Mac Remote Access

---

name: mac-remote-access description: Diagnose, configure, and recover remote access to a macOS machine over Tailscale. Use when setting up or troubleshooting Mac SSH, Screen Sharing/VNC, RealVNC, AnyDesk, RustDesk, Tailscale ACLs, or remote-access baselines, especially for Windows-to-Mac access, unreachable port 22/5900 issues, visible-in-tailnet-but-not-connectable cases, or break-glass remote recovery planning.

---

Mac Remote Access

Set up or troubleshoot remote access to a Mac over Tailscale.

Workflow

1. Check the Mac side first. 2. Verify TCP reachability from the remote client. 3. Check Tailscale ACLs before tuning VNC clients. 4. Preserve at least one command-line recovery path (SSH). 5. Recommend a layered setup: SSH fallback, AnyDesk primary GUI fallback, VNC secondary.

Mac-side checks

Run these first when local access to the Mac exists:

tailscale status
tailscale ip -4
sudo systemsetup -getremotelogin
sudo /usr/sbin/netstat -anv -p tcp | grep '\.5900 .*LISTEN'
nc -vz  5900

If Screen Sharing looks stuck, restart it:

sudo launchctl kickstart -k system/com.apple.screensharing

Windows-side checks

Use PowerShell and prefer TCP tests over ping:

Test-NetConnection  -Port 22
Test-NetConnection  -Port 5900

Interpretation:

22=False and 5900=False → check Tailscale ACL / policy first

22=True and 5900=False → check Mac Screen Sharing / VNC service

22=True and 5900=True → move to client auth/compatibility

ACL guidance

Prefer explicit ACLs during troubleshooting.

Read references/acl-template.md for a minimal working example.

References

references/acl-template.md — minimal ACL template

references/checklist.md — baseline checklist

references/sop.md — end-to-end operating procedure

references/anydesk-rustdesk.md — GUI fallback setup and troubleshooting notes