Tailscale is a VPN built on top of WireGuard (a kernel-level encrypted tunnel protocol) that replaces the certificate and key-management parts with identity-based authentication. You install it on a server, you install it on your laptop, you sign in, and the two machines have a private network connection. There is no port forwarding, no shared secrets to copy between machines, no firewall holes to poke. I have been running Tailscale across my homelab, my travel laptop, and a server in a colo (a rented machine in someone else’s data center) for about two years, and the network is the part of my infrastructure I have had to touch the fewest times.
If WireGuard is “set up an encrypted tunnel, then manage it yourself”, Tailscale is “set up an encrypted tunnel, then forget it exists”. That difference is what makes it worth using.
Installing Tailscale on a single Linux server
The install is three commands and a browser sign-in.
- Add the Tailscale package repository. On Ubuntu 24.04 and 26.04, run
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/$(. /etc/os-release; echo "$VERSION_CODENAME").gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg > /dev/nullthen add the repo andapt update. - Install the package.
sudo apt install tailscale. The package is small (about 30 MB) and the daemon is a single Go binary. - Bring the interface up and authenticate.
sudo tailscale up. This prints a URL. Open it in any browser, sign in with Google, GitHub, or Microsoft, and the machine shows up in your Tailscale admin console immediately.
The IP assigned to your machine is a CGNAT-range (Carrier-Grade NAT, an address in the 100.64.0.0/10 range that is not routable on the public internet) address. It only works from machines that are also running Tailscale. There is no exposed port on the open internet.
Setting up an exit node
An exit node is a Tailscale machine that all your other devices can route their traffic through. The use case is the coffee-shop Wi-Fi problem: you are on an untrusted network, you want all your traffic to go through a server you control. Tailscale makes this one CLI flag.
- Run on the server you want to use as the exit node:
sudo tailscale up --advertise-exit-node. The node appears in your admin panel with a flag indicating it offers exit-node routing. - Approve the exit node in the admin panel. The first time you enable exit-node routing on a machine, the admin (you, in this case) needs to confirm.
- Pick the exit node from another machine:
sudo tailscale set --exit-node=<name>. All traffic from this machine now routes through the exit node until you turn it off.
DNS follows the exit node by default. MagicDNS (Tailscale’s automatic DNS resolver that gives each machine a stable name on the network) means you can reach machines on your tailnet by name from any device on the tailnet.
ACL policies and subnet routers
Two features turn Tailscale from a “VPN for me” into a “VPN for my whole homelab”.
A subnet router is a Tailscale machine that advertises a real subnet from your physical network. If your server has 10.0.1.0/24 as its LAN, you can run sudo tailscale up --advertise-routes=10.0.1.0/24 and the subnet becomes reachable from any device on your tailnet. This is how you expose a homelab printer, a NAS, or a camera system without opening ports on your home router.
ACL policies are JSON rules in the admin panel that govern which machines can talk to which. The default policy is permissive. A reasonable starting ACL for a homelab:
- Tag the exit node and subnet router nodes with
tag:exit-nodeandtag:subnetusingtailscale up --advertise-tags=tag:exit-node. - Write an ACL that only allows your own user to use exit-node traffic, and only your own devices to reach the subnet.
- Reject all other connections.
ACLs are the difference between “Tailscale on my laptop” and “Tailscale for the whole network”. They take an hour to set up the first time and make the network manageable when there are more than five machines.
Comparing Tailscale to raw WireGuard and OpenVPN
I have run all three. The tradeoffs are real and worth understanding before you commit.
- Raw WireGuard is faster (the kernel-mode implementation adds zero userspace overhead) and you own every byte of the configuration. The cost is operational: every new device means generating a keypair, signing a peer config, distributing it, and updating the allowed-IPs list. With three devices, that is fine. With fifteen, it stops being fine.
- OpenVPN has the longest history, the most mature authentication options, and the easiest path to running on a router (DD-WRT, OpenWrt, pfSense all support it). The cost is performance: OpenVPN runs in userspace, which is measurably slower than WireGuard. It also needs a real public IP or port forwarding, which Tailscale sidesteps.
- ZeroTier is the closest competitor to Tailscale and was the main alternative before Tailscale was acquired by a major cloud provider. ZeroTier is more flexible (it can do software-defined networking in layers that Tailscale does not), but the admin UI is less polished and the documentation is sparser.
- Tailscale wins for the common case. Identity-based onboarding, MagicDNS, exit nodes that work in two minutes, and subnet routers that just work. The cost is a dependency on the Tailscale coordination servers; if those go down, new device onboarding breaks (existing connections keep working).
For a single-machine-to-machine tunnel I would still reach for raw WireGuard. For “I want a personal network across five devices” Tailscale is the only tool that does what the others take a day to set up.
Trade-offs
The setup is not free in time. The first install and authentication takes about fifteen minutes; that part is easy. A meaningful ACL that you actually trust takes another hour. In our case, the ACL took longer than the install because the JSON structure for tagging and grants has a learning curve, and there is not a good GUI builder for it.
Tailscale as a service is freemium, with a hitch. The free tier covers up to 100 devices for personal use and is generous enough for almost any homelab. The paid tier (Tailnet name “Plus”, about $5 per user per month) adds features like ACL editors in the admin UI, multiple subnet routes per device, and shared workspaces. If you only use the free tier on a homelab, you will be fine.
There is a real dependency on Tailscale’s coordination servers. They are how machines find each other. Tailscale’s coordination server is a hosted control plane that distributes the public keys and routing information for your tailnet. If Tailscale (the company) disappears or has a multi-day outage, new device onboarding breaks; existing connections would keep working. A “headscale” option is the open-source reimplementation of the coordination server, if you want full self-hosting.
The migration took about 90 minutes for a six-device tailnet. One specific thing that was harder than expected: ACL tag matching had a subtle bug where my own user was not granted access to my own exit node the first time around. The docs did not make it obvious that users and tags both need to be in the grants list. One specific thing that was easier than expected: setting up Tailscale SSH, which lets you SSH to any machine on the tailnet by tailnet name without managing authorized_keys files. That is a single line in the ACL and it just works.
If you want to connect five to twenty devices you control across networks you do not control, Tailscale is a clear win. If you have one device on one network, use ssh. If you need to expose services to the public internet, use a real reverse proxy, not Tailscale funnel (which is a feature that does expose ports through Tailscale’s coordination but is not a replacement for a public reverse proxy for production use).
Bottom line
Tailscale replaces the operational parts of a VPN with identity-based onboarding and a hosted coordination server. The result is a personal network across all your devices, with MagicDNS for names and ACLs for permissions, that you can set up in an afternoon. The two features that matter most are exit-node routing (one flag on a server, one flag on a client) and subnet routers (expose your homelab to your tailnet without port forwarding). The cost is a dependency on the coordination servers and a free tier that covers up to 100 devices. For a homelabber or a remote worker who wants their machines to act like one network, this is the cleanest answer in 2026.