Tailscale builds a private network (a “tailnet”) between your devices using WireGuard underneath. Each device gets a stable private IP (in 100.64.0.0/10) and can reach the others directly — through NAT, without opening ports or managing keys by hand. On a VPS it’s an easy way to:

  • reach SSH, databases and admin panels without exposing them to the internet;
  • connect servers in different locations privately;
  • use the VPS as an exit node — a personal VPN through the server’s IP.

How it works

The Tailscale coordination service handles identity (you sign in with Google, Microsoft, GitHub or another provider) and distributes public keys. Traffic between devices flows directly, end-to-end encrypted with WireGuard; when a direct path isn’t possible, it’s relayed through Tailscale’s DERP servers (still encrypted). If you prefer to self-host the coordination server, see Headscale.

1. Install on the VPS

curl -fsSL https://tailscale.com/install.sh | sh

(The script adds Tailscale’s package repository for your distribution; review it first if you like.)

sudo tailscale up

It prints a login URL — open it, sign in, and the server joins your tailnet.

For servers, generate an auth key in the admin console and use it instead of interactive login (handy for automation):

sudo tailscale up --auth-key=tskey-auth-XXXX --hostname=web1

Disable key expiry for servers in the admin console, or they’ll drop off the network when the node key expires (default: 180 days).

2. Install on your devices

Install Tailscale on your laptop and phone and sign in with the same account. Then:

tailscale status
ping web1                # MagicDNS names
ssh deploy@web1

MagicDNS gives each device a name, so you don’t need to remember 100.x.y.z addresses.

3. Close public access to admin services

Now that SSH works over Tailscale, you can restrict it to the tailnet:

sudo ufw allow in on tailscale0 to any port 22 proto tcp
sudo ufw delete allow OpenSSH     # remove the public SSH rule
sudo ufw status

Test a new SSH connection via the Tailscale name before closing your existing session. Keep the VPS’s VNC console in mind as a fallback.

Do the same for anything that shouldn’t be public: database ports, Grafana, Portainer, Netdata. Services can bind to the Tailscale IP specifically (tailscale ip -4 shows it).

4. Use the VPS as an exit node

Route all traffic from your laptop or phone through the VPS — like a traditional VPN:

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl --system
sudo tailscale up --advertise-exit-node

Approve the exit node in the admin console (Machines → … → Edit route settings), then pick it on your device (“Use exit node”). Your traffic now leaves from the VPS’s IP and location.

5. Subnet router: reach a whole private network

If the VPS has a private network with other machines, advertise it:

sudo tailscale up --advertise-routes=10.0.0.0/24

Approve the route in the console. Your devices can now reach 10.0.0.x hosts that don’t run Tailscale themselves.

6. Tailscale SSH (optional)

sudo tailscale up --ssh

Tailscale then handles SSH authentication using your tailnet identity and ACLs — no SSH keys to distribute. Many admins keep regular OpenSSH with keys and use Tailscale only as the network layer; both approaches work.

7. Access control (ACLs)

By default, all your devices can reach each other. In the admin console’s Access controls, restrict it — for example, only the admin group may reach servers on port 22, and servers may not initiate connections to laptops. Use tags (tag:server) for servers so ACLs don’t depend on a person’s account.

Docker and Tailscale

Containers can join the tailnet via the official tailscale/tailscale image as a sidecar, giving one app its own tailnet name — or simply let the host’s Tailscale route to containers through the reverse proxy.

Limits and considerations

  • The free personal plan covers a generous number of devices; check current plan limits for teams.
  • You depend on Tailscale’s coordination service for key distribution (or self-host Headscale).
  • Performance is usually close to plain WireGuard when direct connections succeed; relayed (DERP) connections are slower. tailscale status shows direct or relay.

Tailscale vs WireGuard vs ZeroTier

  • Plain WireGuard — full control, no third party, manual key and IP management.
  • Tailscale — WireGuard with automatic key exchange, NAT traversal, SSO and ACLs.
  • ZeroTier — similar mesh concept, its own protocol, layer-2 networking.

For a handful of servers and devices, Tailscale is the quickest way to get private, secure access. Pair it with the Linux server hardening checklist, and pick exit-node locations to suit you — USA, Hong Kong or Tokyo.

  • Tailscale
  • VPN
  • Networking