---
title: Raspberry Pi Zero 2 W as a Tailscale Wake-on-LAN gateway
title_en: Raspberry Pi Zero 2 W as a Tailscale Wake-on-LAN gateway
description: Use a Pi Zero 2 W as an always-on Tailscale node and WoL broadcaster on the LAN, securely waking a home PC from the internet across the L3/L2 boundary. Covers hardware selection, UpSnap deployment, systemd service setup, exposing it over HTTPS with Tailscale Serve, and BIOS/Windows WoL settings on the PC side.
sidebar_label: Pi Zero × Tailscale WoL Gateway
---

# Raspberry Pi Zero 2 W as a Tailscale Wake-on-LAN gateway

> Hardware: Raspberry Pi Zero 2 W ｜ Architecture: Tailscale (L3) + UpSnap (L2 Magic Packet) ｜ Goal: securely wake a home PC from the internet

---

## Architecture

```
Remote device (phone / laptop)
       │
       │ Tailscale encrypted tunnel
       ▼
Raspberry Pi Zero 2 W (always-on)
       │
       │ UpSnap sends Magic Packet
       ▼
Home router (L2 broadcast)
       │
       ▼
PC NIC (wakes the host)
```

**Why the Pi is needed**: Tailscale operates at OSI L3 (network layer), while a WoL Magic Packet is an L2 (data link layer) broadcast. Tailscale can't emit one directly, so an always-on device inside the LAN has to send it on Tailscale's behalf.

**Why the Pi Zero 2 W**:
- Idle power consumption around 0.4 W — roughly NT$12 per year in electricity
- Cheap (about NT$700)
- Quad-core ARM Cortex-A53 at 1 GHz + 512 MB RAM — more than enough for Tailscale + UpSnap
- Wi-Fi is fine — the WoL broadcast goes through the router to the wired PC

---

## Hardware

- Raspberry Pi Zero 2 W (2W is enough — no need for 2WH)
- microSD card (8 GB+, A1 or A2 class recommended)
- USB-C power supply (5 V 2.5 A)
- A PC on the same LAN that supports Wake-on-LAN

---

## Step 1: Flash the OS

1. Download and install [Raspberry Pi Imager](https://www.raspberrypi.com/software/)
2. Pick **Raspberry Pi OS Lite (64-bit)**
   - It must be 64-bit because the UpSnap binary we'll use later is arm64
3. Click the gear icon (advanced settings) before flashing:
   - Hostname: `upsnap` (or whatever you prefer)
   - Enable SSH (password or SSH key, either works)
   - Set Wi-Fi SSID and password
   - Set username and password (examples below use `jeff`)
   - Set locale and keyboard (zh-TW, Asia/Taipei)
4. After flashing, insert the card into the Pi and power it on
5. Wait 1–2 minutes for the Pi to join Wi-Fi

---

## Step 2: SSH into the Pi

```bash
ssh jeff@upsnap.local
# Or by IP: ssh jeff@192.168.x.x
```

Once in, update the system:

```bash
sudo apt update && sudo apt upgrade -y
```

---

## Step 3: Install Tailscale

```bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
```

Open the URL it prints in your browser and log in — the Pi will join your tailnet.

Check the Tailscale IP:

```bash
tailscale ip -4
```

---

## Step 4: Download the UpSnap binary

> ⚠️ Don't download or unzip with `sudo` — it'll cause permission issues later.

```bash
# Switch to home directory
cd ~

# Find the latest version at:
# https://github.com/seriousm4x/UpSnap/releases
# Look for a file named like upsnap_X.X.X_linux_arm64.zip

# Example: version 5.3.2 (replace with the actual latest)
wget https://github.com/seriousm4x/UpSnap/releases/download/5.3.2/upsnap_5.3.2_linux_arm64.zip

# Unzip (if unzip isn't installed: sudo apt install unzip -y)
unzip upsnap_5.3.2_linux_arm64.zip
chmod +x upsnap
```

Confirm the file is owned by the current user (not root):

```bash
ls -la ~/upsnap
# Should show: -rwxr-xr-x 1 jeff jeff ...
```

---

## Step 5: Set capabilities and test the launch

```bash
# Grant the ability to send raw packets (one-off)
sudo setcap cap_net_raw=+ep ./upsnap

# Install nmap (so UpSnap can scan the network for devices)
sudo apt install nmap -y

# Test launch
./upsnap serve --http=0.0.0.0:8090
```

Open `http://<Pi-LAN-IP>:8090` or `http://upsnap.local:8090` in a browser and create the admin account.

Once you confirm you can log in, stop it with `Ctrl+C`.

---

## Step 6: Make it a systemd service (autostart on boot)

```bash
sudo nano /etc/systemd/system/upsnap.service
```

Paste in the following (make sure `User` and the paths match your environment):

```ini
[Unit]
Description=UpSnap Wake-on-LAN
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=jeff
WorkingDirectory=/home/jeff
ExecStart=/home/jeff/upsnap serve --http=0.0.0.0:8090
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
```

Enable the service:

```bash
sudo systemctl daemon-reload
sudo systemctl enable --now upsnap
sudo systemctl status upsnap
```

`active (running)` means it's working.

---

## Step 7: Expose over HTTPS with Tailscale Serve (recommended)

This lets you reach UpSnap from anywhere at `https://upsnap.<your-tailnet>.ts.net`, with no port forwarding and a legitimate TLS certificate.

```bash
sudo tailscale serve --bg --https=443 http://localhost:8090
```

Check status:

```bash
tailscale serve status
```

After that, any device on your tailnet can open the UpSnap UI in a browser.

---

## Step 8: Add the PC in UpSnap

1. Log in to the UpSnap web UI
2. Click **Add device**
3. Fill in:
   - **Name**: your PC's name
   - **MAC Address**: find it on Windows with `ipconfig /all`, or look it up in your router admin UI
   - **IP**: the PC's LAN IP (e.g. `192.168.1.100`)
4. Click **Wake** to test

---

## PC-side Wake-on-LAN settings (the hard part)

This is where things usually break. The Pi side is rock solid — failures are almost always misconfigured PCs.

### BIOS (vendors name these differently — search for these keywords)

- ✅ Enable **Wake on LAN** / **Power On by PCI-E** / **Resume by PCI-E Device**
- ✅ Disable **ErP Ready** / **EuP**
- ✅ Disable **Deep Sleep** / **Deep S5**

### Windows 10/11

**Device Manager settings**

1. Open Device Manager → expand "Network adapters" → right-click your wired NIC → Properties
2. **Power Management** tab:
   - ✅ Tick "Allow this device to wake the computer"
   - ✅ Tick "Only allow a magic packet to wake the computer"
3. **Advanced** tab (names vary by NIC model):
   - **Wake on Magic Packet** → Enabled
   - **Wake on Pattern Match** → Enabled (optional)
   - **Energy Efficient Ethernet** → Disabled (this blocks WoL on some NICs)

**Disable Fast Startup (critical)**

If you leave it on, WoL won't work from a **full shutdown** — only from sleep.

1. Control Panel → Power Options
2. Click "Choose what the power buttons do"
3. Click "Change settings that are currently unavailable"
4. Uncheck "**Turn on fast startup**"
5. Save changes

### Verification

After the PC sleeps or shuts down, look at the LED on the NIC's RJ45 jack — it should **still be lit or blinking slowly** (the NIC stays powered to listen for magic packets). If the LED is fully off, the BIOS or NIC settings are wrong and WoL won't work.

---

## Router checks

If the magic packet goes out but the PC doesn't respond, check whether the router is blocking it:

- **AP Isolation** / **Client Isolation**: must be **off**, otherwise wireless devices can't broadcast to wired ones
- **IGMP Snooping**: can filter broadcasts in some setups — try turning it off
- Mesh systems (Eero, Orbi, Asus AiMesh, etc.) sometimes isolate traffic between nodes

---

## Troubleshooting

### Q1: UpSnap fails with `attempt to write a readonly database`

Cause: `pb_data/` is owned by root (usually because it was started with `sudo` at some point).

```bash
# Check ownership
ls -la ~/pb_data

# Restore ownership
sudo chown -R jeff:jeff ~/pb_data

# Or nuke it entirely (the DB only holds config — if you haven't set anything up, just delete it)
rm -rf ~/pb_data
```

### Q2: Magic packet sent but PC doesn't wake

Check in order:
1. Is the PC's NIC LED still lit when sleeping? (No → BIOS / NIC settings problem)
2. Try a WoL tool on another PC (e.g. `WakeMeOnLan`) on the same LAN to rule out PC-side issues
3. Confirm Pi and PC are on the same subnet (compare `ip a` output)
4. Disable AP Isolation on the router
5. Check that Fast Startup is disabled on the PC

### Q3: Tailscale doesn't autostart after a Pi reboot

```bash
sudo systemctl enable tailscaled
sudo systemctl status tailscaled
```

### Q4: Accessing UpSnap directly over LAN

```bash
http://upsnap.local:8090
# or
http://<Pi-LAN-IP>:8090
```

### Q5: Upgrading UpSnap

```bash
cd ~
sudo systemctl stop upsnap
wget <new-version-download-url>
unzip upsnap_X.X.X_linux_arm64.zip
sudo setcap cap_net_raw=+ep ./upsnap
sudo systemctl start upsnap
```

---

## Security notes

- **Don't expose UpSnap directly to the public internet** — its shutdown feature essentially runs shell commands, so a compromise hands an attacker a root shell inside your LAN
- **Always go through Tailscale** — its zero-trust model ensures only devices you authorise can reach it
- Audit your Tailscale ACLs regularly to make sure no device has more access than it needs

---

## References

- [UpSnap GitHub](https://github.com/seriousm4x/UpSnap)
- [UpSnap Releases](https://github.com/seriousm4x/UpSnap/releases)
- [Tailscale blog: Making a Wake-on-LAN server using Tailscale, UpSnap, and Raspberry Pi](https://tailscale.com/blog/wake-on-lan-tailscale-upsnap)
- [Tailscale documentation](https://tailscale.com/kb/)
- [PocketBase docs](https://pocketbase.io/docs/) (UpSnap's backend)