Tailscale Changed How I Think About Networking

I used to spend an unreasonable amount of time fighting with port forwarding, dynamic DNS, SSH tunnels, and firewall rules just to access my own machines. Then I installed Tailscale on everything and most of that went away.

This isn't a sponsored post. I just genuinely think it's one of those tools that once you use it, you can't believe you dealt with the alternative.

What Tailscale Actually Is

Tailscale builds a mesh VPN between your devices using WireGuard under the hood. Every device gets a stable IP on a private network (100.x.x.x range), and they can all talk to each other directly, regardless of what network they're physically on.

No port forwarding. No dynamic DNS. No exposing SSH to the public internet. Your machines just... find each other.

The key difference from a traditional VPN is that there's no central server your traffic routes through. Devices connect peer-to-peer when possible, using NAT traversal to punch through firewalls. When direct connections aren't possible, traffic goes through Tailscale's relay servers (DERPs), but that's the fallback, not the default.

My Setup

I've got Tailscale on:

• My main workstation (Arch, triple monitor, the daily driver)
• A couple of remote servers running various projects
• My phone (mostly for the exit node feature)

Every machine gets a hostname on the tailnet. So instead of remembering IP addresses or keeping SSH configs updated when my home IP changes, I just ssh myserver and it works. From anywhere. On any network.

# Before Tailscale
ssh -p 2222 user@203.0.113.42  # Hope the IP hasn't changed
# Or worse
ssh -p 2222 user@some-dynamic-dns-hostname.ddns.net  # Hope the DDNS updated

# After Tailscale
ssh myserver  # Just works. Every time.

That's it. That's the main pitch. Everything else is bonus.

The Stuff I Actually Use

SSH Without the Anxiety

Before Tailscale, accessing a remote machine meant either:

1. Exposing SSH to the public internet (bad)
2. Setting up a VPN server somewhere (annoying)
3. Using a reverse tunnel through some intermediary (fragile)
4. Port forwarding on your router and praying your ISP doesn't change your IP (unreliable)

Now my SSH ports aren't exposed to the internet at all. The machines only accept connections over the tailnet. If you're not on my Tailscale network, the ports don't exist as far as you're concerned. I still use non-standard ports and key-only auth because defense in depth is real, but the attack surface dropped dramatically.

Deploying to Prod

I run a few web projects on remote servers. Deploying used to involve making sure my SSH config was pointing at the right IP, that my dynamic DNS had updated, and that my router's port forwarding hadn't reset after a firmware update (yes, this happened).

Now I SSH into the server by hostname, pull changes, rebuild, done. The deployment scripts don't care what network I'm on. Coffee shop, home, phone hotspot - same command, same result.

ssh myserver
cd /path/to/project
make deploy

Exit Nodes

This is the one that surprised me. You can designate any Tailscale device as an exit node, which means you can route all your internet traffic through that device. It's basically a personal VPN that you control.

I use my home machine as an exit node when I'm on sketchy WiFi. Instead of trusting some VPN company with all my traffic, I'm routing through my own hardware. I know exactly what's logging what (nothing) because I set it up.

# On the exit node machine
sudo tailscale up --advertise-exit-node

# On the client (phone, laptop, whatever)
# Just pick the exit node in the Tailscale app

It's not a replacement for Tor if you need anonymity. But for "I don't trust this airport WiFi," it's perfect.

Sharing Machines With Other People

Tailscale has this sharing feature where you can give someone access to specific machines on your network without giving them access to everything. I've used this to let someone access a staging server without setting up new credentials, opening ports, or any of the usual dance.

They install Tailscale, I share the node, they connect. When we're done, I revoke access. No cleanup, no ports to close, no firewall rules to remove.

The Security Angle

Here's why I think Tailscale is interesting from a security perspective:

It shrinks your attack surface massively. Services that used to be internet-facing can be tailnet-only. My database admin panels, monitoring dashboards, and internal APIs are only accessible over Tailscale. They don't have public IPs. Port scans find nothing.

WireGuard is solid crypto. Tailscale uses WireGuard, which is a relatively small, auditable codebase compared to older VPN protocols. It's been in the Linux kernel since 5.6. The cryptographic choices (ChaCha20, Curve25519, BLAKE2s) are modern and well-regarded.

MagicDNS is genuinely magic. Every device gets a DNS name on your tailnet. No more editing /etc/hosts or maintaining your own DNS server for internal names. It just works, and it updates automatically when devices join or leave.

ACLs if you need them. For more complex setups, Tailscale lets you define access control lists - which devices can talk to which, on which ports. I don't use this much for my personal stuff, but it's there if you're running a team or have devices with different trust levels.

What It Doesn't Do

Tailscale is not a privacy tool in the "hide from websites" sense. It doesn't change your browser fingerprint, block trackers, or make you anonymous. Websites still see your exit node's IP address, your cookies, your canvas fingerprint - all of it.

It's a networking tool, not a privacy tool. Different problems, different solutions. If you want browser privacy, check out my writeup on what your browser actually leaks.

It also relies on Tailscale's coordination server for key exchange and NAT traversal. Your traffic doesn't go through their servers (in most cases), but they do facilitate the connections. If that bothers you, there's Headscale, an open-source implementation of the Tailscale coordination server. Self-host the whole thing if you want.

The Free Tier Is Generous

Personal use is free for up to 100 devices and 3 users. I've never come close to hitting that limit. There's no catch that I've found - no bandwidth limits, no speed throttling, no "upgrade to unlock SSH" nonsense.

The paid tiers add team management, more users, and enterprise features. But for personal use and small projects, the free tier covers everything.

The Honest Take

Tailscale isn't revolutionary technology. WireGuard does the hard work. What Tailscale did is make it stupid easy to set up and manage. Install the package, authenticate, done. Your device is on the mesh.

Before Tailscale, I understood mesh VPNs conceptually but never bothered because the setup cost wasn't worth it for a few machines. Now I install it on everything by default because it takes thirty seconds and the upside is significant.

If you manage more than one machine and you're not using something like this, you're making your life harder than it needs to be. And if you're exposing SSH to the public internet because "it's fine, I use keys" - yeah, it's probably fine. But it could be finer.