Tailscale Explained: One Private Network, Every Device.

What Tailscale actually does

Say you have a laptop, a home desktop, a small cloud server, and a phone. They're not on the same Wi-Fi network, most of them don't have a public IP address, and you'd rather not open ports on your router just to check on one of them. Normally that means either giving up on remote access, or wading into port forwarding, dynamic DNS, and a pile of firewall rules you'll forget about in six months.

Tailscale skips all of that. Install it on each device, sign in with the same account, and within a couple of minutes every device can reach every other device by name. You type ssh my-server, not ssh 203.0.113.9 -p 51234, and the connection stays encrypted end to end. No public IPs. No port forwarding. No certificates to renew.

You are not exposing your devices to the internet. You are building a private network limited to approved users and devices.

Why would you use it

The appeal is less about any single feature and more about what stops being a chore:

• Reach your own devices from anywhere. A home desktop, a VPS, a Raspberry Pi, and a laptop that changes Wi-Fi all day are all reachable by one stable name, whether you are on the same network or across the world.
• Private SSH and dev servers, without exposing them. SSH into a home server, reach a development machine, or check on a box while travelling without ever putting a port on the public internet.
• Nothing to expose by default. Admin dashboards, internal tools, and dev servers can stay private instead of being put on the public internet and then locked down after the fact.
• Less firewall bookkeeping. Fewer one-off port-forwarding rules and reverse proxies to remember you set up.
• Cloud and local machines talk privately. A VPS and a laptop on different networks, even with different providers, can reach each other as easily as two devices on your home Wi-Fi.

How it works, at a high level

WireGuard handles the encrypted connection. Tailscale handles device identity, discovery, and permissions, which are the parts you would otherwise configure by hand.

Most of the time, the two devices end up talking directly through an encrypted connection. If a direct path is unavailable, Tailscale can fall back to a configured peer relay or a DERP relay. The traffic stays encrypted end to end either way. That is where the "it just works" reputation comes from.

Tailscale's control plane maintains device and network metadata, distributes public keys, and enforces policy, but it cannot read encrypted traffic. Private keys never leave the devices they belong to.

Getting started

If you have never used Tailscale before, this is the part that matters. Most people can get two devices talking in well under ten minutes.

1. Create an accountSign up at tailscale.com using an email, Google, GitHub, or Microsoft account. The free Personal plan is enough to follow along.
2. Install Tailscale on your first deviceThere are apps for macOS, Windows, Linux, iOS, Android, and many routers and NAS devices. Download the one for whatever you're using right now.
3. Sign inOpen the app and sign in with the account you just created. That is the only credential this device needs. There is no separate password to manage.
4. Add a second deviceInstall Tailscale on another machine, such as a home desktop, a phone, or a small cloud server. Sign in, and it joins the same tailnet automatically.
5. Find your devicesOpen your admin console or run tailscale status from a terminal. You'll see every device you've added, each with its own stable name.
6. Make your first connectionFrom one device, try reaching the other by name. For example, use ssh myuser@my-server instead of typing an IP address. If SSH is already enabled on the target machine, it should just work.

A simple real-world example

Take a laptop you carry around and a small server or VPS sitting somewhere else. It could be a home machine or a cheap cloud box. Once both have Tailscale installed and signed in:

# check that both devices are on the network
tailscale status

# connect by name; no public IP address needed
ssh myuser@my-server

That is the whole idea. The laptop connects to the server privately, usually over a direct path, and Tailscale coordinates the connection. The laptop does not need the server's public IP address or the same local network. It needs only the server's Tailscale name, and the connection stays encrypted end to end.

Serve vs. Funnel

Serve and Funnel answer two different questions. Serve keeps a service inside your tailnet. Funnel deliberately puts it on the public internet.

The important detail is that Tailscale controls who can reach the connection. It does not decide what that caller is allowed to do next. Private is not the same as authorized. Your app still needs its own login if the service is sensitive.

Basic security

You don't need to become a networking expert to use Tailscale safely. A few habits cover most of it:

When Tailscale may not be the right tool

It's not the only option, and it isn't always the best fit.

FAQ