You are at a friend's house and want to show them a photo stored on your home server. Or you are on vacation and want to check the ad blocker is still running. Tailscale solves this. It is a service that joins your phone, laptop and home server into one private network, built on the WireGuard VPN, so they can reach each other from anywhere. You do not need to open any ports on your router.
This guide explains how Tailscale works in plain words, what the free plan covers as of October 2026, how to set it up, and what can go wrong.
Who this is for (and who it is not for)
This is for you if you run a home server, a NAS or a mini PC, and you want to reach it safely from outside the house.
This is not for you if you want to publish a public website for strangers. Tailscale is for your own devices and people you invite. It is also not for you if you refuse to depend on any outside company. In that case, read the sections on Headscale and plain WireGuard below.
If you have not built the server yet, start with the home server setup guide. If you are still picking hardware, the guide to what to look for in a mini PC home server helps.
The problem Tailscale solves
Your home router acts like a front door with no mail slot. Devices inside can go out to the internet. Nothing outside can come in, unless you let it.
The old way to let it in is port forwarding. You tell the router: "send anything that arrives on this door number to my server." It works. But that door is now open to the whole internet. Automated scanners find open ports fast, then try passwords and known bugs. If the app behind the door has a flaw, an attacker can get in.
That is why you should never expose admin pages, such as the Proxmox web interface, to the internet.
Tailscale takes a different path. Each device makes an outgoing connection, which your router already allows. Then the devices find each other and connect. Tailscale's docs say it works across firewalls and NAT (the way your router shares one public address with every device at home) "without requiring port forwarding or complex firewall rules."
What is Tailscale, and how does it work?
Tailscale has two parts.
- The app on each device. You install it on your server, phone and laptop. It creates encrypted WireGuard tunnels to your other devices. WireGuard describes itself as "an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography."
- The coordination server. Tailscale runs this. It keeps a list of your devices and hands out their keys and addresses, so they can find each other. It acts like a phone book, not a switchboard.
Your devices and the people you invite form a private network. Tailscale calls this a tailnet. According to the Tailscale docs, devices connect peer to peer (directly, device to device) with end-to-end encryption.
Sometimes a direct link is not possible, for example on a strict hotel or office network. Then traffic goes through a Tailscale relay, called a DERP server. As of October 2026, you can also let one of your own devices act as a peer relay. A relay only forwards data that is already encrypted. Tailscale's docs state that private keys never leave the device, so a relay cannot decrypt your traffic.
You do not create a Tailscale password. You sign in with an account you already have. As of October 2026, Tailscale's docs list Apple, Google, GitHub, Microsoft, Okta and OneLogin, plus passkeys and custom sign-in (OIDC) providers.
Tailscale vs WireGuard and other options
Tailscale is not the only way in. Here is how the common options compare for a home user.
| Option | Open ports needed? | Setup effort | Who runs the coordination | Best for |
|---|---|---|---|---|
| Tailscale | No | Low: install and sign in | Tailscale (the company) | Most DIYers and families |
| Headscale + Tailscale apps | Yes, for your Headscale server | Medium to high | You | People who want no outside control server |
| Plain WireGuard | Yes, one UDP port on your router | Medium: you manage keys and configs | You | People who want full control and fewer moving parts |
| Cloudflare Tunnel | No | Medium | Cloudflare | Publishing a web app to the public |
| Port forwarding | Yes, one per service | Low at first | You | Never for admin pages |
Plain WireGuard
Tailscale uses WireGuard under the hood. You can also run WireGuard by itself. You set up a server at home, open one UDP port on your router and create a key pair for each device. WireGuard's site says a connection is made "by exchanging very simple public keys", much like SSH keys. It is fast and lean. The cost is your time: you add each device by hand and keep the configs in order.
Cloudflare Tunnel
A Cloudflare Tunnel also avoids open ports. A small program called cloudflared makes an outgoing connection from your server to Cloudflare's network. Visitors reach your app through Cloudflare. That suits a public web page, such as a family blog. You usually need a domain managed in Cloudflare. The trade-off is that your traffic passes through Cloudflare, and anything you publish is open to the internet unless you add a login in front of it. For private admin access, a VPN such as Tailscale is the simpler fit.
Headscale: the self-hosted option
Headscale is "an open source, self-hosted implementation of the Tailscale control server." You run the phone book yourself and point the Tailscale apps at it. Its README says it covers a single tailnet, suited to personal use or a small open-source group. It also states it is not associated with Tailscale Inc. The catch: your devices must reach your Headscale server from wherever they are. That usually means opening a port or renting a small cloud server. Start with Tailscale. Move to Headscale later if you want to.
What you need: hardware, skill, time and cost
- Hardware. Nothing new. Tailscale has apps for Linux, Windows, macOS, iOS and Android. For other devices, check the install docs.
- Skill. You can install an app and paste one command on a Linux server.
- Time. An evening for your first devices and settings.
- Cost. As of 9 October 2026, the Tailscale pricing page lists a free Personal plan with up to 6 users and unlimited user devices. Some features have caps on the free plan. Plans change, so check the page before you rely on it. Paid plans exist for teams and businesses.
One caveat. Most of the Tailscale client code is open source (BSD-3-Clause license), but the coordination server is not. You depend on the company for that part, unless you use Headscale.
How to set up Tailscale: the outline
These steps show the shape of the job. Follow the current Tailscale docs, because screens change.
- Create your tailnet. Go to the Tailscale site and sign in with your Google, Microsoft, Apple or GitHub account. Use the account you protect best.
- Install it on your home server. On a Linux server or VM, the docs give a one-line install:
curl -fsSL https://tailscale.com/install.sh | sh. Then runsudo tailscale up. It prints a link. Open the link and sign in to add the server. - Install it on your phone or laptop. Get the app from your app store. Sign in with the same account.
- Find your server by name. MagicDNS gives each device a name, so you type the server's name instead of a number address. Tailscale's docs say it is on by default for tailnets created on or after 20 October 2022.
- Test from outside. Turn off Wi-Fi on your phone and use cellular data. Open your photo app or dashboard by the server's name.
- Turn off key expiry for the server. By default, device keys expire after 180 days, and the device must sign in again. Tailscale's docs suggest turning this off for trusted servers that are hard to reach. Leave it on for phones and laptops.
If your server runs Proxmox, install Tailscale inside the VM or container that runs your apps, not on the host by habit. An unprivileged LXC container also needs access to the /dev/net/tun device. Tailscale's LXC guide shows how. The guide to what Proxmox VE is explains the host and guest layers.
Two useful extras
- Exit node. An exit node is a device that carries all your internet traffic, not just traffic to your server. Set your home server as one, and on hotel Wi-Fi your phone browses as if it were at home. On Linux, turn on IP forwarding, then run
sudo tailscale set --advertise-exit-node. An admin then approves it in the admin console. - Subnet router. Some devices cannot run Tailscale, such as a printer or a smart TV. A subnet router is a Tailscale device that lets your tailnet reach them on your home network.
Sharing with family
You have two choices.
- Invite them as users. They join your tailnet. The free plan counts them toward the 6-user limit listed on the pricing page. By default, they can reach every device, so set access rules first (see below).
- Share one device. You share only the media server, for example. Tailscale's docs say the recipient gets access to "only the shared machine" and nothing else. They accept it with their own Tailscale account. Sharing is available on all plans.
For grandparents who only want the photo app, sharing one device is the cleaner choice.
The risky bit: what can go wrong
- A weak sign-in account. Your tailnet is only as safe as the Google or Microsoft account you sign in with. Turn on two-step login there. If someone takes that account, they can add their own device to your network.
- Open access rules. Tailscale's docs say the default policy lets every device in the tailnet reach every other device. That is fine for one person. Once you add family, write access control rules (ACLs, the list of who can reach what) so a guest phone cannot reach your Proxmox admin page.
- Treating the tailnet as a fortress. A device on your tailnet can still be infected. Keep strong passwords on your apps, and keep the server updated.
- A forgotten old device. A lost laptop stays in the tailnet until you remove it. Check the device list now and then.
- Opening ports anyway. Once Tailscale works, close any old port forwards on your router. Otherwise you keep both risks.
The recovery step: removal and rollback
- Remove a lost device. Open the admin console, find the device and remove it. Its access ends.
- Keep a way in at home. Tailscale is an extra path, not the only path. Make sure you can still reach your server on your home network without it, in case you lock yourself out with an access rule.
- Undo an access rule. Keep a copy of your last working policy before you edit it. If a change blocks you, paste the old one back.
- Remove Tailscale completely. On the server, sign out with
sudo tailscale logout, then uninstall it as Tailscale's uninstall guide describes. Remove the device in the admin console too.
For more ideas on what to run once you can reach your server from anywhere, see these home lab projects.
FAQ
Is Tailscale free?
As of 9 October 2026, Tailscale lists a free Personal plan with up to 6 users and unlimited user devices. Some features have caps on that plan. Check the pricing page for current terms before you rely on them.
Is Tailscale a VPN?
Yes. It is a mesh VPN built on WireGuard. Instead of all traffic going through one central server, your devices connect to each other directly where they can.
Can Tailscale see my traffic?
Tailscale's docs say traffic is encrypted end to end, and private keys stay on your devices. Even its relay servers cannot decrypt traffic. The company does run the coordination server, which knows which devices are in your tailnet.
What is the difference between Tailscale and WireGuard?
WireGuard is the VPN protocol. Tailscale is a service built on it that handles keys, addresses and connections for you. With plain WireGuard, you do that work yourself and open a port on your router.
Do I need to open ports on my router for Tailscale?
No. Each device makes an outgoing connection, which home routers allow. If a direct link fails, traffic goes through an encrypted relay instead.
Can I self-host Tailscale?
Not the official coordination server. Headscale is an open source, self-hosted replacement for it, run by a separate project. It covers a single tailnet, and your devices must be able to reach it from outside the house.
