What Is Tailscale? The VPN That Doesn't Suck
The last time you configured OpenVPN, you spent three hours debugging a certificate chain, another two fighting tun vs tap, and then had to explain to your CTO why the "secure" tunnel was routing all remote traffic through a single t3.micro in us-east-1 that was already at 90% CPU from a runaway log shipper.
That's not a VPN. That's a distributed denial-of-service attack you're paying for.
Tailscale is WireGuard with a control plane, an identity layer, and NAT traversal that actually works. It is not magic. It is simply well-engineered, and that's rarer than it should be.
This guide is for sysadmins, DevOps engineers, and security engineers who've been burned by OpenVPN or IPsec and want to understand what Tailscale actually does under the hood — not the marketing version. By the end, you'll know how the control plane and data plane split works, how to roll it out on real infrastructure with tags and ACLs, where the production footguns live, and when Tailscale is the wrong tool.
We're not going deep on DERP internals or enterprise pricing negotiation. Those are separate posts.
:::note[TL;DR]
- Tailscale = WireGuard data plane + a coordination server that handles key exchange, NAT traversal, and ACL distribution. Your traffic does not flow through Tailscale's servers except via DERP relays when direct connections fail.
- The value isn't the protocol — WireGuard is ~4000 lines of C. The value is identity, ACLs, and the ops surface.
- Tags are ACLs. Untagged nodes are owned by a user; tagged nodes are owned by the tailnet. Never tag a laptop.
- The default ACL allows every node to reach every node. In prod, that is a security incident waiting for a calendar invite.
- If you're running raw WireGuard at scale, you've rebuilt 60% of Tailscale badly. If you're running OpenVPN in 2026, you're paying an ops tax for no benefit. :::
Prerequisites
- Root or sudo on Linux nodes you plan to enroll
- An identity provider you actually control (Google Workspace, Okta, Entra ID, GitHub org) for SSO
- A tailnet — the free tier supports 3 users and 100 devices, which is fine for a homelab and useless for anything else
- Basic familiarity with CIDR notation and firewall rules, because subnet routers will force you to remember
The VPN Landscape Is a Dumpster Fire (And Why)
Before we talk about what Tailscale does right, we need to be honest about why the previous generation of VPNs is so painful. It's not that IPsec and OpenVPN are bad protocols — it's that they were designed for a world that no longer exists.
IPsec — The Protocol That Requires a PhD to Debug
IPsec was designed for site-to-site tunnels between two static endpoints that trusted each other. It was never designed for a laptop that roams between coffee shops, home Wi-Fi, and a hotel captive portal. IKEv2 phase 1 and phase 2 negotiate security associations in a way that makes sense to a cryptographer and is inscrutable to anyone trying to debug why a tunnel won't come up at 2 AM.
I once spent a full day on a Cisco ASA because someone typed esp-aes instead of esp-aes-256. The logs told us nothing useful. The tunnel came up. Traffic didn't flow. The fix was a single token in a config file, and the cost was eight hours of a senior engineer's time.
OpenVPN — Works Everywhere, Fast Nowhere
⚠️ TRUNCATED VERSION
This is an abbreviated cross-post. Full article (all config files, architecture diagrams, images): valtersit.com
🛠️ Partner Tools for Developers
ValtersIT curates partner deals for developers and sysadmins — VPS hosting, security tools, monitoring platforms and dev productivity gear. No filler, no affiliate spam.
Top comments (0)