Short answer: there are three common ways to reach your home devices while you’re out: a VPN server on your router, a mesh VPN service such as Tailscale, or port forwarding. A router VPN server needs a public IP address on your internet connection. Tailscale says its connections work without port forwarding. Port forwarding exposes the service itself to the internet.
The three options
| Option | What it depends on | What the internet can reach |
|---|---|---|
| VPN server on your router | A router that has one; ASUS documents a public WAN address as a must | The router’s VPN service |
| Mesh VPN service | The service and its app on your devices | Tailscale says no port forwarding |
| Port forwarding | A rule on the router for each service | The forwarded service itself |
The difference that matters most is what you expose. Port forwarding makes the service itself, such as a camera’s web page, reachable from the internet. With a VPN, the VPN is what you expose instead, and you reach the service through it once you’re connected.
A VPN server on your router
Some routers, ASUS’s among them, include a WireGuard VPN server. WireGuard carries traffic over UDP, and a connection is set up by exchanging public keys, much like SSH keys. ASUS supports its WireGuard server on firmware later than 3.0.0.4.388.
The catch is reachability. ASUS says the router needs a public WAN IP address from your internet provider, so devices on the internet can find it. That requirement implies a limit: if your provider shares one public address among many customers (carrier-grade NAT), or there’s another router in front of yours, a router VPN server can’t be reached as it stands. Our guide to double NAT explains how to check for a second router, and how a home network works covers public and private addresses.
A mesh VPN service
Mesh VPN services take a different route. Tailscale says connections between your devices work across firewalls and NAT without port forwarding or complex firewall rules, and that it uses WireGuard to encrypt them. It also says it can send all of a device’s traffic through an “exit node”, like a traditional VPN.
It is a third-party service, so you rely on that company for it to work, and you’ll need to set it up on the devices you want to reach.
When port forwarding is still the answer
Port forwarding is the right tool when something has to be reachable by people who won’t install a VPN, such as a game server. Our port forwarding guide covers how to set it up and how to do it safely. Whichever route you choose, keep the router itself secure: see our router security checklist.