Your Windows PC reaches your Mac with Remote Desktop Connection (mstsc.exe). Then you leave the building, and that address goes nowhere.

The quick fix people search for is "forward port 3389 on the router". Please don't. Here is the setup we document instead, with the limits we know about.

Windows Remote Desktop Connection showing a Mac desktop (local network)
mstsc connected to a Mac over the local network. Over a VPN only the address you type changes (we have not tested that route end to end yet, see below).

Why not forward 3389?

Port 3389 is one of the most scanned ports on the internet. If you forward it from your router to the Mac, anyone can try to log in to that machine, all day. A VPN gives the Windows PC a private path to the Mac, so the router stays closed.

The setup: Tailscale on both devices

Tailscale is one VPN that is easy to set up for this. Any VPN that gives the Windows PC a route to the Mac works the same way.

  1. On the Mac, install Tailscale and sign in.
  2. On the Windows PC, install Tailscale and sign in to the same Tailscale account. Keep it running on both.
  3. Find the Mac's Tailscale address. It starts with 100.. (In RDPyon, the menu bar item "Enter this address in mstsc" lists it with a "VPN" label and copies ip:port. The default port is 3389.)
  4. On Windows, open mstsc and paste that address into the Computer field.

That's it. No port forwarding, no dynamic DNS.

If it does not connect

  • Both devices online in Tailscale? Both must be running and signed in to the same account. Copy the 100.x address again; don't type it from memory.
  • Mac firewall. In System Settings > Network > Firewall, make sure "Block all incoming connections" is off, or that the RDP server app is allowed.
  • The Mac must be awake and logged in. It fails with the lid closed, and right after a reboot before FileVault is unlocked. Before you leave: power adapter in, lid open.
  • Slow? Tailscale connects devices directly when it can. When it can't, traffic goes through its DERP relay, which can be slower.

The licence catch

Tailscale's Personal plan is free (up to 6 users, unlimited devices per user), but it is for non-commercial use only. If this is for company work, use a paid Tailscale plan or your company VPN. Check Tailscale's pricing page for the current terms.

What we have not tested yet

We have tested mstsc to a Mac on the local network many times. We have not yet tested the Tailscale route end to end: neither the connection itself nor latency, direct or via DERP. We'll add results when we have them, rather than guess.

Where the Mac side comes from

Disclosure: we build RDPyon, a small Mac app that lets the built-in Windows mstsc connect to a Mac over RDP, with no account or relay server of its own. It's a paid app (one-time purchase) with a free trial.

The full guide, with the same steps and an FAQ, is here: https://devjar.dev/go/G-1389

If you already reach a Mac from outside another way, we'd like to hear which VPN you use and what broke.