your router. For example, a home user with one Pi, one laptop, and one phone can usually get remote SSH working in under 10 minutes with Tailscale, while port forwarding and DNS setup can easily take 30–60 minutes. If you manage several devices across different networks, Tailscale often saves time and reduces public exposure.

What SSH Does on a Raspberry Pi

SSH gives you a secure command line on your Raspberry Pi. You can update packages, edit config files, restart services, pull logs, run scripts, and fix problems without plugging in a monitor or keyboard.

On Raspberry Pi OS, SSH is handled by OpenSSH. It is mature, widely audited, and used everywhere from hobby projects to production servers. When someone says “SSH into the Pi,” they usually mean connecting to the Pi’s OpenSSH server.

The real question is not whether to use SSH. You almost certainly should. The question is how your client reaches the Pi.

  • OpenSSH alone: You connect directly to the Pi using its local IP or public IP.
  • OpenSSH with Tailscale: You connect through a private Tailscale network using a secure device address.

Option 1: OpenSSH Direct Access

OpenSSH is already the base layer. To enable it on Raspberry Pi OS, you can use the graphical settings menu, raspi-config, or place an empty file named ssh in the boot partition before first startup.

Once enabled, a local connection looks like this:

ssh pi@192.168.1.42

Replace pi with your user name and 192.168.1.42 with the Pi’s address.

OpenSSH is excellent on a trusted local network. It is fast, simple, and does not require a third-party account. If your laptop and Raspberry Pi are on the same Wi-Fi, this is usually the cleanest answer.

The trouble starts when you want to connect from outside your home. You may need:

  • Router port forwarding
  • A static public IP or dynamic DNS
  • Firewall rules
  • Key-based authentication
  • Extra protection against brute-force login attempts

Honestly, it feels like a small job until your ISP uses carrier-grade NAT or your router hides the right menu three screens deep. Then a five-minute task turns into a support rabbit hole.

Hardening OpenSSH

If you expose SSH to the internet, do not treat default settings as enough. Automated scans hit public IPs all day. A Raspberry Pi on port 22 can start receiving login attempts within minutes.

At minimum, use these settings:

  • Disable password login and use SSH keys.
  • Use a non-default user instead of old examples that rely on pi.
  • Keep Raspberry Pi OS updated with sudo apt update && sudo apt upgrade.
  • Limit access by firewall when possible.
  • Install fail2ban if the Pi must face the public internet.

You can create a key on your main computer with:

ssh-keygen -t ed25519

Then copy it to the Pi:

ssh-copy-id user@192.168.1.42

After testing key login, disable password authentication in /etc/ssh/sshd_config:

PasswordAuthentication no

Restart SSH:

sudo systemctl restart ssh

Option 2: SSH Through Tailscale

Tailscale gives your Raspberry Pi a private address inside your own encrypted network. Your laptop, phone, and Pi can see each other even when they are on different internet connections.

The key benefit is simple: you do not need to expose SSH to the public internet. No router port forwarding. No open port 22. No guessing whether your ISP blocks inbound traffic.

A typical setup looks like this:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

After signing in, check the Pi’s Tailscale IP:

tailscale ip -4

Then connect from another device on the same Tailscale network:

ssh user@100.x.y.z

You are still using OpenSSH. Tailscale is only providing the private path between devices.

OpenSSH vs Tailscale: Practical Comparison

Feature OpenSSH Direct OpenSSH with Tailscale
Best for Local network access, advanced server setups Remote access across networks
Router setup Often required for remote access Usually not required
Public exposure Possible if port forwarded No public SSH port needed
Account needed No Yes, a Tailscale account
Offline LAN use Works well May depend on prior setup and network state

When OpenSSH Alone Makes Sense

Use OpenSSH by itself when your access stays inside your local network. This is common for media servers, Pi-hole boxes, Home Assistant systems, and development boards.

It also makes sense if you already run a proper VPN, such as WireGuard, and you are comfortable maintaining it. In that case, direct OpenSSH over that VPN is clean and reliable.

OpenSSH alone is also the better choice for strict environments where third-party identity systems are not allowed. Some labs, schools, and companies prefer systems they control from end to end.

When Tailscale Is the Better Fit

Use Tailscale when the Pi lives behind a home router, mobile network, hotel Wi-Fi, or any connection where inbound access is annoying. It is also useful for family tech support. You can place a Pi at a relative’s house and reach it later without asking them to read router settings over the phone.

The catch is that Tailscale adds another service to trust. You depend on its coordination system for device identity and connection setup. The traffic itself is encrypted end to end, but the account and admin console still matter. Use strong login protection and remove old devices you no longer use.

Security Recommendation

For most home users, the safest practical setup is OpenSSH with key authentication over Tailscale. That gives you two useful layers. SSH protects the login and shell session. Tailscale keeps the SSH service off the public internet.

Do not rely on Tailscale as an excuse for weak SSH habits. Keep password login disabled if possible. Use a normal user with sudo, not direct root login. Patch the Pi often. Remove keys that no longer belong.

A Sensible Setup for Most People

  1. Install Raspberry Pi OS and create a named user.
  2. Enable SSH on the Pi.
  3. Create an ed25519 SSH key on your main computer.
  4. Copy the public key to the Pi.
  5. Confirm that key login works.
  6. Disable SSH password login.
  7. Install Tailscale on the Pi and your client devices.
  8. Connect using the Pi’s Tailscale IP or MagicDNS name.

This setup is boring in the best way. It avoids public SSH exposure and keeps daily access simple. You can sit in a café, open a terminal, and administer your Raspberry Pi as if it were on your desk.

Final recommendation: choose OpenSSH alone for simple local access. Choose Tailscale plus OpenSSH for remote access over the internet. If you are unsure, start with Tailscale. It removes the router pain, cuts public attack surface, and still lets SSH do what it does best.