The project started from a practical constraint: there was no administrative access to the home router. Without router-level control (port forwarding or VLANs), remote access and monitoring needed to be implemented without modifying the network infrastructure itself.
Initial approach
The first step was to place individual devices on a mesh VPN so they could be reached remotely without touching the router. Tailscale was selected for its low-friction WireGuard-based overlay: it quickly creates encrypted connectivity between nodes and removes the need for router configuration changes for basic remote access.
Subnet routing for non‑client devices
Many home devices (smart home appliances, cameras, embedded controllers) cannot run a VPN client. To make those reachable, a subnet router approach was used: one or more machines on the LAN advertise routes into the tailnet so clients on the tailnet can reach devices on the LAN without direct access. This preserves reachability while avoiding changes at the physical router.
Eliminating single points of failure
A single subnet router is a single point of failure. To avoid losing remote access when one node goes down, multiple nodes were configured to advertise the same routes. Tailscale handles automatic failover between advertising nodes so the tailnet continues to reach the LAN via an available subnet router.
Monitoring the monitors
Redundancy in routing only helps when someone notices a failure. To avoid creating a monitoring single point of failure, two monitoring instances were deployed (Uptime Kuma). Each monitor checks the set of subnet routers and also watches the other monitor, creating a cross-check that reduces the chance of blind spots in monitoring.
Security monitoring and integration
Once the access layer was resilient, security monitoring was layered on top. Wazuh was deployed across the router nodes to collect host telemetry and correlate events. A Kismet instance on one node provides wireless detection and forwards deauth alerts into Wazuh (via syslog), while an object-detection camera (Frigate) provides physical detection signals. The goal was to make remote access and monitoring mutually reinforcing rather than creating separate fragile systems.
Operational notes and limitations
The approach works well when multiple reliable nodes are available, but it does add operational complexity (route approval in the Tailscale admin console, keeping subnet routers patched and online, and ensuring monitors remain reachable). Where router admin access is available, integrating required routing changes at the router level can be simpler; this design is a practical workaround when that access is not possible.
Lessons learned
Building redundancy early and testing failover behaviour proves valuable: automated failover is only useful if it is exercised and monitored. When designing resilient systems, map failure modes across routing, monitoring, alerting, and response so remediations don't unintentionally introduce new blind spots.