Nico Delgado_ Tell me your idea →

Field guide — iOS · Termius · Tailscale · SSH

SSH into your Mac and your VPS from your iPhone.

Build a private WireGuard network with Tailscale, then connect with Termius using SSH keys. Set up once, connect from anywhere in the world.

~20 min setup Free tools No open ports in between
An iPhone running Termius connects through the Tailscale network to a Mac and a VPS, each with its own 100.x.x.x address IPHONE termius TAILNET wireguard MAC 100.x.x.x VPS 100.x.x.x
every device gets a stable 100.x.x.x address inside your private tailnet

What you need#

  • An iPhone with Termius installed — the free tier is enough for this guide.
  • A Mac you can sit in front of once, to set things up.
  • A Linux VPS (Ubuntu/Debian assumed below) with root or sudo access.
  • A free Tailscale account — sign in with Google, GitHub or Apple. The free plan covers up to 100 devices.
  • Basic comfort with a terminal: run a command, edit a file.

Why Tailscale?It creates an encrypted WireGuard mesh ("tailnet") between your devices. Each one gets a stable private IP (100.x.x.x) and a name. Your Mac becomes reachable from your phone anywhere in the world — without opening ports on your router — and your VPS can stop exposing SSH to the whole internet.

Install Tailscale on all three devices#

All three must be logged into the same Tailscale account.

MacDesktop app

  1. Download Tailscale from tailscale.com/download (or the Mac App Store) and install it.
  2. Open it, click Log in, and authenticate in the browser.
  3. The menu-bar icon turns active. Click it — you'll see your Mac listed with its tailnet IP.

VPSOne-line install

vps — ssh
$ curl -fsSL https://tailscale.com/install.sh | sh
$ sudo tailscale up
To authenticate, visit: https://login.tailscale.com/a/xxxxxxxx

Open that URL in any browser, log in, and the VPS joins your tailnet. Confirm with:

vps — ssh
$ tailscale ip -4
100.101.102.103

iPhoneiOS app

  1. Install Tailscale from the App Store and log in with the same account.
  2. Toggle the VPN on and accept the VPN configuration prompt.
  3. The app now lists all your devices — your Mac and your VPS, each with a 100.x.x.x IP.

MagicDNSIn the Tailscale admin console (DNS tab), enable MagicDNS if it isn't already. Then you can use names like my-macbook and my-vps instead of memorizing IPs. Both work in this guide — use whichever you prefer.

Enable SSH on the Mac#

macOS ships an SSH server, but it's off by default.

  1. Open System Settings → General → Sharing.
  2. Turn on Remote Login.
  3. Under "Allow access for", pick Only these users and select your user account — tighter than "All users".

Find your Mac username — you'll need it for Termius:

mac — terminal
$ whoami
nico

Keep it awakeA sleeping Mac won't answer SSH. If you want it always reachable, set System Settings → Energy (or Battery → Options on laptops) to prevent sleep when plugged in, or enable "Wake for network access".

Check SSH on the VPS#

Almost every VPS already runs an SSH server — that's how you log into it. Verify:

vps — ssh
$ systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
     Active: active (running)
# On some distros the unit is called sshd instead of ssh

Nothing else is required for now. In Step 08 we'll use Tailscale to stop exposing SSH to the public internet entirely — one of the biggest wins of this setup.

Generate an SSH key in Termius#

SSH keys replace passwords: the private key stays on your iPhone, and each server gets a copy of the public key. More secure, more convenient.

  1. Open Termius → Keychain (bottom tab).
  2. Tap + → Generate Key.
  3. Name it (e.g. iphone-key), choose type Ed25519, and optionally set a passphrase.
  4. Save. Then open the key and copy the public key — a single line starting with ssh-ed25519 AAAA…. Send it to yourself (AirDrop, Notes, email — the public key is safe to share).

Never share the private keyOnly the public key leaves your phone. If anything ever asks you to paste the private key into a server, something is wrong.

Install the public key on both hosts#

MacAdd to authorized_keys

In Terminal on the Mac, paste your public key into the command below (keep the quotes):

mac — terminal
$ mkdir -p ~/.ssh && chmod 700 ~/.ssh
$ echo "ssh-ed25519 AAAA... iphone-key" >> ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys

VPSSame idea

vps — ssh
$ mkdir -p ~/.ssh && chmod 700 ~/.ssh
$ echo "ssh-ed25519 AAAA... iphone-key" >> ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys

Permissions matterSSH silently refuses keys if ~/.ssh isn't 700 or authorized_keys isn't 600. The chmod lines above are not optional.

Create the hosts in Termius & connect#

With the Tailscale VPN toggled on on your iPhone:

  1. Termius → Hosts → + → New Host.
  2. Mac:
    • Address: the Mac's tailnet IP (e.g. 100.64.0.12) or its MagicDNS name (e.g. my-macbook)
    • Username: your Mac user (from whoami)
    • Key: select iphone-key from the Keychain
  3. VPS: same thing — tailnet IP or MagicDNS name, your VPS username (e.g. root or ubuntu), same key.
  4. Tap each host to connect. First time, accept the host fingerprint.

✓ Full shell on your Mac and your VPS — from anywhere, over an encrypted private network.

Hardening & troubleshooting#

Lock down the VPS (recommended)

Since SSH now works over Tailscale, you can stop answering SSH from the public internet:

vps — ssh
# 1. Disable password logins (keys only)
$ sudo nano /etc/ssh/sshd_config
#    set:  PasswordAuthentication no
$ sudo systemctl restart ssh

# 2. Firewall: allow SSH only from the tailnet
$ sudo ufw allow in on tailscale0 to any port 22
$ sudo ufw delete allow 22   # remove the old public rule if present
$ sudo ufw enable

Test before you close the doorConfirm your Termius-over-Tailscale connection works before removing the public port-22 rule, or you can lock yourself out. Keep your provider's web console as a rescue hatch.

If a connection fails, check in this order

SymptomLikely cause & fix
Timeout / unreachableTailscale VPN is off on the iPhone, or the target device is offline / asleep. Open the Tailscale app — all three devices must show as connected.
Connection refusedSSH server isn't running: Remote Login is off on the Mac, or ssh.service is stopped on the VPS.
Permission denied (publickey)Wrong username, key not attached to the host in Termius, or bad permissions on ~/.ssh — redo the chmod lines in Step 06.
MagicDNS doesn't resolveMagicDNS not enabled in the admin console, or the iPhone joined a different tailnet account. Fall back to the 100.x.x.x IP.
Works at home, not awayThe Mac went to sleep. Adjust energy settings (Step 03) or keep it plugged in with sleep disabled.

Nice extras

  • tmux on both hosts keeps sessions alive if your phone drops the connection: tmux new -s main, later tmux attach -t main.
  • Termius snippets let you save frequent commands and run them with one tap.
  • Tailscale's Tailscale SSH feature can even replace key management on Linux hosts — worth exploring once this setup feels comfortable.

Who wrote this

I build software for a living.

I'm a one-person product studio: SaaS, native mobile apps, and AI automation, built end to end. Same person designs it, writes it and ships it. If you have something you want built, tell me what it is — an assistant will walk you through it in a few minutes and I'll read every word.

Tell me your idea →