Tailscale

Last reviewed Aug 24, 2026 · 707 words

Tailscale deleted the hardest problem in self-hosting — reaching your services from anywhere without exposing them — and replaced it with a login button. Install the client on two devices, sign in, and they can reach each other over WireGuard from any network on earth, NAT be damned, no port forwarding, no certificates, no dynamic DNS. The free tier covers 100 devices and 3 users, which is to say: your entire homelab. What's left to learn is the handful of decisions that separate "installed it" from "built my network on it".

Subnet router or client-everywhere?

Two ways to bring your LAN into the tailnet. Installing the client on every device is the pure model: each machine gets a stable 100.x address and identity, ACLs see real machines, and connections go peer-to-peer. A subnet router — one Linux box advertising --advertise-routes=192.168.1.0/24 — instead makes the whole LAN reachable through a single node, which is how you reach the printer, the IPMI interface, and the TV that can't run Tailscale. The mature setup uses both: clients on everything that can (laptops, phones, servers), one subnet router for the stragglers. Approve the advertised route in the admin console or nothing happens — the most common first-hour confusion.

The three features to turn on this week

• MagicDNS names every node (jellyfin, nas) so you stop memorising 100.x addresses; combined with HTTPS certificates (tailscale cert) you get valid TLS on private services without touching public DNS.
• Exit nodes: any node advertising --advertise-exit-node becomes your VPN-out — phone on airport Wi-Fi routes all traffic home through it. This quietly replaces a commercial VPN subscription for the travel case, and pairs beautifully with your Pi-hole: set the tailnet's DNS to the Pi-hole's tailscale IP and ad-blocking follows your phone everywhere.
• Tailscale SSH (--ssh on the node) authenticates SSH by tailnet identity — no key juggling, sessions recorded if you want, and one less port to think about.

Write the ACL before you need it

Default tailnets are flat: every device reaches every device, which is fine until the kid's laptop can reach the NAS admin page. The ACL file (JSON in the admin console, and worth mirroring to git) fixes that in twenty lines — tag servers (tag:server), group people, and write rules like "family reaches media ports only; admins reach everything." Doing this while the tailnet is small is trivially easy; retrofitting discipline onto forty devices is a weekend. This is also where the threat-modeling exercise becomes concrete: Tailscale removes your public attack surface, but inside-the-tailnet lateral movement is yours to constrain.

The honest part: the control plane isn't yours

The clients are open source; the coordination server — the piece that authenticates devices and distributes keys — is Tailscale-the-company's hosted service, and the catalogue's one listed con. Your traffic stays end-to-end encrypted peer-to-peer (relays carry only ciphertext), but device identity and your tailnet's shape live with them, and an account compromise is a network compromise — so protect the identity provider login with hardware 2FA, and enable device approval. If that dependency is unacceptable, Headscale reimplements the control server for self-hosting, works with official clients, and is the right answer for the principled — at the cost of running the most security-critical service you own and losing some polished features (the admin UI, Funnel). The pragmatic read in remote access three ways: most people are better served by hosted-control Tailscale than by a Headscale they operate distractedly.

What I'd do

Client on every capable device, one subnet router on the always-on box, MagicDNS with the Pi-hole as tailnet DNS, an exit node at home, ACLs written at device ten rather than forty, hardware 2FA on the account. Then delete every port forward on the router except 80/443 to the reverse proxy — for services with no public audience, delete those too. The end state is the homelab reachable from anywhere and visible from nowhere, which is what remote access was always supposed to mean.