Tailscale

What Tailscale Actually Is

Tailscale is a mesh VPN built on top of WireGuard, a modern, minimal, heavily-audited VPN protocol. Install the Tailscale client on your laptop, phone, or server, sign in with an existing account (Google, GitHub, Microsoft, etc.), and that device joins your tailnet — a private network only your devices can see.

Unlike a traditional VPN, there's no central server all your traffic funnels through. Devices connect directly to each other wherever possible, encrypted end-to-end. Tailscale's infrastructure only helps devices find each other and negotiate that connection — it doesn't sit in the middle of your actual traffic.

Why People Use It

• No more painful VPN setup. No port forwarding, no static IP allowlists — install the client, log in, done.
• Works through NAT and firewalls automatically. Two devices behind separate home routers can still find a direct path to each other. When that's not possible, traffic relays through Tailscale's servers — still fully encrypted, just routed rather than direct.
• Great for individuals, not just companies. A huge part of Tailscale's popularity comes from hobbyists running a home lab, self-hosting things like Nextcloud or Home Assistant, or just wanting to reach their desktop from anywhere. The free tier covers personal use with a generous device limit.

Standout Features

• MagicDNS — every device gets a stable hostname (myserver.tailnet-name.ts.net) instead of you needing to remember an IP.
• Taildrop — AirDrop-style file transfer between your own devices.
• Subnet routers and exit nodes — expose your whole home LAN to your tailnet, or route all internet traffic through a trusted device.
• Tailscale SSH — identity-based SSH access without manual key management.

My Setup: Home Server + Nextcloud

I use Tailscale specifically to reach my home server and my self-hosted Nextcloud storage — without opening any ports to the public internet.

• Home server access — I install the Tailscale client directly on the home server, so it joins my tailnet just like my laptop and phone do. From anywhere, I can reach it by its Tailscale hostname instead of a public IP.
• Nextcloud access — instead of exposing Nextcloud's port 443 to the internet, I point the Nextcloud desktop and mobile apps at the server's Tailscale hostname (e.g. homeserver.tailnet-name.ts.net). This keeps file sync and access completely private to my own devices.
• MagicDNS — turned on so I never have to remember or type IP addresses for either service.
• Mobile access — the Tailscale app has to be running in the background on my phone before the Nextcloud app can reach the server.
• HTTPS — using tailscale cert to get a real Let's Encrypt-backed certificate for the tailnet hostname, so there are no self-signed cert warnings in the Nextcloud clients.

This setup means my storage server is reachable from any of my devices, anywhere, with no port forwarding and no attack surface exposed to the public internet.

Getting Started

1. Create a free account at tailscale.com.
2. Install the client on two devices.
3. Log in on both.
4. Ping one from the other by hostname.

No port forwarding, no static IPs, no certificate management required to get started.