Tailscale (Mesh VPN)

WireGuard-based mesh VPN that connects your devices and servers into a private network with zero config, SSO auth, and ACLs.

VPS & Self-HostedBeginner

Why

Tailscale assigns each node a stable 100.x.y.z IP and routes traffic peer-to-peer over WireGuard, punching through NAT. You authenticate with SSO (Google, GitHub), so onboarding a new server is one command.

ACLs control which nodes can talk, and MagicDNS gives nodes names like 'db.tailnet.ts.net'.

When

Use Tailscale to access private servers (DBs, admin panels) without exposing them publicly, or to connect on-prem + cloud into one network. Free for up to 100 devices.

Avoid for workloads needing full site-to-site routing without a subnet router — though Tailscale supports that too.

How

1. Sign up at tailscale.com (free for 100 devices). 2. Install tailscale on each node: curl -fsSL https://tailscale.com/install.sh | sh. 3. tailscale up to authenticate via SSO. 4. Nodes get 100.x.y.z IPs and MagicDNS names. 5. Configure ACLs in the admin console to restrict access. 6. Use tailscale serve to expose a local service on the tailnet. ```bash curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up # authenticate in browser tailscale ip # show this node's tailnet IP ssh [email protected] # SSH over the tailnet ```

Example

Expose a local Postgres only to the tailnet, then connect from your laptop: ```bash # on the DB server sudo tailscale up # postgres listens on 100.x.y.z:5432 (tailnet IP) # edit pg_hba.conf to allow 100.64.0.0/10 (tailnet range) # on your laptop tailscale up psql -h db.tailnet.ts.net -U postgres # connects over WireGuard, no public port ``` ACL allowing only the 'admin' tag to reach the DB: ```json { "acls": [ { "action": "accept", "src": ["tag:admin"], "dst": ["tag:db:5432"] } ], "tagOwners": { "tag:db": ["[email protected]"], "tag:admin": ["[email protected]"] } } ```

Common Problems

⚠Nodes can't see each other — one or both did not run 'tailscale up' (authenticated); check 'tailscale status' to see if both are Active.
⚠Traffic relayed (slow) instead of direct — NAT prevents P2P; Tailscale relays via DERP. Usually still fast enough; enable UPnP or use a public IP for direct connections.
⚠ACL not taking effect — ACLs apply to new connections; existing connections may persist until the node re-auths or the connection times out.

Best Practices

✓Use tags (tag:db, tag:admin) in ACLs instead of user emails so access survives user changes and is group-based.
✓Enable MagicDNS and use hostnames (db.tailnet.ts.net) instead of IPs — they are stable across node re-joins and far more readable.
✓Use 'tailscale serve' or 'tailscale funnel' to expose local services to the tailnet (or publicly) without opening firewall ports.

FAQ

What is Tailscale (Mesh VPN) and what problem does it solve?

WireGuard-based mesh VPN that connects your devices and servers into a private network with zero config, SSO auth, and ACLs. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Tailscale (Mesh VPN) in 5 minutes?

Two steps to run it: (1) Sign up at tailscale.com (free for 100 devices).; (2) Install tailscale on each node: curl -fsSL https://tailscale.com/install.sh | sh.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Tailscale (Mesh VPN)?

The most frequent issue is: Nodes can't see each other — one or both did not run 'tailscale up' (authenticated); check 'tailscale status' to see if both are Active.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Tailscale (Mesh VPN)?

Best practices for Tailscale (Mesh VPN) include: Use tags (tag:db, tag:admin) in ACLs instead of user emails so access survives user changes and is group-based.; Enable MagicDNS and use hostnames (db.tailnet.ts.net) instead of IPs — they are stable across node re-joins and far more readable.; Use 'tailscale serve' or 'tailscale funnel' to expose local services to the tailnet (or publicly) without opening firewall ports.. The first one — "Use tags (tag:db, tag:admin) in ACLs instead of user emails so access survives user changes and is group-based." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Tailscale (Mesh VPN)?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Tailscale (Mesh VPN) options offer a free tier — validate within free quota before scaling.