KKitis
Home/Guides/Reach an Ubuntu server from an iPhone with Tailscale

Reach an Ubuntu server from an iPhone with Tailscale

Connect an iPhone to an Ubuntu server without making the service public.

What this gives you

Both devices join the same private Tailscale network, so the phone can reach the server from anywhere.

This is usually the better choice for private tools. A web panel, SSH service, or development page does not need a public domain when only your own devices should reach it.

1. Add the Ubuntu server

Install Tailscale using the current Linux instructions from the official site, then bring the server online:

sudo tailscale up

The command prints an authentication link when the server is not signed in yet. Open it and use the same Tailscale account you will use on the phone.

Confirm the server is connected:

tailscale status
tailscale ip -4

The second command prints an address in Tailscale’s private range. Keep it; you will use it from the iPhone.

2. Add the iPhone

  1. Install Tailscale from the App Store.
  2. Open it and approve the VPN configuration prompt.
  3. Sign in with the same account used by the Ubuntu server.
  4. Make sure the connection switch is on.

If device approval is enabled in the tailnet, approve the phone or server in the Tailscale admin console before testing.

3. Confirm the service listens beyond localhost

A service bound only to 127.0.0.1 accepts connections from the Ubuntu machine itself but not from the phone. Check the listening address:

sudo ss -tulpn

For example, a service on port 8096 should usually show 0.0.0.0:8096, [::]:8096, or the Tailscale address. Do not change a secure localhost-only service without understanding its authentication.

4. Connect from the phone

In Safari, enter the Tailscale IP and service port:

http://100.x.y.z:8096

You can also use the device name when MagicDNS is enabled:

http://kitis-core:8096

The exact hostname appears in tailscale status and in the Tailscale Machines page.

5. Use SSH from a phone client

For an SSH app such as Termius, create a host using:

  • Address: the Ubuntu server’s Tailscale IP or MagicDNS name.
  • Port: 22, unless SSH uses a different port.
  • Username: your Linux username.
  • Authentication: an SSH key rather than a reusable password.

On Ubuntu, verify SSH is running:

sudo systemctl status ssh --no-pager
sudo ss -tulpn | grep ':22'

6. Troubleshoot in this order

  1. Does tailscale status show both devices online?
  2. Can the Ubuntu server open the service locally?
  3. Is the service listening on more than 127.0.0.1?
  4. Does the Ubuntu firewall allow traffic on the Tailscale interface?
  5. Do tailnet access-control rules allow the phone to reach the server?

A quick firewall test on Ubuntu is:

sudo ufw status verbose
ip addr show tailscale0

7. Keep private services private

  • Do not open the same service publicly just because the Tailscale address works.
  • Keep login protection enabled on applications even inside the tailnet.
  • Remove old devices from the tailnet when they are sold, lost, or no longer used.
  • Use device approval and access-control rules when sharing the tailnet with other people.

Official sources