Tailscale Guide 2026: Setup Mesh VPN for Your VPS, Team & Homelab

What is Tailscale?

Tailscale is a mesh VPN service built on top of WireGuard — a modern VPN protocol that is significantly faster, lighter, and more secure than OpenVPN or IPSec. The key distinction from traditional VPNs: instead of routing all traffic through a central VPN server, Tailscale connects devices peer-to-peer directly, resulting in lower latency and no single point of failure.

When you install Tailscale on multiple devices — whether a VPS, laptop, phone, or Raspberry Pi — they all join your tailnet (a private network) and can communicate directly via IP addresses in the 100.64.x.x/10 CGNAT range, without requiring any firewall port forwarding.

Tailscale Inc. is headquartered in Toronto, Canada. The client is open source (MIT license); the coordination server (key exchange and ACL management) runs on Tailscale's infrastructure. A self-hosted alternative control plane called Headscale also exists for those who want full control.

How Tailscale Works: WireGuard + Coordination

Tailscale separates into two planes:

1. Data Plane — Actual traffic transmission between devices via WireGuard (peer-to-peer whenever possible)
2. Control Plane — Tailscale's coordination server distributes WireGuard public keys between nodes and enforces ACL policies. Your actual traffic does not pass through this server.

When Node A needs to communicate with Node B:

1. Both nodes exchange WireGuard public keys through the coordination server
2. Tailscale attempts a direct peer-to-peer path using STUN/ICE NAT traversal
3. If direct connection succeeds (works in most cases), traffic flows directly
4. If NAT traversal fails (strict firewall environments), traffic is relayed through the nearest DERP (Designated Encrypted Relay for Packets) server

DERP servers are deployed globally, including in Asia, keeping latency minimal even when relay is required. All DERP-relayed traffic is still encrypted end-to-end with WireGuard keys — DERP servers cannot read your traffic.

CGNAT Address Space

Tailscale assigns each device a stable IPv4 address in the 100.64.0.0/10 CGNAT range. This range doesn't conflict with typical private LAN ranges (192.168.x.x, 10.x.x.x, 172.16.x.x), avoiding address collisions when connecting to corporate or home networks.

Installing Tailscale on Linux VPS (Ubuntu/Debian)

Installation is straightforward — Tailscale provides an official install script:

Step 1: Install

# Official install script (recommended)
curl -fsSL https://tailscale.com/install.sh | sh

# Manual repo setup for Ubuntu/Debian
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.gpg | sudo apt-key add -
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.list | sudo tee /etc/apt/sources.list.d/tailscale.list
sudo apt update && sudo apt install tailscale

Step 2: Authenticate

# Start Tailscale and authenticate (generates a URL to open in browser)
sudo tailscale up

# View this VPS's Tailscale IP
tailscale ip -4

# View all nodes in your tailnet
tailscale status

Step 3: Enable Autostart

sudo systemctl enable tailscaled
sudo systemctl start tailscaled

Enable IP Forwarding (Required for Subnet Router / Exit Node)

# Persist IP forwarding across reboots
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

CentOS / RHEL / AlmaLinux

sudo dnf install tailscale
sudo systemctl enable --now tailscaled
sudo tailscale up

SSH Securely via Tailscale

Once your VPS joins the tailnet, SSH through Tailscale IP instead of the public IP — avoiding any need to expose port 22 to the internet:

# SSH via Tailscale IP — no public exposure needed
ssh [email protected]

# With MagicDNS enabled, use hostname directly
ssh user@my-vps

Installing Tailscale Client on Windows & macOS

Windows

Download from tailscale.com/download/windows. Install normally; Tailscale starts automatically on Windows boot. Sign in with the same account used on your VPS — it will appear in the tailnet immediately.

macOS

Available on the Mac App Store or at tailscale.com/download/mac. A menubar icon handles all connectivity. Just sign in.

iOS and Android

Both platforms have official apps in their respective app stores. Download, sign in with the same account, and all your devices are connected.

Verifying Connectivity

# From any Tailscale node, ping another node
tailscale ping my-vps

# Check current connection path (direct vs DERP relay)
tailscale ping --verbose my-vps

# Test latency
ping 100.64.x.x

Subnet Router: Expose an Entire LAN to Your Tailnet

A Subnet Router is a Tailscale node configured to advertise a local network subnet to the entire tailnet. Other tailnet nodes can then reach devices on that subnet without needing Tailscale installed on each one.

Common Use Cases

• Access office LAN (servers, printers, NAS) from home over Tailscale without installing Tailscale on every office device
• Expose a home network (192.168.1.0/24) via a Raspberry Pi so you can reach home devices from anywhere
• Give a remote team access to an internal staging environment without a traditional VPN gateway

Configure Subnet Router

# On the node that will act as the Subnet Router
# Replace the CIDR with your actual subnet
sudo tailscale up --advertise-routes=192.168.1.0/24

# Then in Admin Console > Machines > select the node > Edit route settings
# Toggle on the subnet you just advertised

# On client nodes that need to use the subnet
sudo tailscale up --accept-routes

Multiple Subnets

# Advertise multiple subnets at once
sudo tailscale up --advertise-routes=192.168.1.0/24,10.0.0.0/8

After configuration, clients with --accept-routes can ping devices on the advertised subnet directly using their LAN IPs.

Exit Node: Route All Traffic via a VPS

Exit Node routes all internet-bound traffic from your device through a specific Tailscale node — functionally identical to using a traditional VPN. Typical use cases:

• Browse the internet with a different public IP (the VPS's IP)
• Secure traffic on untrusted public Wi-Fi
• Access geo-restricted content from a specific country

Set Up a VPS as an Exit Node

# On the VPS you want to use as Exit Node
# (IP forwarding must be enabled first — see Installation section)
sudo tailscale up --advertise-exit-node

# In Admin Console > Machines > your VPS > Edit route settings
# Enable "Use as exit node"

Use the Exit Node from a Client

# Linux/macOS — specify by Tailscale IP or hostname
sudo tailscale up --exit-node=100.64.x.x
sudo tailscale up --exit-node=my-vps

# Allow routing to LAN even when exit node is active
sudo tailscale up --exit-node=my-vps --exit-node-allow-lan-access

# Disable exit node
sudo tailscale up --exit-node=

# Windows: Tailscale system tray icon > Use exit node > select node

Note: Exit node usage counts against the VPS bandwidth. Ensure your VPS plan has sufficient transfer allowance.

MagicDNS: Automatic DNS Hostnames in Your Tailnet

MagicDNS automatically provides each Tailscale node with a DNS hostname, eliminating the need to memorize IP addresses. All nodes in the tailnet resolve each other by name.

Enable MagicDNS

Navigate to Admin Console > DNS > toggle on MagicDNS. Once enabled:

• A node named my-server is reachable as my-server.tailnet-name.ts.net
• Short hostnames work: ssh user@my-server, curl http://my-server:8080
• Works across all OS platforms (Tailscale updates system DNS configuration)

Custom Nameservers

Admin Console > DNS > Nameservers lets you define custom DNS servers for the tailnet — useful for integrating with internal corporate DNS. Split DNS allows using internal DNS for specific domains while using external DNS for everything else.

Access Control Lists: Fine-Grained Permissions

By default, all nodes in a tailnet can communicate freely. For production environments, ACLs let you define exactly which nodes can reach which ports on which other nodes. ACLs are written in HuJSON (JSON with comments) and managed from Admin Console > Access Controls:

{
  "groups": {
    "group:dev": ["[email protected]", "[email protected]"],
    "group:ops": ["[email protected]"]
  },
  "acls": [
    // Developers can reach dev servers on SSH, HTTP, HTTPS only
    {
      "action": "accept",
      "src": ["group:dev"],
      "dst": ["tag:dev-server:22", "tag:dev-server:80", "tag:dev-server:443"]
    },
    // Ops team has full access
    {
      "action": "accept",
      "src": ["group:ops"],
      "dst": ["*:*"]
    }
  ],
  "tagOwners": {
    "tag:dev-server": ["group:ops"],
    "tag:prod-server": ["group:ops"]
  }
}

Tagging Nodes

# Tag a node during authentication
sudo tailscale up --advertise-tags=tag:prod-server

# Or assign tags from Admin Console > Machines > node > Edit

Tailscale Plans & Pricing (2026)

Tailscale offers four main tiers. Always verify current pricing at tailscale.com/pricing as prices may change:

*Approximate pricing as of October 2026 — verify at tailscale.com/pricing. Tailscale uses seat-based pricing.

What Seat-Based Pricing Means

You pay per seat, not per device. Devices are unlimited on all plans. A "seat" is occupied when a user first authenticates a device. Seats can be reused — if a user leaves and another joins, they share the same seat count.

Free 14-Day Enterprise Trial

Sign up with a custom domain (work email) to get a 14-day free trial of all Enterprise features with unlimited users and devices.

Plan Feature Comparison

• Personal (Free): MagicDNS, Subnet Router, Exit Node, ACLs, up to 3 users, 100 devices
• Standard: All Personal features + unlimited users, custom DNS, priority support
• Premium: All Standard + SSO/SAML, SCIM provisioning, audit logs, custom DERP servers
• Enterprise: All Premium + dedicated support, compliance features, annual invoice

Tailscale vs. Self-Hosted WireGuard

Headscale: Self-Hosted Control Plane

For maximum privacy and control, Headscale is an open-source implementation of the Tailscale coordination server. Deploy it on your own VPS and point Tailscale clients at it — you get the Tailscale UX with full control over the control plane. Headscale is a community project, not officially supported by Tailscale.

When to Choose Tailscale

• Fast setup with minimal networking knowledge
• Team needs web-based node management
• Personal/homelab on the free tier
• MagicDNS and Subnet Router without manual configuration

When to Choose Self-Hosted WireGuard

• Full control over every component
• Company policy prohibits third-party coordination services
• Specific compliance requirements around key management

Real-World Use Cases

1. Remote Work: Access Office Resources from Home

Install Tailscale on one office machine (or a dedicated Raspberry Pi/mini PC) and configure it as a Subnet Router for the office LAN (e.g., 192.168.0.0/24). Remote employees running Tailscale can then access internal resources — file servers, databases, internal web apps — directly from home without a traditional VPN gateway.

2. Developer Teams: Secure Staging Access

Teams use Tailscale to connect laptops to staging servers without exposing those servers to the public internet. ACLs ensure developers only access their permitted servers and ports, while ops has full access.

3. Homelab: Access NAS and Services Remotely

Install Tailscale on a Raspberry Pi and set it as a Subnet Router. Access your Synology NAS, Home Assistant, Plex, Proxmox, or any other home service from anywhere in the world without port forwarding or DDNS setup.

4. Site-to-Site: Connect Multiple Cloud Regions

Join VPS instances across different providers and regions (e.g., a Thai VPS and a European VPS) into one tailnet. Services on each node communicate via private Tailscale IPs, without exposing inter-node traffic to the public internet.

5. Kubernetes and Container Networking

Tailscale's official Kubernetes operator integrates pods and services into a tailnet. Useful for hybrid setups mixing on-premises and cloud clusters, or giving developers direct access to staging cluster services without kubectl port-forward.

Recommended VPS for Running Tailscale

Any Linux VPS is compatible with Tailscale. The key requirements are:

• Linux OS (Ubuntu 20.04+ or Debian 11+ recommended)
• Root or sudo access for installation and IP forwarding
• Sufficient bandwidth if using as an Exit Node
• Static public IP (not strictly required, but simplifies configuration)