{"slug":"access-pikvm-from-anywhere","title":"Access PiKVM from anywhere","tags":["tailscale","access-control"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Access PiKVM from anywhere\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nPiKVM is a Raspberry Pi based KVM (keyboard, video, and mouse) over IP solution. It lets you connect to a computer remotely and use it as if you were in front of it. This guide shows you how to set up Tailscale on PiKVM.\r\n\r\nTo find out more about PiKVM, visit [`pikvm.org`](https://pikvm.org/). We also have a video guide on how to set up Tailscale on PiKVM.\r\n\r\nYouTube\r\n\r\n## [Prerequisites](https://tailscale.com/docs/integrations/pikvm\\#prerequisites)\r\n\r\n- A PiKVM device or a Raspberry Pi with PiKVM installed.\r\n - The PiKVM project [recommends](https://docs.pikvm.org/faq/) a Pi 4. The Pi 5 provides little to no performance improvement for this use case.\r\n- [A Tailscale account](https://login.tailscale.com/start)-the free [Personal plan](https://tailscale.com/pricing) includes all you need to get started.\r\n\r\n## [Install Tailscale](https://tailscale.com/docs/integrations/pikvm\\#install-tailscale)\r\n\r\n1. Access your PiKVM through the web interface and open the web terminal.\r\n![The pikvm web interface. Highlighting the 'Terminal' option.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fpikvm-web-terminal.bef01a95.png&w=1920&q=75)\r\n2. Elevate to root.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\n# default password is 'root'\r\nsu -\r\n```\r\n\r\n3. Enable read-write mode.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nrw\r\n```\r\n\r\n\r\nIf you reboot your PiKVM during this process, you will need to re-enable read-write mode.\r\n\r\n4. Install the `tailscale-pikvm` package.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\npacman -Sy tailscale-pikvm\r\n```\r\n\r\n\r\nWe recommend the `tailscale-pikvm` package as a result of [this issue](https://github.com/tailscale/tailscale/issues/2934)\r\n\r\n5. Enable and start the Tailscale service.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nsystemctl enable --now tailscaled\r\n```\r\n\r\n6. Log in to Tailscale.\r\n\r\nFor more information on the available login options, refer to our [Command Reference](https://tailscale.com/docs/reference/tailscale-cli#up).\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ntailscale up\r\n```\r\n\r\n7. (Optional) Enable [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh).\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ntailscale set --ssh\r\n```\r\n\r\n8. Revert to read-only mode.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nro\r\n```\r\n\r\n\r\nYou might prefer to disable key expiry on your subnet nodes to avoid having to periodically reauthenticate. Refer to [key expiry](https://tailscale.com/docs/features/access-control/key-expiry) for more information about machine keys and how to disable their expiry. If you use [tags](https://tailscale.com/docs/features/tags), [key expiry is disabled by default](https://tailscale.com/docs/features/tags#key-expiry).\r\n\r\n## [Access your PiKVM device](https://tailscale.com/docs/integrations/pikvm\\#access-your-pikvm-device)\r\n\r\nOnce you have installed Tailscale on your PiKVM device, you can access it from anywhere using the Tailscale network.\r\n\r\nOpen the [Machines](https://login.tailscale.com/admin/machines) page of the admin console and find your PiKVM device.\r\n\r\nYou can access the web interface by visiting `https://..ts.net`. For example, if your PiKVM device is named `pikvm` and your Tailscale network is named `pango-lin`, you would visit `https://pikvm.pango-lin.ts.net`.\r\n\r\n### [Use Tailscale Serve to access your PiKVM device](https://tailscale.com/docs/integrations/pikvm\\#use-tailscale-serve-to-access-your-pikvm-device)\r\n\r\nYou can set up Tailscale Serve to proxy your PiKVM's web interface. This provides a valid TLS certificate for your PiKVM device, preventing your browser from displaying a security warning.\r\n\r\nTo setup Tailscale Serve, follow the instructions below. You can also find more information on our [Use Tailscale Funnel and Serve](https://tailscale.com/docs/reference/examples/funnel) topic.\r\n\r\nA Tailscale Serve server can only be access over your tailnet. It is not accessible from the public internet. Using [Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel) would open your PiKVM device to the public internet, which is not recommended.\r\n\r\n```shell\r\ntailscale serve --bg https+insecure://localhost:443\r\n```\r\n\r\nAfter running the command above, you can access your PiKVM device, as before, by visiting `https://..ts.net`. The difference is that the connection is proxied through your Tailscale Serve server, providing a valid TLS certificate for your PiKVM device.\r\n\r\nThe first request to your PiKVM device may take a few seconds to complete. This is because Tailscale Serve needs to fetch a valid TLS certificate for your PiKVM device. Subsequent requests will be much faster.\r\n\r\n### [Use your PiKVM node as an exit node or subnet router](https://tailscale.com/docs/integrations/pikvm\\#use-your-pikvm-node-as-an-exit-node-or-subnet-router)\r\n\r\nNow that PiKVM is in your tailnet, you can configure it to do other useful things, such as functioning an [exit node](https://tailscale.com/docs/features/exit-nodes) or a [subnet router](https://tailscale.com/docs/features/subnet-routers).\r\n","html":"

Access PiKVM from anywhere

\n

Last validated: Jan 5, 2026

\n

PiKVM is a Raspberry Pi based KVM (keyboard, video, and mouse) over IP solution. It lets you connect to a computer remotely and use it as if you were in front of it. This guide shows you how to set up Tailscale on PiKVM.

\n

To find out more about PiKVM, visit pikvm.org. We also have a video guide on how to set up Tailscale on PiKVM.

\n

YouTube

\n

Prerequisites

\n
    \n
  • A PiKVM device or a Raspberry Pi with PiKVM installed.\n
      \n
    • The PiKVM project recommends a Pi 4. The Pi 5 provides little to no performance improvement for this use case.
      • \n
    \n
    • \n
  • A Tailscale account-the free Personal plan includes all you need to get started.
    • \n
\n

Install Tailscale

\n
    \n
  1. Access your PiKVM through the web interface and open the web terminal.\r\n\"The
    2. \n
  2. Elevate to root.
    3. \n
\n
# default password is 'root'\r\nsu -\n
\n
    \n
  1. Enable read-write mode.
    2. \n
\n
rw\n
\n

If you reboot your PiKVM during this process, you will need to re-enable read-write mode.

\n
    \n
  1. Install the tailscale-pikvm package.
    2. \n
\n
pacman -Sy tailscale-pikvm\n
\n

We recommend the tailscale-pikvm package as a result of this issue

\n
    \n
  1. Enable and start the Tailscale service.
    2. \n
\n
systemctl enable --now tailscaled\n
\n
    \n
  1. Log in to Tailscale.
    2. \n
\n

For more information on the available login options, refer to our Command Reference.

\n
tailscale up\n
\n
    \n
  1. (Optional) Enable Tailscale SSH.
    2. \n
\n
tailscale set --ssh\n
\n
    \n
  1. Revert to read-only mode.
    2. \n
\n
ro\n
\n

You might prefer to disable key expiry on your subnet nodes to avoid having to periodically reauthenticate. Refer to key expiry for more information about machine keys and how to disable their expiry. If you use tags, key expiry is disabled by default.

\n

Access your PiKVM device

\n

Once you have installed Tailscale on your PiKVM device, you can access it from anywhere using the Tailscale network.

\n

Open the Machines page of the admin console and find your PiKVM device.

\n

You can access the web interface by visiting https://<your-pikvm>.<your-tailnet>.ts.net. For example, if your PiKVM device is named pikvm and your Tailscale network is named pango-lin, you would visit https://pikvm.pango-lin.ts.net.

\n

Use Tailscale Serve to access your PiKVM device

\n

You can set up Tailscale Serve to proxy your PiKVM's web interface. This provides a valid TLS certificate for your PiKVM device, preventing your browser from displaying a security warning.

\n

To setup Tailscale Serve, follow the instructions below. You can also find more information on our Use Tailscale Funnel and Serve topic.

\n

A Tailscale Serve server can only be access over your tailnet. It is not accessible from the public internet. Using Tailscale Funnel would open your PiKVM device to the public internet, which is not recommended.

\n
tailscale serve --bg https+insecure://localhost:443\n
\n

After running the command above, you can access your PiKVM device, as before, by visiting https://<your-pikvm>.<your-tailnet>.ts.net. The difference is that the connection is proxied through your Tailscale Serve server, providing a valid TLS certificate for your PiKVM device.

\n

The first request to your PiKVM device may take a few seconds to complete. This is because Tailscale Serve needs to fetch a valid TLS certificate for your PiKVM device. Subsequent requests will be much faster.

\n

Use your PiKVM node as an exit node or subnet router

\n

Now that PiKVM is in your tailnet, you can configure it to do other useful things, such as functioning an exit node or a subnet router.

\n"}