What Is Tailscale and How Do You Install It on Servers and Devices?

To manage a server we usually open the SSH port to the internet and then watch login attempts from all over the world in the logs. Reaching a device at home from outside means port forwarding on the router, and setting up a shared internal network for a team means installing and managing a VPN server. Tailscale is a tool that turns all of this into a few minutes of setup. In this post we explain what Tailscale is, how it works and how to install it on a server, a computer and a phone, step by step.

What Is Tailscale and How Does It Work?

Tailscale is a mesh VPN built on the WireGuard protocol. In classic VPNs, all devices connect to a central VPN server and traffic goes through it. With Tailscale, devices connect to each other directly:

• The coordination server only distributes devices' public keys and settings; your traffic doesn't pass through it.
• Even behind NAT and firewalls, devices find each other and set up direct, end-to-end encrypted connections. No port forwarding needed.
• If a direct connection isn't possible, traffic is carried through Tailscale's DERP relay servers, still encrypted.
• Each device gets a stable IP like 100.x.y.z, and thanks to MagicDNS you can reach devices by name (e.g. web01).

The private network formed by devices on the same account is called a tailnet.

Tailscale vs OpenVPN vs WireGuard

If you'd like to set up a classic VPN server, we walk through it in our what is a VPN, how to set up OpenVPN post.

What Is It Good For?

• Secure SSH to servers: Close the SSH port to the internet and connect only over Tailscale.
• Access to devices at home or the office: Reach a NAS, camera or test server without opening ports.
• Keeping databases off the internet: Let the app server and database server talk over a private network even if they're in different places.
• An internal network for teams: Give developers access to internal services and manage who reaches what centrally.
• Secure internet exit: Route all traffic through your own server (exit node) on public Wi-Fi.

Step 1: Create an Account

Just sign in at tailscale.com with Google, Microsoft, GitHub, Apple or a corporate identity provider. Tailscale doesn't keep its own passwords; it leaves authentication to these providers. So it's important to have two-factor authentication enabled on the account you use.

Step 2: Install on a Linux Server

On Ubuntu, Debian, the RHEL family and other common distros, the official install script does the job with one command:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up            # open the printed link in a browser and log in
tailscale ip -4              # the server's Tailscale IP (100.x.y.z)
tailscale status             # devices in the tailnet

The tailscale up command prints a login link. Open it in a browser, approve with your account, and the server is added to your tailnet.

Step 3: Add Your Other Devices

Download the official apps for Windows, macOS, iOS and Android and sign in with the same account. Within seconds all devices can see each other. Test the connection from your computer:

tailscale ping web01       # is the connection direct or via relay?
ssh root@web01             # by name instead of IP thanks to MagicDNS

If the tailscale ping output says "via DERP", the connection is going through a relay; it works, but it's a bit slower than a direct connection.

Step 4: Auth Keys and Key Expiry for Servers

When adding lots of servers or automating setup, logging in through a browser every time isn't practical. You can create an auth key under Settings → Keys in the admin console and use it during install:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --authkey tskey-auth-XXXXXXXXXXXX --hostname web01

For security, device keys are set by default to require re-authentication after a certain time (usually 180 days). That's a good thing on user devices, but on servers the connection drops when the key expires. For servers, use the Disable key expiry option from the device's menu in the admin console.

Tailscale SSH and Closing the SSH Port

One of Tailscale's most loved features: closing the server's SSH port to the internet completely and managing it only over the Tailscale network. If you want, Tailscale SSH can also take over SSH key management:

sudo tailscale set --ssh                 # turn on Tailscale SSH (login rights are managed by policies in the admin console)

# allow SSH only over the Tailscale interface
sudo ufw allow in on tailscale0
sudo ufw delete allow 22/tcp             # or: sudo ufw delete allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Exit Nodes and Subnet Routers

An exit node lets clients send all their internet traffic out through a server in the tailnet; like a secure exit point on public Wi-Fi. A subnet router exposes a network with devices that don't have Tailscale installed (e.g. an office network) to the tailnet:

# on the server that will be the exit node: enable IP forwarding and advertise
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-exit-node

# subnet router: expose a network behind it to the tailnet
sudo tailscale set --advertise-routes=10.0.0.0/24

# on the client: send all traffic through the exit node
sudo tailscale set --exit-node=100.101.102.103
sudo tailscale set --exit-node=          # to turn it off

For security, exit nodes and subnet routes must also be approved in the admin console; approve them with Edit route settings from the device's menu. On systems using firewalld you may also need to enable masquerade.

One small note: tailscale serve shares a service only inside the tailnet, while tailscale funnel exposes the same service to the internet. Be careful about what you expose when using Funnel.

Access Control

With default settings, devices in the tailnet can reach each other. As the team grows, you should write policies under Access controls in the admin console to define who can reach which device on which port. Giving servers tags (e.g. tag:prod) and writing policies for tags instead of people makes management alot easier. The rule is simple: everyone gets access only to what they need.

Common Commands

Common Problems

Pricing and Alternatives

Tailscale has a free plan for personal, non-commercial use, and it's usually more than enough to connect one person's devices. For teams and companies there are plans billed per user. Since plan limits change from time to time, we recommend checking Tailscale's pricing page for current details.

If you also want to keep the coordination server in your own hands, the open-source Headscale project offers an alternative control server that works with Tailscale clients and runs fine on a small VPS. The management UI and some features are more limited, but everything stays on your server.

Tailscale on VECDC Servers

VECDC virtual servers come with NVMe disks and a 1 Gbps connection from $6/month and are ready in about 5 minutes with automated setup. As soon as the server is up you can install Tailscale, close SSH to the internet and connect your servers over a private network. Even the smallest plan is enough for Headscale or an exit node; since you can choose the location when ordering, you can run the exit node wherever you like. With the Developer VDS that comes with Docker, you can add your dev environment to the same tailnet too. If you're wondering about the difference between VPS and VDS, have a look at our what is VDS, what is VPS post.

Frequently Asked Questions

In Short

Tailscale is a WireGuard-based mesh VPN that takes minutes to set up and needs no port forwarding. Install it on your server with one command, add your other devices with the same account, close SSH to the internet, and grow your network with exit nodes, subnet routers and access policies when needed. If you get stuck during setup, drop us a message, were happy to help.