Tailscale Access Without Root Privileges: Android as a Network Gateway with Termux

Termux and Taiscale to use Android as a fully functional server

In the world of computer security and system administration, we often come across machines where we cannot or do not want to install software that requires administrator privileges. Whether because of corporate policies, security, or simply to keep a clean system, the need to access private networks without compromising the host system is real.

Today I share with you an elegant solution: using an Android device as a bridge to reach your whole Tailscale network, without installing absolutely anything with root privileges on your main machine.

The Architecture

macOS ──► Android ──► Tailscale ──► Servers
  │       (Termux)    Network
  │           │                         ▲
  └─SSH──────►│                         │
            socat tunnels───────────────┘

Software Stack

On Android:

Tailscale: Official app from the Play Store
Termux: Terminal emulator and Linux environment
OpenSSH: SSH server in Termux
socat: Tool to create network tunnels

On macOS/Linux:

SSH: The system’s native client (nothing else!)

Step by Step Configuration

1. Set Up Android as an Exit Node

In the Tailscale app on Android:

Go to Settings → Exit node
Enable «Run as exit node»
Approve the node from the Tailscale admin console

2. Prepare Termux

Install Termux from F-Droid or the Play Store, then:

# Actualizar e instalar herramientas necesarias
pkg update && pkg upgrade
pkg install openssh socat net-tools

# Iniciar servidor SSH
sshd

Termux’s SSH server listens on port 8022 by default.

3. Enable the Hotspot and Connect

Enable the hotspot/tethering on Android
Connect your machine to the hotspot
Find the gateway IP (which will be Android):

# En macOS/Linux
route -n get default | grep gateway

4. Create Tunnels with socat

Once connected by SSH to Termux:

# Conectar a Termux desde tu máquina
ssh -p 8022 u0_aXXX@IP_GATEWAY

# En Termux, crear túnel hacia servidor en Tailscale
socat TCP-LISTEN:2222,fork,reuseaddr TCP:100.x.x.x:22

Where 100.x.x.x is the Tailscale IP of the destination server.

5. Connect to the Final Server

From your machine, you can now connect to the remote server through the tunnel:

ssh -p 2222 usuario@IP_GATEWAY

Use Cases

This setup is perfect for:

Corporate machines where you cannot install VPNs
Temporary systems where you do not want to leave a trace
Remote debugging when you need quick access
Keeping a clean system without extra daemons

Optimisations and Automation

For frequent use, you can:

Set up SSH keys for passwordless access
Use tmux in Termux to keep persistent sessions
Create scripts that automate IP detection and tunnel creation
Set up multiple tunnels for different servers at the same time

Security Considerations

Only use it on networks you trust (your own hotspot)
Configure SSH with key authentication, never a password
The traffic between Android and the servers travels encrypted by Tailscale
The hotspot creates an isolated network between your device and Android

Conclusion

This solution shows that with a bit of creativity we can get around technical limitations without compromising security. Android becomes a powerful network gateway, Tailscale provides the secure connectivity, and your main machine stays clean and without system modifications.

The result? Full access to your private infrastructure using only standard tools and a phone you probably already carry with you.

Have you implemented similar solutions? What other creative uses would you give this architecture? Share your ideas in the comments.