Connecting Remotely — ProRDP

ProRDP has no cloud relay, broker, or account service, and that’s deliberate. Your Mac accepts connections only from the networks it can already reach. There’s no ProRDP server in the middle that could be breached, go down, or see your sessions. The trade-off is that to reach your Mac from outside your home, you bring the device you’re connecting from into your network first, with a VPN.

This page covers three ways to do that, from easiest to most hands-on:

	Tailscale	WireGuard / OpenVPN	Router app (UniFi, ASUS)
Setup effort	Easiest	Moderate	Easy, if your router supports it
Router changes	None	A VPN server, and sometimes one forwarded VPN port	Built into the router
Needs a public IP	No	Yes	Depends on the router
Third-party account	Tailscale	None	Usually the router maker’s

If you’re not sure, use Tailscale. You can switch later without changing anything in ProRDP.

Before you start

Whichever option you choose:

Make sure it works at home first. Connect to your Mac from another device on the same network. If that fails, a VPN won’t fix it. See Getting started.
Use a strong password. Set a long, unique password in the Account pane, and keep Require Network Level Authentication on.
Keep the Mac awake. A sleeping Mac can’t be reached. Leave Keep this Mac awake set to Always.
Keep ProRDP and macOS up to date. See Updates.

Tailscale (recommended)

Tailscale is a mesh VPN built on WireGuard. Every device you sign in gets a private address that only your other devices can reach. It needs no router changes and no port forwarding, and it works even when your provider doesn’t give you a public IP address.

Set up Tailscale

Install Tailscale on your Mac. Download it from tailscale.com/download. Tailscale recommends its Standalone variant for macOS; the Mac App Store version also works. Don’t install both.
Sign in. Open Tailscale from the menu bar, choose Log in, and sign in with Google, Microsoft, Apple, GitHub, or another supported provider. Approve the VPN or system extension prompt macOS shows.
Turn on Launch at login in Tailscale’s settings, so the Mac rejoins after a restart.
Install Tailscale on the device you’ll connect from (Windows, Mac, iPhone, iPad, Android, or Linux) and sign in with the same account.
Turn off key expiry for the Mac. By default, Tailscale asks each device to sign in again every few months, which would cut you off while you’re away. In the admin console, open the … menu next to your Mac and choose Disable key expiry.
Connect. In your RDP client, add your Mac by its Tailscale name (shown in the admin console, like mac-mini) or its Tailscale address, which starts with 100.. Sign in with your ProRDP username and password.

Test it once from outside your network, for example from a laptop tethered to your phone with Wi-Fi off, before you rely on it on a trip.

How Tailscale carries your session

Tailscale connects your devices directly whenever it can. When a direct path isn’t possible, it relays the traffic through its own servers, but the traffic stays end-to-end encrypted with WireGuard, so the relay can’t read your session. Tailscale’s coordination service does know which of your devices exist and are online.

If you’d rather not depend on a third-party service at all, use a self-hosted VPN instead.

WireGuard or OpenVPN

The self-hosted approach is to run a VPN server on your home router, then connect to it with a VPN app wherever you are. Once you’re connected, your laptop or phone is effectively on your home network.

WireGuard is the better choice if your router offers it. It’s fast, simple to configure, and silently ignores anyone without a valid key, so scanners can’t even tell it’s there.
OpenVPN is older and slower, but supported almost everywhere, including on routers that don’t offer WireGuard yet.

Many routers include one or both, including models from ASUS, GL.iNet, Firewalla, Ubiquiti, and TP-Link, and firewall software like pfSense and OPNsense. Menu names differ between makers, so use your router’s own documentation alongside these steps.

Set up the VPN server

Give your Mac a fixed address. In your router’s DHCP settings, reserve an IP address for the Mac, like 192.168.1.20, so it doesn’t change while you’re away.
Turn on the VPN server. In your router’s admin page, find the VPN Server section and enable WireGuard or OpenVPN. Note the port it uses: WireGuard defaults to UDP 51820, and OpenVPN to UDP 1194.
Set up dynamic DNS. Your home’s public IP address can change. Most routers have a DDNS setting that gives you a stable name, like myhome.asuscomm.com. Use that name in your VPN profiles instead of the IP address.
Forward only the VPN port, if needed. Routers usually open their own VPN port. If your router sits behind a separate modem or another router, forward the VPN port to it, and nothing else. Never forward 3389.
Create a profile for each device. Add a WireGuard peer or OpenVPN client for every device you’ll connect from. Give each one its own profile, so you can revoke a lost phone without affecting the others.

Connect from your device

Install the VPN app.
- WireGuard: the official app for macOS, iPhone and iPad, Windows, Android, or Linux, all from wireguard.com/install.
- OpenVPN: OpenVPN Connect, or the open-source Tunnelblick on a Mac.
Import the profile. Open the .conf (WireGuard) or .ovpn (OpenVPN) file from your router, or scan the QR code it shows from the mobile app.
Turn the tunnel on, then connect your RDP client to the Mac’s local address, like 192.168.1.20. Some VPNs don’t pass .local names through, so use the IP address if mac-mini.local doesn’t work.

Keep in mind: this needs a public IP address on your router. Many mobile, satellite, and some fiber providers use carrier-grade NAT, which makes a home VPN server unreachable. If your router’s WAN address starts with 100.64–100.127, 10., 172.16–172.31, or 192.168., you’re probably behind one, and Tailscale is the simpler fix.

Router remote access apps

Some router makers wrap their VPN server in their own app, so you get a self-hosted VPN without creating profiles by hand. These only work with that maker’s routers, and the exact menus change between firmware versions, so check your router’s documentation if a step doesn’t match.

UniFi Teleport and WiFiman

If you have a UniFi gateway, Ubiquiti’s Teleport is a one-click VPN built on WireGuard, and the WiFiman app connects to it. WiFiman Desktop runs on macOS and Windows, and the WiFiman mobile app runs on iPhone, iPad, and Android.

In the UniFi Network app, open Settings and find Teleport in the VPN settings (Teleport & VPN on some versions). Turn it on and apply the change.
Make sure WiFiman support is enabled in the Network app’s System settings.
Back in Teleport, generate an invitation link. Each link works for one device and expires after 24 hours. Anyone who has it can join your network, so send it only to yourself.
Install WiFiman on the device you’ll connect from, then open the link. It opens WiFiman, or you can paste it in.
Accept the invitation and allow WiFiman to install its VPN configuration.
With Teleport connected, connect your RDP client to the Mac’s local address, like 192.168.1.20.

Repeat steps 3–5 for each device.

ASUS Instant Guard

Many ASUS routers support Instant Guard, a one-tap VPN back to your router, with no VPN client or profile to configure. It requires a public IP address on your router, and the app is available only for iPhone and Android, so it’s a good fit for connecting from a phone or tablet, but not from a laptop.

Make sure your router’s firmware is up to date and that your model supports Instant Guard.
In the ASUS Router app on your phone, turn on Remote Connection for your router.
Install Instant Guard from the App Store or Google Play.
In the ASUS Router app, open Settings and choose Instant Guard. It opens Instant Guard with your router already added.
Tap the connect button to start the VPN, then connect your RDP client, such as Windows App, to the Mac’s local address.

Other routers have their own equivalents, such as GL.iNet’s and Firewalla’s apps. Check what yours offers before installing anything else.

Make the connection faster

An internet link, especially your home’s upload speed, is much slower than your home network. In the Experience pane:

Lower Max frame rate to 24 fps, the setting meant for slower links.
Lower Max bitrate to 20 or 40 Mbit/s, so video doesn’t ask for more than your home upload can deliver.
Try Enable UDP in the Connection pane. On links with latency or packet loss it avoids stalls. It’s experimental, so turn it off again if you have trouble.