Tailscale baby monitor: watch away from home with two phones or a Wi-Fi camera, step by step

The short answer

A local baby monitor keeps the picture on your home Wi-Fi. That is the private part. It is also why it stops at the front door. Tailscale fixes that. It is a free app that puts your phones and home devices on one private network, wherever each of them is.

So the phone in your pocket can reach the phone by the crib, at work or across town. Nothing is opened on the router. Tailscale is built on WireGuard, and its own docs say traffic between your devices is encrypted end to end. When a direct path is impossible, a Tailscale relay passes the packets on, but it can't read them.

We use this ourselves, for the baby camera and every other home service. Our home internet sits behind carrier-grade NAT, so nothing outside can reach in at all, and Tailscale still connects. Measured by us in September 2026 on our own setup: the relay gave about 2 MB/s, and the camera stream needs about 0.3 Mbit/s, so even the slow path has room to spare.

What you set up depends on what watches the baby. The table is the whole decision.

Which setup you need, at a glanceThe legend under the table says what each answer means.

What is by the crib	Tailscale on	Effort
An old phone	both phones	easy
Home Assistant camera	server + phone	add-on
Wi-Fi camera, direct	box + phone	advanced
Open router port	nothing	don't

Old phone

An iPhone or Android phone by the crib runs Tailscale itself, and so does your phone: two app installs.

Home Assistant camera

A camera read through Home Assistant or go2rtc: the Home Assistant server runs Tailscale as one add-on.

Wi-Fi camera, direct

A Tapo or Hikvision camera read directly can't run Tailscale: an always-on box at home (a subnet router) shares the route to it, set up on a command line.

Open router port

Nothing to install, and the camera faces the internet. Don't.

How to set it up with two phones

This is the easy case: an old phone by the crib is the camera, and a phone can run Tailscale itself. Pairing the two phones at home is in the two-phone guide. These steps add the away-from-home part.

1. Make a Tailscale account. On tailscale.com, sign in with an Apple, Google, Microsoft or GitHub login. Tailscale has no passwords of its own. Turn on two-step login for that account, since it now guards the nursery.
2. Install Tailscale on the phone by the crib. Get it from the App Store or Google Play. Open it, sign in, and allow the VPN when the phone asks. You should see the phone listed in the app.
3. Install it on your own phone with the same account. Now both phones show up in the list. Leave Tailscale switched on, on both.
4. Connect once at home. With both phones on the home Wi-Fi, start the monitor as usual. The app learns the crib phone's addresses this way.
5. Test it away from home. Turn Wi-Fi off on your phone and watch over mobile data. You should see the crib within a few seconds. If not, open Tailscale on both phones and check that both say Connected.
6. Add every phone that watches. We hit this one: the second parent's phone had the monitor app but not Tailscale, so it worked only at home. Each watching phone needs Tailscale, signed in to your network.

How to reach a Wi-Fi camera through Tailscale

A Tapo or Hikvision camera can't install Tailscale. Something at home has to lend it a connection. Tailscale calls that a subnet router. Its docs list Linux, macOS, Windows, Apple TV and Android as options; ours is a Raspberry Pi. Reading the camera at home first is in the IP camera guide.

Photo: TP-LinkTapo C200no Tailscale

The camera itself can't run it. It needs a box at home to share its route.

Photo: HikvisionHikvision DS-2CD2443G2-Ino Tailscale

The same for any camera read over RTSP: the route comes from the box.

Photo: Laserlicht, Wikimedia CommonsRaspberry Pisubnet router

Ours. A small Linux box that stays on; the command below is for this kind of box.

Photo: Dillan Payne, Wikimedia CommonsApple TVsubnet router

On Tailscale's list too. No command line: the option is in the Tailscale app.

1. Give the camera a fixed address. In your router, look for DHCP reservation and pin the camera to its current address. Otherwise the route breaks the day the router hands out a new one.
2. Install Tailscale on the always-on box and sign in with the same account. On Linux, also turn on IP forwarding, as the subnet router docs show.
3. Share only the camera. On Linux, run sudo tailscale set --advertise-routes=<camera-address>/32. The /32 means one address, as in the route examples. Share just the camera: a whole home range clashes with hotel and friends' Wi-Fi that use the same numbers. On an Apple TV, look for the subnet router option in the Tailscale app.
4. Approve the route. In the admin console, open Machines, pick the box, open its Subnets, tick the route and save.
5. Check your policy file. If you wrote custom grants, add the camera's address to them. Our first test failed with no error until we did: no phone got the route.
6. Test from outside. Turn Wi-Fi off on your phone and open the camera's address. Phones pick up the route by themselves. If the picture times out, check the route shows as approved.

Behind Home Assistant it is simpler. The community Tailscale add-on puts the server itself on your network, and your phone reads the go2rtc stream at the server's Tailscale address instead of its home one. The camera details are in the Home Assistant guide.

Why not open a port or use the maker's cloud?

Opening a port puts the camera on the open internet. The UK's National Cyber Security Centre advises turning port forwarding off for smart cameras. TP-Link's Tapo FAQ says RTSP is for trusted local networks and points to a VPN instead. So don't forward the camera's port "to be sure". Keep the router firewall on too, since with IPv6 home devices can have public addresses.

The maker's cloud is the zero-setup choice, and for some families it is a fair trade. The price is that the nursery passes through someone else's servers, behind an account. The documented cases are in is a baby monitor app safe.

What breaks, and how to tell

• A work laptop won't connect. Company security software can block Tailscale. Phones are the simple case.
• The camera refuses a viewer. Many cameras allow only a couple of viewers at once, and a phone watching from outside takes one. Close the camera's own app, or put go2rtc in front of it.
• It works at home but not outside. Usually that phone is not in your Tailscale network, or Tailscale is switched off on it.
• Travel with the baby. Then both phones are away from home and Tailscale isn't needed: the travel guide covers hotels and hotspots, and the other baby monitor guides cover the rest.

Where Mamoon fits

Mamoon is a baby monitor app: an old phone or a Wi-Fi camera by the crib, your phone as the screen. At home, picture and sound go over your home Wi-Fi, not the internet: no cloud, no account. Away, it switches to Tailscale by itself. The link between the phones is encrypted. If the connection drops, Mamoon turns the screen grey and alerts you after 20 seconds. It does not work away from home without Tailscale, and a direct camera also needs the subnet route above. Sound and cry alerts are free; the picture costs $29.99 once or $3.99 a month after 14 days free.

Frequently asked questions

How these pages are made: an AI model drafts them from our own tests, real app screens and the sources listed, and Jan Drábek checks every page before it goes live.