RDP over Tailscale

Why use a private network for RDP?

Windows Remote Desktop is useful, but exposing its port directly to the public internet creates unnecessary risk. A private overlay network such as Tailscale lets approved devices communicate using private addresses while keeping RDP away from unsolicited public traffic.

The standard Tailscale setup

• Install Tailscale on the Windows computer or server you want to reach.

• Install Tailscale on the remote user's computer.

• Authenticate both devices into the appropriate tailnet.

• Use the target computer's Tailscale IP or approved hostname in Remote Desktop.

This is usually the best place to start because it uses the official Tailscale client and its normal management model.

When a lighter client workflow may help

Some businesses do not want a permanent VPN-style client installed on a contractor, accountant or temporary support computer. They may also want the user to have a narrower task-oriented experience.

That is the use case behind Private RDP.

Authentication keys need care

Authentication keys should be treated as credentials. Scope them appropriately, protect them, and rotate or expire them according to the access model you choose.

Accountant or branch-office scenario

A common design is to keep the central Windows machine inside the office, use Tailscale for the private network path, and use RDP for the Windows session. Application permissions and filesystem permissions should still be enforced on Windows itself.

Tailscale is a separate product and company. Dopadroid is not affiliated with or endorsed by Tailscale Inc.