Remote access to your rig and ASICs: Tailscale, ZeroTier and Hive Shell without port forwarding

Forwarding port 80 or 22 on your router is the fastest way to hand your ASICs to strangers: scanners find an exposed Antminer within hours, and half of them still use root/root. This guide covers three working ways to reach your rig and ASICs from anywhere without a public IP or open ports: Tailscale (the main option — set it up once and it runs for years), ZeroTier (if Tailscale doesn't fit for some reason) and Hive Shell (the HiveOS rig console straight from a browser). Everything was tested on a Windows rig, HiveOS and Antminer S19/S21 without installing anything on the ASIC itself.

📌 Status as of 11 September 2026: Tailscale reworked its plans on 8 April 2026 — the free Personal plan now covers 6 users, unlimited devices and 50 tagged resources. Free ZeroTier has been limited to 10 devices and one network since 2025. Hive Shell in HiveOS works unchanged.

How it works and why you don't need a public IP

All three tools build an encrypted tunnel outward — from the rig to a coordination server — and use it to connect your phone or laptop to the rig directly. The router sees an ordinary outbound connection, like a browser. Nothing inbound, nothing open, and a carrier-grade NAT address from your ISP doesn't get in the way.

The difference between the tools:

Tailscale is enough for 95 % of farms. ZeroTier makes sense if you specifically need layer 2 (broadcast) or already run a ZeroTier network. Hive Shell is an add-on for HiveOS users: a console without VPN, but it can't open an ASIC's web interface. How to install HiveOS from scratch and connect a rig to the dashboard is in Hive OS: install, set up and run a miner — the complete guide.

Method 1. Tailscale: the rig as a gateway to the ASIC network

The idea: Tailscale is installed on one machine in the farm's LAN — a Windows or HiveOS rig, an old laptop, a Raspberry Pi. That machine becomes a subnet router and advertises the whole 192.168.x.0/24 subnet. After that, a phone in another city opens http://192.168.1.50 — the Antminer web UI — as if you were at home.

Step 1. Account and phone client

Sign up at Tailscale with Google, Microsoft, Apple or GitHub. Install the Tailscale app on your phone and laptop and sign in with the same account. Each device shows up in the admin console under Machines.

Step 2. Client on the rig

Windows rig. Download the installer from the Tailscale site, install it, sign in. Then in PowerShell as administrator:

tailscale up --advertise-routes=192.168.1.0/24

Replace 192.168.1.0/24 with your subnet: check with ipconfig — if the rig's address is 192.168.0.15, the subnet is 192.168.0.0/24.

HiveOS rig. Open Hive Shell or connect via SSH and run:

curl -fsSL https://tailscale.com/install.sh | sh
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-dns=false

tailscale up prints a link — open it in a browser on your phone or laptop and confirm adding the rig. The --accept-dns=false flag keeps Tailscale from touching the rig's DNS; otherwise the miner may fail to resolve the pool after a reboot.

💡 On HiveOS, packages installed via apt survive a regular selfupgrade but do not survive an image reinstall via hive-replace. After replacing the image, install Tailscale again.

Step 3. Approve the route in the admin console

In the Tailscale admin console open Machines → your rig → Edit route settings → enable the advertised subnet. Without this step the route doesn't work — the single most common cause of "I did everything and the ASIC won't open".

While there, click Disable key expiry for the rig: otherwise the device key expires after 180 days and you lose access while away.

Step 4. Open the ASIC from your phone

Enable Tailscale on the phone and make sure subnet routes are accepted (default on iOS and Android; Linux clients need --accept-routes). Open http://192.168.1.50 in the browser — the Antminer web interface. WhatsMiner, the router admin page and BTC Tools scanning the whole farm subnet from a laptop all work the same way.

⚠️ Important. The home subnet and the farm subnet must not overlap. If both are 192.168.1.0/24, the phone will try to open the ASIC on your home network. The fix is to change the farm's subnet (e.g. to 192.168.50.0/24) — Tailscale's 4via6 feature also solves this, but reconfiguring the farm router is simpler.

Step 5. Lock access down to yourself

By default on the free plan every device in your Tailscale network can see every other. If other people touch the rig (a partner, a hosting provider), leave only your own devices in Access controls. A minimal policy that grants subnet access to members only:

{
  "acls": [
    { "action": "accept", "src": ["autogroup:member"], "dst": ["192.168.1.0/24:*"] }
  ]
}

Method 2. ZeroTier: if Tailscale doesn't fit

ZeroTier does the same job, but the network is created manually and the route into the ASIC subnet is set in the web panel. The free plan limit at the time of publication is 10 devices and one network — enough for a rig, a laptop and a phone.

Step 1. Network

At ZeroTier create a network (Create A Network) and note its 16-character Network ID. In the network settings enable Private so devices connect only after your approval.

Step 2. Clients

Windows rig: install ZeroTier One, tray icon → Join New Network → paste the ID. HiveOS:

curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join YOUR_NETWORK_ID

In the ZeroTier panel under Members tick Auth for every new device. Phone — the ZeroTier One app, same Network ID.

Step 3. Route into the ASIC subnet

In the network panel, Managed Routes section, add a route: Destination 192.168.1.0/24, Via — the rig's ZeroTier address (shown in Members, like 10.147.x.x). On the rig enable forwarding and NAT:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i zt+ -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o zt+ -m state --state RELATED,ESTABLISHED -j ACCEPT

Replace eth0 with your interface name from ip a. iptables rules don't survive a reboot — add them to /hive/etc/rc.local (HiveOS) or install iptables-persistent. On a Windows rig you'd use Internet Connection Sharing (ICS) on the ZeroTier adapter instead — noticeably more finicky, which is why Tailscale is easier for Windows farms.

After that, http://192.168.1.50 from the phone opens the ASIC just like in method 1.

Method 3. Hive Shell: the HiveOS console from a browser

If all you need is the rig console — restart the miner, read logs, fix a config — Hive Shell works without VPN and without installing anything. In the Hiveon web panel open the worker → Remote Access → Hive Shell Start. A few seconds later a link like https://shell.hiveos.farm/... appears — that's the rig's terminal in your browser. The link lives while the session is active; Hive Shell Stop closes it.

The same from the console:

hssh start
hssh stop

Hive Shell also works from PuTTY: generate a key in PuTTYgen, add it to the rig profile, host — shell.hiveos.farm. That's more convenient for pasting long commands from a laptop.

💡 Locally on the rig's network, Shellinabox is always available at https://RIG_IP:4200/, login user, password 1. Through Tailscale it opens too — without starting Hive Shell.

What Hive Shell can't do: show an ASIC's web interface or a Windows rig's desktop. For that you need method 1 or 2. They combine well: Tailscale for the ASICs, Hive Shell when you need to hand a colleague one-off console access via a link.

What about the Antminer itself: passwords and ports

Neither Tailscale nor ZeroTier can be installed on an Antminer — the firmware is closed and SSH is disabled on stock. The ASIC is reachable only through the subnet router. But do three things on the ASIC itself:

1. Change the web interface password. Stock is root/root on S19/S21 and root/admin on older models. Even inside the VPN it's worth changing: guests of your network use the same tunnel.
2. Make sure the router has no forwards for 80, 4028 (cgminer API) and 22 to the ASIC. Check Port Forwarding / Virtual Server. If there were any — delete them after the VPN is set up.
3. Don't enable UPnP on the farm router: some ASIC firmware and monitoring tools open ports outward on their own.

🔒 Hive Shell links and Tailscale keys are access to the farm. Don't forward them in open chats. If someone saw a Hive Shell link — stop the session; the next one gets a different address.

Common mistakes

Tailscale is connected, but the ASIC won't open. In 9 cases out of 10 the route isn't approved in the admin console (Edit route settings). The second suspect is overlapping home and farm subnets. The third — the Windows rig went to sleep: in power settings disable sleep and network adapter power-off.

It opens through Tailscale, but slowly. The connection goes through a DERP relay instead of directly — usually because of symmetric NAT on a mobile carrier. Enabling UPnP or NAT-PMP only on the router at home, where the phone is (not on the farm), helps — or just accept it; the relay is fast enough for an ASIC web UI.

Tailscale doesn't start after a HiveOS reboot. Check sudo systemctl status tailscaled. If the service isn't enabled — sudo systemctl enable tailscaled. If the rig was reimaged with hive-replace — reinstall.

The miner won't connect to the pool after installing Tailscale. DNS interception is on. Run sudo tailscale up --accept-dns=false with the same other flags.

ZeroTier: device shows Offline in the panel. Auth wasn't ticked in Members. Or the antivirus on Windows blocks the virtual adapter driver — add ZeroTier to exclusions; the procedure for miners is covered in the Windows Defender article.

Frequently asked questions (FAQ)

Do I need a public IP or a paid ISP add-on? No. All three tools work behind a shared IP, behind carrier-grade NAT and over mobile internet.

Can I put Tailscale directly on the farm router so the rig isn't involved? Yes, if the router runs OpenWrt, Keenetic with Entware, MikroTik RouterOS 7 or Ubiquiti. Then the router itself is the subnet router, and the ASICs stay reachable even when the rig is off. For a plain ISP router, a Raspberry Pi or any laptop on the LAN is simpler.

How many devices are free? Tailscale at the time of publication — unlimited devices with 6 users; ZeroTier — 10 devices and one network. Both are enough for a home farm with one or two rigs.

Does this work with BTC Tools and WhatsMinerTool? Yes. Run the tool on a laptop with Tailscale and set the scan range to the farm subnet — it finds the ASICs through the tunnel. Scanning is slower than on the LAN, but it works.

What's safer: Tailscale or a port forward with a long password? Tailscale. A forward is an open port the whole internet sees; a long password doesn't protect against vulnerabilities in the ASIC firmware itself. A VPN tunnel isn't visible from outside at all.

Can I monitor ASICs without VPN — just through an app? For monitoring — yes: Hiveon for ASICs, Foreman, Awesome Miner Cloud. But managing (changing pools, flashing firmware, opening the web UI) through them is either impossible or paid. A VPN gives full access for free.

This material is for informational purposes only and is not financial advice. Tailscale and ZeroTier plans, client versions and commands are given as of 11 September 2026 and may change.