You can securely wake a self-hosted gaming PC from outside your home, but a Tailscale subnet route does not carry a Wake-on-LAN broadcast by itself. The reliable pattern is to use an always-on device on the PC’s LAN as a relay: connect to that relay through Tailscale, then have it send the magic packet locally. This guide shows how to set up that path, restrict access, and treat a smart plug as a cautious fallback.
This is for a physical PC you own and stream from. A rented cloud VM normally needs its provider’s start, stop, or API controls; a home LAN relay cannot wake a virtual machine in a provider’s data center.
Why a subnet router needs a local WoL relay
Wake on LAN over internet Tailscale combines two jobs that happen at different network layers. Tailscale connects devices and routes IP traffic at Layer 3. Traditional WoL uses a Layer 2 Ethernet frame containing the target network adapter’s MAC address. A subnet router can provide remote access to devices on your LAN, but it does not turn a remote client’s connection into the local broadcast frame the sleeping PC listens for.
Put a small, always-on Linux computer, NAS, or other supported host on the same LAN as the gaming PC. The remote laptop or phone reaches that host over your tailnet. The host then runs a local WoL utility on its Ethernet connection. Tailscale describes this relay pattern in its Wake-on-LAN guide; its subnet-router documentation explains that subnet routers route traffic between IP networks.
| Component | Role | What it does not do |
|---|---|---|
| Tailscale client on your remote device | Authenticates and connects you to your tailnet | Does not power the PC directly |
| Always-on LAN relay / subnet router | Accepts an authorized remote session and sends WoL locally | Does not make WoL a routed Layer 3 packet |
| Gaming PC NIC and firmware | Listen for a supported wake signal while standby power is available | Cannot listen when AC power is cut or wake support is disabled |
For broader privacy context, see our Tailscale mesh VPN guide.
Prepare the gaming PC before configuring remote access
Start with a local test. WoL depends on the motherboard, Ethernet adapter, driver, firmware, and power state. Prefer wired Ethernet, enable supported wake options in firmware and the NIC driver, and record the wired adapter’s MAC address. A Wi-Fi MAC will not wake the Ethernet interface.
Test from another device on the LAN in the sleep state you plan to use, then test shutdown separately. Some systems wake from sleep but not shutdown because standby power is removed. Windows behavior varies by power state and Fast Startup settings; Microsoft’s WoL behavior documentation describes those limits. Check your motherboard and NIC documentation before relying on shutdown WoL.
Reserve or document the relay and PC addresses. A guest network or isolated VLAN may block the relay from reaching the PC’s broadcast domain; do not weaken network isolation just to make WoL work.
Our remote gaming PC WoL setup guide covers local PC-side preparation. This article focuses on the extra remote-access and relay path.
Set up an always-on Tailscale subnet router
Choose a device that stays powered on the PC’s wired LAN, such as a Linux mini PC or single-board computer. Install Tailscale, sign it into the tailnet, and enable IP forwarding as required. If you need to reach other non-Tailscale LAN devices after the PC starts, advertise the LAN’s actual subnet. For example:
sudo tailscale set --advertise-routes=192.168.1.0/24Replace the example with your actual subnet. Approve the route in the admin console, then use a policy to limit which users or devices can reach it; route approval and access policy are separate. Follow Tailscale’s subnet-router setup guide for platform-specific forwarding steps.
Connect to the relay’s Tailscale identity directly; the phone does not need to route a broadcast. Enable Tailscale SSH on a supported Linux relay or use SSH firewalled to tailnet access. Follow Tailscale’s SSH guide and restrict who can open a shell. Do not expose SSH or WoL ports on the public router.
Advertise only the subnet you need and review the policy scope: a route may expose more LAN services than the PC alone.
Send the Wake-on-LAN packet from the relay
Install a WoL utility on the relay and test it at home. Tailscale’s Raspberry Pi example uses etherwake to send to the PC’s wired MAC address:
sudo etherwake 00:11:22:33:44:55Replace the sample with the PC’s Ethernet MAC. If the relay has multiple adapters, select the correct LAN interface using your utility’s documented syntax. Keep both devices on the same LAN or VLAN; Tailscale’s relay walkthrough also assumes the PC is configured for WoL.
Once local wake works, switch your phone or laptop to cellular or another remote network, connect to Tailscale, and open an authorized SSH session to the relay. Run the same command. A subnet route can provide access to LAN services after boot, but the relay—not the route—sends the WoL frame.
A successful command only means the relay attempted to send a packet. Check a separate signal—host ping, the PC’s Tailscale connection, or the streaming service—to confirm each boot stage.
If you prefer a dashboard button instead of SSH, expose a small wake action only inside the tailnet and require authentication. Home Assistant’s Wake-on-LAN integration can send a magic packet, but the sender still needs to be local to the target network. See our existing Home Assistant and smart-plug WoL automation guide for a different control workflow.
Make a smart plug a conditional failsafe, not the WoL switch
A WoL smart plug failsafe is easy to misunderstand: when off, the plug removes AC, so the NIC has no standby power and cannot hear WoL. Leave it on for normal wake operation.
A smart plug may provide a cold-start fallback if firmware has an “AC Power Recovery” or similar option set to power on. Restoring AC may then boot the PC without WoL, but behavior varies by board. Test it locally and read the manual; this is power restoration, not a magic packet.
Do not cut power to shut down a running PC. First request a normal operating-system shutdown and verify it completed. If the relay cannot confirm the state, leave the plug on. A smart plug cannot make an abrupt power cut safe for unsaved work or active storage writes.
Use the plug only for a PC that is already shut down or otherwise verified safe. Never turn it off on a ping timeout: the PC may be asleep or ICMP may be blocked.
Test each layer and troubleshoot in order
Validate the chain from the PC outward, changing one thing at a time:
- Wake the PC from sleep on the local LAN and confirm the wired MAC and firmware settings.
- Run the WoL utility on the relay while at home; confirm it uses the PC’s local broadcast domain.
- Connect to the relay over Tailscale from a mobile network and run the same local command.
- Approve the route and test access to one intended LAN service; verify the tailnet policy does not allow more than required.
- Test the optional AC-restore fallback only after a normal shutdown, with someone available to observe the first boot.
If local wake fails, check the PC power state, NIC, MAC, relay interface, and VLAN. If only remote access fails, check Tailscale sign-in, route approval, forwarding, SSH, and policy. If the PC wakes but will not stream, troubleshoot the OS and streaming service separately.
This is a documentation-based setup guide, not a hands-on test of a particular motherboard, smart plug, or Tailscale installation. Wake support, cold-start behavior, and boot time depend on your hardware and configuration; validate them before automating unattended power actions.
Use the subnet router for access and the relay for wake
The secure design is simple once the two jobs are separate: Tailscale lets an authorized remote device reach your always-on relay, and the relay sends the WoL packet locally. Advertise a subnet only when you need routed access to other LAN services, restrict that access with tailnet policy, and keep public router ports closed. Leave AC available for ordinary WoL; reserve the smart plug’s AC-restore behavior for a tested, deliberate fallback.
For more self-hosted setup and remote-access guides, explore the Cloud PC section on 9GG CLOUD.
