How it works

The short version: two pre-configured routers, one private tunnel between them, traffic exits the internet from your home IP, wherever you are, as long as the network you're on allows Tailscale traffic.

How Do I Keep My Home IP Address While Traveling?

Watch the three-minute guide to why a regular VPN app doesn't give you your own home IP, how the Home and Away units connect, and what to check before your first trip.

Watch on YouTube 3:39 · English captions

Play here, or open YouTube using the link above. YouTube loads only when you press play and processes viewing data under its own privacy policy.

At home: the Home unit plugs into your router

The Home unit (a fanless GL.iNet Brume 2) sits behind your existing home router. It joins your Tailscale account as an “exit node” — Tailscale's term for “a device willing to forward other devices' internet traffic through itself.” It does nothing visible to your home network beyond that.

On the road: the Away unit is your portable WiFi

The Away unit (a pocketable GL.iNet Beryl AX) is what you take with you. Plug it into a USB-C charger rated for 5V/3A. Connect it upstream to the local WiFi (hotel, cafe, friend's place) or to Ethernet. Your laptop, phone, and tablet join the Away unit's WiFi just like a normal hotspot.

Behind the scenes: Tailscale binds them together

When the Away unit boots, it dials home over Tailscale's encrypted overlay network and asks: “route all my traffic through the Home unit, please.” The Home unit accepts. Now every packet from your devices goes:

your device  →  Away unit  →  Tailscale tunnel  →  Home unit  →  your home router  →  internet

When the tunnel is connected, websites see your home IP. The local network sees encrypted Tailscale traffic, either directly to the Home unit or through a Tailscale DERP relay; it cannot read the tunneled traffic itself.

Designed for CGNAT connections

A lot of consumer ISPs — T-Mobile Home Internet, Starlink, most cellular plans, some apartment buildings — put you behind “carrier-grade NAT” (CGNAT). A home device that relies on accepting direct inbound connections can't do that behind CGNAT, and there is no port to forward, so it needs some kind of relay. Tailscale can use DERP relays when a direct path is unavailable. Actual connectivity still depends on both internet connections and the local networks allowing Tailscale traffic. On a CGNAT connection, the public IP that sites see is your internet provider's shared address, which can change; it's the same address your devices get at home.

Your data: where it goes (and doesn't)

We sell hardware. We don't run the tunnel. We don't see your traffic, your devices, or your Tailscale account. Your Tailscale account stays yours — and Tailscale's Personal plan is currently free, with up to 6 users and unlimited user devices. Tailscale controls its plans, pricing, terms, and availability. The routers are not locked to a PacketMole account, but continued operation still depends on compatible third-party software, services, and working internet connections.

Order PacketMole — $349