Your Remote Home Base: Tailscale, Always-On Home PC, Layered Remote Desktop

About a year into living in Central America, my company rolled out a new internal tool that did IP-based location checks on login. It noticed I was logging in from outside Canada and locked my account. I got the “suspicious activity” email. I had to phone IT and pretend I was at a coffee shop on holiday. They unlocked it. I spent the rest of that day pretending I’d gone home and rebuilding my entire network setup from scratch, because what I had been doing up to that point (nothing) had just stopped working.

The first thing I tried was a commercial VPN. NordVPN, ExpressVPN, the usual options. It worked for about two weeks before a different system flagged the IP as a known VPN endpoint and locked me out again. Commercial VPN IPs are datacentre IPs. Any serious work system maintains lists of them. The IP doesn’t look like a person working from home. It looks like a person hiding.

The setup I run now is different. It’s a Tailscale mesh network connecting all my devices privately. It routes my outbound traffic through small computers at friends’ houses back in Canada, so work systems see a residential IP from a residential ISP in the city my paperwork says I live in. There’s an always-on PC in my parents’ basement that I can remote into from anywhere in the world for anything I want to do unambiguously “from home.” And there are four different remote desktop tools installed alongside each other, because the day one of them inevitably has a bad afternoon I don’t want to find out about it during a call.

Nothing in this article is exotic. Most of it is free or near-free. Once it’s set up it more or less runs itself, with occasional maintenance when something updates badly or a host’s ISP changes their router. This is the system that’s held for over two years now without my employer noticing where I actually live.

Work systems see Canada. I see ocean. The IP they log says I’m in a residential apartment two streets from where I grew up.

Article 04 / Previously Power Redundancy for Remote Workers The UPS stack, the DC UPS for your router that almost nobody thinks about, the USB-C battery packs, and ThrottleStop. The layer below this one. ← The Premise

What you’re actually defending against

Before getting into the tools, it’s worth being clear about what a remote worker abroad is actually defending against. The threat model is not a state-level adversary. It’s a much more practical mix.

• IP-based location checks by your work systems. The most common and the most consequential. Your IP address reveals your country. Most enterprise systems either log it, geolocate it, or both. Some lock accounts on detected location anomalies.
• Datacentre IP detection. Many corporate systems flag connections from known commercial VPN providers and cloud IP ranges. Even a working commercial VPN often results in flagged sessions.
• DNS leaks. Even with a VPN running, many configurations let DNS queries resolve through your local ISP. Your DNS queries reveal what services you’re trying to reach even when the connection content is encrypted.
• Traffic inspection on shared networks. Hotel Wi-Fi, co-working space ethernet, the apartment building’s shared router. Anyone with access to the network can see metadata about who you’re talking to.
• Unreliable local infrastructure. ISP outages, country-level DNS manipulation, occasional traffic throttling. A properly configured private network handles all of this at the connection level.

Each layer in this article addresses a specific failure mode. None of them on their own is sufficient. Together they make the question of where you actually are essentially invisible to anyone who isn’t reading your screen over your shoulder.

Why Commercial VPNs Don't Work

The trust problem is just moved

Commercial VPNs do one thing well. They encrypt your traffic between your device and their servers and replace your IP with one of theirs. For protecting traffic on an untrusted hotel network, a reputable commercial VPN is a reasonable first step. The problems start when you ask them to solve anything else.

The first issue is that you’re trusting the VPN provider. You haven’t eliminated the trust problem, you’ve moved it. Instead of trusting the local ISP and the hotel router, now you’re trusting whatever company runs the VPN and the data centres their servers live in. “No logs” is a marketing claim. Mullvad has the strongest privacy track record of any commercial provider currently operating (anonymous payment, audited, Swedish jurisdiction) and even Mullvad requires you to trust them.

The second issue is that you have no control over the exit. Your traffic exits at whatever data centre the provider operates. The IP is a known data-centre IP that work systems recognise as “not a residential user” and frequently flag. You can’t make the connection appear to come from a specific residential address in your home city, which is the entire thing you actually need.

The third issue is that it doesn’t connect your own devices to each other. A commercial VPN is a single connection from your laptop to their server. It doesn’t build a private network between your devices. You can’t SSH into your home server. You can’t reach your NAS. You can’t remote into the PC at your parents’ house.

Tailscale solves all three. Residential exit nodes solve the location problem that no commercial VPN can address at all. The always-on home PC solves the problems neither of the above can touch.

Layer 01 / Tailscale

The mesh network everything else runs on

Tailscale is a mesh VPN built on WireGuard. WireGuard is an open-source VPN protocol that’s significantly faster, simpler, and more secure than older alternatives like OpenVPN or IPsec. Tailscale wraps WireGuard in a coordination layer that handles key exchange, device authentication, NAT traversal, and routing automatically, so the setup that would otherwise take a day takes ten minutes.

The result is a private network (Tailscale calls it a tailnet) that connects all your devices directly to each other over encrypted peer-to-peer WireGuard tunnels regardless of what physical networks they’re on. A laptop in Central America, a phone in Mexico City, a Raspberry Pi at your parents’ house in Canada, a small server at a friend’s apartment, all on the same private encrypted network, all reachable at stable Tailscale IPs that never change.

What you get out of it:

• All your devices on one private network regardless of where they are.
• Each device gets a stable Tailscale IP that never changes.
• Traffic between your devices is end-to-end encrypted with WireGuard.
• DNS handled privately through MagicDNS, with optional override of local DNS to prevent leakage.
• Any device can be configured as an exit node, routing all outbound traffic through it.
• The free Personal plan covers 100 devices and 3 users. More than anyone needs.

That last point matters. The free tier is genuinely free for everything in this article. The paid tiers add features for teams and businesses. For a personal remote-work setup you will not hit any limit.

Layer 02 / Residential Exit Nodes

The feature that makes the whole thing work

This is the capability that separates a Tailscale setup from any commercial VPN, and the one that actually does the work of making your traffic look like it’s coming from home.

When you configure a device on your tailnet as an exit node and then select it from your laptop, all of your laptop’s internet traffic routes through that device first before going out to the public internet. To any website or service or work system you’re talking to, your traffic appears to come from the IP address of the exit node. If that exit node is a Raspberry Pi sitting at your parents’ house in Toronto, your traffic looks like it’s coming from a residential cable connection in Toronto. Because it is.

That distinction is everything. Commercial VPN IPs are data centre IPs that get flagged. A residential exit node is indistinguishable from someone genuinely working from home because it is someone’s home.

What to use as an exit node

Almost any always-on device with a network connection can serve as a residential exit node. The practical options:

The person hosting the device needs to do essentially nothing. They plug it into their router, leave it alone, and ignore it. Tailscale handles all the connectivity automatically with no port forwarding, no router configuration, and no technical knowledge required from the host. Pay for the device, ship it set up, ask a favour, follow up once a year over coffee.

Keeping the nodes alive long-term

• Disable key expiry for every exit node in the Tailscale admin console. By default Tailscale requires periodic re-authentication. For unattended always-on devices this will take them offline. Disable it so they stay connected indefinitely.
• Start at boot. On Linux/Pi: sudo systemctl enable tailscaled. On Android and Apple TV it’s automatic after installation.
• Wire to ethernet. Wi-Fi works but degrades over weeks of continuous unattended operation. Cable is dramatically more reliable for a device nobody is checking.
• Monitor. The Tailscale admin console shows online/offline state for every device. Check before work sessions. For more peace of mind, UptimeRobot has a free tier that pings your tailnet IPs and alerts you when a node drops.

The VPS as a backup exit node

A small VPS at Hetzner, DigitalOcean, or Vultr serves a different purpose to the residential nodes. The IP is a data centre IP, so it’s not useful for appearing to work from home. It is useful as a backup when every residential node is offline at once, for general traffic encryption when location appearance doesn’t matter, and as the most reliable always-on connection in the whole tailnet.

A small Hetzner VPS costs €4 to €6 a month. SSH in and run:

Then in the Tailscale admin console find the VPS in your device list, edit its route settings, and enable it as an exit node. Done. Your complete exit strategy: two or three residential nodes in your home city as primaries, one VPS as the always-on backup.

Layer 03 / The Always-On Home PC

A whole computer at home you can step into from anywhere

This is the layer that almost no remote work guide covers properly, and the one that does the heaviest lifting on the days where the stakes are highest.

The exit node masks your IP and routes traffic from the laptop in front of you. The always-on home PC is a different thing entirely. It’s a full Windows desktop sitting at home in your home country, plugged into the wall, on residential broadband, with a residential IP. You remote into it from wherever you happen to be, and the work happens on that machine. Your local laptop in Central America is just the screen and keyboard. The actual computer doing the work, the one with the work-system logins, the one whose IP and DNS and timezone and everything else gets logged, is the one at home.

For high-stakes activities where you don’t just want IP-level cover but actual physical-machine cover, this is the layer that delivers it. You’re not pretending to be home. You are, in the only sense that the logs care about, home.

What hardware to use

You don’t need a powerful machine. The home PC isn’t doing rendering or anything heavy. It’s running a desktop session you remote into. What it needs to be is reliable, low-power, vPro-capable, and small enough that the host doesn’t mind it sitting in their basement or office.

• Lenovo ThinkCentre M-series Tiny. The M70q or M90q current generations are the standard pick. 1L chassis, Intel vPro available, runs Windows 11 Pro out of the box, accepts up to 64GB RAM and an NVMe SSD, draws under 25W idle. Around $500 to $800 new, frequently available used or refurbished for $200 to $400 with off-lease stock from corporate refresh cycles.
• HP EliteDesk Mini / Pro Mini G9. HP’s equivalent. Same form factor, vPro, similar pricing. Slightly louder under load than the ThinkCentre but unnoticeable at idle.
• Dell OptiPlex Micro. Dell’s equivalent. The OptiPlex 7010 Micro or current 7020 Micro. Same story, same price band, vPro available on most configurations.

All three vendor families come off lease in volume after corporate refresh cycles, so used and refurbished stock is everywhere. A three-year-old M70q with 16GB RAM, an Intel i5 vPro processor, and a fresh 1TB NVMe upgrade runs around $250 and will outlive the rest of this setup.

vPro is the spec that matters

vPro (Intel’s remote management technology, formerly AMT) lets you access the machine’s firmware over the network even when the operating system is down or the machine is powered off. For a PC sitting unattended at someone else’s house, this is non-negotiable. If Windows freezes, vPro lets you remote into the BIOS and reboot. If the machine power-cycles during a Windows Update and gets stuck on a recovery screen, vPro lets you fix it from a thousand kilometres away. Without vPro, the only fix is asking your parents to crawl under the desk and unplug it, which is not a sustainable support model.

Look for “Intel vPro” explicitly on the spec sheet. Not all i5/i7 chips include it. The ThinkCentre, EliteDesk, and OptiPlex lines all have vPro variants and non-vPro variants in the same model number. Verify before buying. Configure the vPro BIOS settings before shipping the machine to the host.

The virtual display dongle

This is the one piece of weird hardware nobody warns you about until you’ve been hit by it.

When a PC has no monitor plugged in, the graphics driver often falls back to low default resolutions (typically 1024×768) or disables the GPU entirely. Remote desktop sessions to a headless machine then look terrible or refuse to connect at all. The fix is a virtual display dongle, also called an HDMI dummy plug or EDID emulator. It’s a small adapter that plugs into the HDMI or DisplayPort output of the PC and convinces the system a monitor is attached.

They cost around $10 on Amazon. Search “HDMI dummy plug 4K” or “virtual display emulator.” Buy two, ship one with the PC and keep one as a spare. Plug it in before deploying the machine. The GPU runs at full capability, the remote session displays at the resolution you want, and you forget it exists. Required hardware for any always-on PC you plan to remote into.

Configure it correctly before you ship it

Set this all up at your kitchen table before you send the box anywhere. Once it’s at the host’s house, every fix is much harder.

1. Install Windows 11 Pro

   Pro, not Home. Home doesn’t include RDP server, which is the daily-driver remote desktop tool. Pro is included with most refurbished business-class machines; if not, buy a key.

2. Set up auto-login

   If Windows boots to a login screen, the machine is unreachable until someone physically types the password. Run netplwiz, uncheck “Users must enter a username and password”, enter the credentials when prompted. The machine now boots straight to the desktop.

3. Enable auto-reboot on power failure in BIOS

   Find the setting called “AC Power Recovery”, “Power On After Power Loss”, or “After Power Failure” depending on the vendor. Set to “On” or “Last State”. After a power outage at the host’s house, the PC turns itself back on instead of staying dark.

4. Enable Wake-on-LAN

   BIOS option, plus Windows Device Manager → Network adapter → Power Management → allow this device to wake the computer. With WoL enabled, you can power-cycle a sleeping machine from anywhere on the tailnet.

5. Configure vPro

   BIOS setup screen. Enable AMT/vPro, set an admin password (use your password manager), enable remote management. Refer to the vendor’s vPro setup guide. Test it works from your laptop on the same network before shipping.

6. Plug in the virtual display dongle

   Into the HDMI output. The GPU now thinks a 4K monitor is connected. Test with a remote desktop session at 1920×1080 or higher before shipping.

7. Install Tailscale and join your tailnet

   Tailscale Windows installer. Sign in. Verify it appears in your Tailscale admin console. Disable key expiry. Confirm the device is reachable at its Tailscale IP from your laptop.

8. Install all four remote desktop tools

   RDP (enable in Windows Settings → System → Remote Desktop), Parsec, Google Remote Desktop (via Chrome), HelpWire. Configure each one. Test each one. Details below.

9. Lock down inbound from the public internet

   The machine should accept connections only from your tailnet. No port forwarding on the host’s router. No public IPs. Windows Firewall set to block all incoming except RDP/Parsec/etc on the Tailscale interface. Anyone scanning the host’s public IP sees a normal home connection, not an exposed remote desktop port.

10. Set Windows Update for off-hours

    Active hours set to your typical work window in the host’s timezone. Updates apply outside that window. Reboots happen when you’re not using the machine. Combined with auto-login, the machine comes back online by itself after every update.

Once all of that is configured, the box ships to the host. They plug it into power and ethernet. You verify everything works over Tailscale. You never have to ask them to touch it again.

Layer 04 / Remote Desktop

Four tools layered so one always works

Here’s the unglamorous truth about remote desktop software: every single one of these tools has a bad day every few months. RDP suddenly refuses connections after a Windows update. Parsec has trouble with a particular network path. Google Remote Desktop’s Chrome extension breaks. HelpWire fails to authenticate after a server-side change. Any of them, on its own day, will be down at the moment you need it.

The fix is to install all four. They’re lightweight, mostly free, and they sit alongside each other without conflict. When the daily driver doesn’t work, you have three more to try.

Daily driver: RDP (Microsoft Remote Desktop)

Built into Windows Pro. Free. Lowest bandwidth requirements of anything in this list (good RDP sessions over a 5Mbps connection are perfectly usable). Best clipboard and file-transfer integration. Best general work feel for office-style tools, browser-based work, document editing.

Enable in Windows Settings → System → Remote Desktop → on. Connect from anywhere using the device’s Tailscale IP and Windows credentials. Microsoft Remote Desktop clients exist for Windows, macOS, iOS, and Android. The macOS client (now called Windows App) is the right pick on a MacBook.

This is the daily driver. 95% of the time RDP is what you’ll use.

Low-latency / GPU work: Parsec

Parsec was originally built for cloud gaming. It uses GPU-accelerated video encoding to push the desktop image at very low latency, which means it’s the right pick for anything where RDP feels sluggish: design tools, video editing, anything that needs GPU acceleration, anything where input lag is visible.

Free for personal use. The free tier is the only tier you need. Install on the home PC and on every device you want to connect from. Sign in. Connect to the host from the Parsec client. Quality is genuinely close to sitting in front of the machine.

Use it for the high-end work. Keep RDP for everything else.

Third fallback: Google Remote Desktop

Browser-based. No client install required on the side you’re connecting from, which makes it the fallback that works when you’re on a machine you don’t own. Install the Chrome extension on the home PC. Set a PIN. Access from any Chrome browser anywhere by signing into the same Google account.

Slower and less responsive than RDP or Parsec. Fine for “I need to check one thing” sessions. Critical as the fallback that doesn’t require any installed tools on the client side, useful if your laptop dies and you’re working off someone else’s machine for a day.

Fourth fallback: HelpWire

HelpWire is a newer remote desktop tool that uses its own routing infrastructure. It tends to work in network conditions where RDP and Parsec both fail (some restrictive corporate networks, some unusual ISP configurations). Free for personal use. Install on the home PC and the client. When the other three are misbehaving for reasons you can’t diagnose, HelpWire frequently gets you in anyway.

Not your daily driver, but the one that’s saved me on at least three occasions where everything else was inexplicably broken.

How to actually use them together

RDP open by default. Parsec for the design or video work. Google Remote Desktop bookmarked in your browser as the fallback that needs no install. HelpWire as the last resort. All four configured, tested, and ready. The day one of them breaks, you just open the next.

Layer 05 / The GL.iNet Router

Maximum security on any network

GL.iNet makes travel routers running OpenWrt with native Tailscale support in the firmware. The combination of GL.iNet on any local network, with Tailscale routing all traffic through your residential exit node, is the maximum network-level protection setup for working from somewhere you’re not supposed to be.

How it works. You plug the GL.iNet into the local network (hotel ethernet, co-working space, apartment router). Your laptop connects to the GL.iNet via ethernet. The GL.iNet runs Tailscale at the router level with your residential exit node configured as its exit. All laptop traffic routes laptop → GL.iNet (ethernet) → Tailscale tunnel → residential exit node → internet. The local network never sees your real traffic. It sees only encrypted WireGuard packets to your residential node.

The single biggest practical benefit of this setup is what it does for a managed corporate laptop. If your work laptop is locked down by your employer so you can’t install Tailscale on it directly, the GL.iNet handles all of it transparently. The corporate laptop just sees a normal ethernet connection. Everything happens at the router level outside the laptop’s control. Important caveats below about how far this can actually take you.

Which GL.iNet to buy

• GL-MT3000 “Beryl AX”. Current flagship travel router. Wi-Fi 6, fast enough to handle WireGuard encryption at line speed without throttling, compact. The top pick.
• GL-AXT1800 “Slate AX”. Previous generation, slightly larger, very stable, widely used in remote work and travel communities. Cheaper than the Beryl. Excellent option if cost matters and you don’t mind giving up some of the Beryl’s WireGuard headroom.

Both are available on Amazon, directly from GL.iNet, and from importers on MercadoLibre across Latin America. The Beryl AX runs around $90 to $120; the Slate AX around $60 to $90.

Setup: log into the GL.iNet admin panel at 192.168.8.1 → VPN → Tailscale → Enable → sign in with your Tailscale account → set the residential exit node as the router’s exit. Full instructions in GL.iNet’s Tailscale documentation.

Layer 06 / DNS

The leak nobody mentions

Even with Tailscale running and an exit node selected, DNS queries can still leak. Many operating systems and routers default to using whatever DNS servers were assigned by the local DHCP, which means your DNS queries can resolve through the hotel’s ISP or the local network’s DNS server even when the rest of your traffic is going through the encrypted tunnel.

This is a common, poorly understood privacy leak. Test for it at any time by visiting browserleaks.com and ipleak.net. They’ll show you which DNS servers your queries are actually resolving through. If you see anything that isn’t your tailnet or your exit node’s ISP, you have a leak.

The fix in Tailscale is straightforward. In the admin console, go to DNS, enable MagicDNS, then enable Override local DNS, then add 1.1.1.1 (Cloudflare) and 1.0.0.1 as global nameservers. All DNS queries now route through your tailnet to those resolvers. No local ISP visibility.

Test after configuring. Re-test occasionally. Whenever you switch exit nodes, re-test. DNS leak detection is a thirty-second task that catches the most common slip in the whole stack.

A perfect Tailscale setup with a DNS leak is just an expensive way to broadcast your real ISP every time you check the weather.

Layer 07 / Connectivity

Layering your actual internet

Tailscale and the home PC need an internet connection underneath them. The whole setup is only as good as the underlying link. Three layers of internet, primary to last-resort.

Primary: fibre to the home

Where you can get it, fibre is the only right answer. Symmetrical speeds (upload matches download) matter enormously for video calls. A 100Mbps fibre connection with 50Mbps upload performs dramatically better for sustained calls than a 300Mbps cable connection with 15Mbps upload. Fibre is expanding across urban and suburban Central America (Tigo, Claro, and various regional providers). When picking accommodation, fibre availability should be near the top of the priority list. Run ethernet from the ONT to your router and from your router to your desk. Wi-Fi for casual stuff, cable for sustained work.

Backup: phone USB tethering

The most practical backup, and it requires no additional hardware. Connect the phone to the laptop via USB cable, enable USB tethering in iOS (Settings → Personal Hotspot) or Android (Settings → Hotspot & Tethering). The laptop sees it as a wired connection. Faster than the Wi-Fi hotspot mode, doesn’t heat the phone as hard, and charges the phone simultaneously.

Verify your plan allows tethering. In Central America, Claro and Tigo both offer plans with tethering but the specific terms vary, and some “unlimited” plans throttle hotspot use to 3G speeds after a data cap. Test before you rely on it. If signal is weak, move the phone toward a window before starting.

Nuclear option: Starlink Roam

For rural locations or anywhere with genuinely unreliable ground-based infrastructure, Starlink Roam is now available across 50+ countries in Latin America and the Caribbean. Roam Regional is $50 per month, Roam Global is $165 per month, and the Starlink Mini hardware runs around $249. Real-world speeds in the region consistently hit 100 to 200Mbps down with low latency. Covered in more detail in Article 4.

Tailscale handles network switching gracefully

One practical advantage of Tailscale over commercial VPNs is what happens when you switch connections. From fibre to phone tethering, from one Wi-Fi to another. Tailscale’s WireGuard tunnels reconnect within seconds of a network change. Your exit node re-establishes automatically. Your tailnet stays up. Commercial VPNs typically drop and need a manual reconnect, leaving a window where your traffic is going out unprotected. Tailscale doesn’t.

A Variant Worth Knowing

Host the home PC at a friend’s place

The above assumes the home PC sits at your parents’ or your own home. That’s the cleanest setup. If neither is an option, the entire thing also works hosted at a friend’s house, with a few caveats.

The friend needs to be someone you trust to leave the box plugged in, ignore it, and call you if their power goes out for more than a day. The box should be physically labelled so nobody unplugs it during a clean. Wired to ethernet. On a UPS at their place if they’ll allow it (a small APC unit is $80 to $120, worth it). vPro configured so you can fix anything BIOS-level without asking them to touch it.

The advantage of hosting at a friend’s is that you can pay for it. A box at someone’s house doing nothing of theirs is harder to ask for than one where you’re covering the electricity (probably $5 to $10 a month) and bringing them a bottle of something nice every Christmas. Make the exchange explicit and the arrangement lasts longer than friendships often do.

Putting It Together

The full stack at a glance

One last thing

Set this up once, properly, in stages over a few weekends, and it more or less runs itself for years. The hardest part is the first weekend, when you’re shipping a small computer to your parents and trying to explain over the phone what an ethernet cable looks like. After that the system is invisible. The work systems see Canada. The work systems have always seen Canada. You see ocean.

Two years in, my employer has never once questioned my location. The IP-based location check from that original incident has never flagged me again. The internal directory still lists my address as the apartment I haven’t lived in for years. The vPro mini-PC in my parents’ basement has rebooted itself through dozens of Windows updates and three power outages and is still chugging along. The friends hosting my exit nodes haven’t had to do anything to those devices in eighteen months.

Build it once. Forget about it. Get on with the rest of your life in a place you actually want to be.

Article 06 / Up next The Off-Grid Solar Work Setup The endgame for power independence. Hybrid solar systems, daily load calculation, panel and battery sizing for wet season, and what’s actually available in Latin America. → Up Next / Article 06 The Off-Grid Solar Work Setup →