Exposing SSH, databases or panels like Proxmox to the internet invites attacks. Tailscale builds a private mesh network (a "tailnet") over WireGuard between your devices, wherever they are, so admin services can listen only on private addresses.
Before you start
- A Tailscale account (sign-in via an identity provider) and the devices you want to connect. Check Tailscale's current plan limits for your use.
- Prefer to self-host everything? Run your own WireGuard server instead; see WireGuard on a VPS, or the open-source Headscale control server.
Install on a Linux server
curl -fsSL https://tailscale.com/install.sh | shReview the script first if you prefer, or add Tailscale's package repository manually following its documentation. Then:
sudo tailscale upOpen the printed URL to authorise the machine. For headless automation, create an auth key in the admin console and run sudo tailscale up --authkey tskey-....
Install on your laptop
Install the desktop app (Windows, macOS, Linux) or mobile app and sign in with the same account. Check connectivity:
tailscale statusping web01With MagicDNS enabled, machines are reachable by name.
Lock admin services to the tailnet
- SSH: allow port 22 only on the
tailscale0interface:sudo ufw allow in on tailscale0 to any port 22, then remove the public SSH rule after testing. - Databases: bind MySQL/PostgreSQL to the server's Tailscale IP (100.x.y.z) instead of 0.0.0.0.
- Panels: restrict Proxmox port 8006 or Cockpit 9090 to the tailnet; see remote KVM management.
Keep provider VNC console access as a fallback in case Tailscale stops.
Control access with ACLs
In the admin console's access controls, define who can reach what, for example only the admins group may reach port 22 on servers tagged tag:prod. Tag servers when authenticating with --advertise-tags=tag:prod.
Extra features
- Subnet router: expose a whole private network (e.g. your KVM VMs' bridge) to the tailnet.
- Exit node: route a laptop's internet traffic through a VPS.
- Tailscale SSH: SSH authenticated by your identity instead of keys.
Troubleshooting
- Machines connected via relay (DERP) and slow: a firewall blocks direct UDP; allow outbound UDP or open UDP 41641.
- Locked out after closing public SSH: use the provider console and re-add the rule.
- Names do not resolve: enable MagicDNS in the admin console.
Frequently asked questions
Is Tailscale traffic encrypted?
Yes, end-to-end with WireGuard between devices.
Does it replace a firewall?
No, it complements it: keep public ports closed and use ACLs.
Tailscale or plain WireGuard?
Tailscale handles keys, NAT traversal and ACLs for you; plain WireGuard is fully self-managed.