Every home lab eventually collides with the same wall: you want to reach your machines from outside, and your ISP won’t let you. Carrier-grade NAT — increasingly common on consumer and NBN connections — means there’s no public IPv4 address and no port forwarding, so the classic “expose a service on the router” playbook simply doesn’t exist. A writer at XDA Developers recently documented their solution, and it’s a lovely piece of lateral thinking: they gave the oldest, weakest board in the drawer — an original Raspberry Pi Zero — the most important job in the lab.
The ingredient that makes it work is a mesh VPN such as Tailscale. Instead of opening ports, every device you care about joins a private overlay network and talks to its peers over encrypted WireGuard tunnels, using UDP hole-punching to sneak through NAT. No inbound ports, no cloud server rental, and the free tier is generous enough for home and small-office use. It’s the answer to CGNAT that doesn’t involve calling your ISP or paying for a static IP you can’t get.
The clever part is how little of it you actually need to install. Installing the VPN client on every server, VM and container gets old fast — especially if you rebuild nodes regularly for experiments. The fix is a subnet router: one device joins the mesh and advertises your local subnet as a route. From that moment, anything connected to the VPN can reach everything on your LAN — servers, printers, smart gadgets, the lot — with no client installed anywhere else. One board, one configuration, whole-network coverage.
And that’s where the Pi Zero earns its keep. Routing packets between a VPN tunnel and your LAN is almost no work at all for a modern CPU, let alone a humble ARM11. The XDA author paired theirs with DietPi to strip the OS down to essentials, enabled IP forwarding, and enabled route advertisement with a single command:
tailscale set --advertise-routes=192.168.0.0/24
Approve the route once in the admin console and you’re done. That $15 board everyone wrote off is now the front door to your entire network.
A few practical notes before you raid the parts drawer:
- Connect it wired if you can. The original Zero has no Ethernet port, and subnet routing over Wi-Fi is fine for SSH and dashboards but will bottleneck big file transfers. A USB Ethernet adapter helps; a Pi Zero 2 W (or any spare Pi) is better again if you have one.
- Keep a fallback path. A subnet router is a single point of failure. If remote access matters to you, a second device advertising the same route elsewhere on the LAN gives you failover — or at least a way in when you unplug the wrong cable.
- Lock the tailnet down. Turn on device approval, use Tailscale’s ACLs to limit which devices can reach which subnets, and consider an exit node so roaming laptops can keep lab access off public Wi-Fi.
- Mind the power supply. A flaky USB charger will brown out a Pi under network load and you’ll spend an evening debugging a problem that costs $10 to fix.
For small businesses the same pattern applies with a straight face: secure remote access to an office LAN without opening a single inbound port, without a VPN concentrator appliance, and with the audit trail of who connected sitting in one admin console. Not bad for the board at the bottom of the drawer — and a good reminder that in networking, the boring jobs are often the important ones.