Set up Tailscale

Tailscale is a WireGuard-based mesh VPN. Each device gets a stable 100.x.x.x address in your private network (tailnet), so you can reach SSH and internal services on the server without exposing them publicly.

Prerequisites

• An identity-provider account (Google, Microsoft, GitHub, or any other supported one).
• A device running Windows, macOS, Linux, iOS, or Android.
• sudo / administrator on each device you connect.

Step 1: create your tailnet

Go to tailscale.com, click Get Started and sign in with your identity provider. This creates your tailnet.

Step 2: install Tailscale

Linux (Debian / Ubuntu)

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

tailscale up prints a login URL. Open it in a browser and confirm, and the device joins your tailnet. For other distributions follow the official package instructions.

Windows

Download the installer from the Tailscale website, run it, then sign in from the system-tray icon.

macOS

brew install --cask tailscale

…or download the App Store package.

iOS / Android

Install from the App Store / Play Store and sign in.

Step 3: verify the device is online

tailscale status

You should see your devices and their 100.x.x.x Tailscale addresses.

Step 4: test connectivity

From any device in the tailnet:

ping 100.x.x.x

Or by hostname, if you enable MagicDNS:

ping my-server

Optional configuration

MagicDNS

Use device hostnames instead of 100.x.x.x addresses. Enable in the Tailscale Admin Console under DNS settings.

Subnet routing

Expose a whole LAN (e.g. a colocated rack subnet) through one Tailscale device:

sudo tailscale up --advertise-routes=192.168.1.0/24

Then approve the route in the admin console.

Exit nodes

Route a device's entire public-internet traffic through another tailnet member:

# on the would-be exit node:
sudo tailscale up --advertise-exit-node

Approve it in the admin console, then on the client:

sudo tailscale up --exit-node=<exit-node-name>

Troubleshooting

• tailscale status reports each device's last handshake, which confirms the daemon is alive.
• Restart the service if needed: sudo systemctl restart tailscaled.
• Make sure outbound UDP is not blocked. Tailscale prefers UDP; it will fall back to TCP via a relay (DERP) but with a latency hit.
• The admin console flags devices that need re-authorising after an account change.

Where this fits

Once a tailnet is in place you can lock SSH and other services down to the 100.0.0.0/8 Tailscale range and stop exposing them publicly. See Secure your Linux server for the matching firewall snippets.