How to Use Tailscale for Secure Remote Access

What is Tailscale?

Tailscale is a mesh VPN built on top of WireGuard, the modern, fast, and secure VPN protocol. Unlike traditional VPNs that route all traffic through a single central server, Tailscale creates direct, encrypted connections between your devices -- machine to machine. That means faster speeds, lower latency, and fewer points of failure.

Each device on your tailnet gets a stable IP address (in the 100.x.x.x CGNAT range), and once two devices have connected they can talk to each other securely from anywhere in the world. Tailscale handles NAT traversal and key exchange automatically, so you don't need to open ports or configure your router.

Best of all, it's free for personal use -- up to 100 devices on the Personal plan, which is more than enough for a home lab, a few laptops, and some phone-syncing goodness.

Step 1. Sign Up at Tailscale.com

Head to tailscale.com and sign up for a free account. Tailscale doesn't run its own identity provider -- it uses social login to prove who you are, which is actually quite convenient.

1. 1.Click Get Started or Use Tailscale on the homepage.
2. 2.Choose a login provider -- Google, Microsoft, or GitHub are the common options. You can also use Apple or email-based magic links.
3. 3.Authorize Tailscale to read your basic profile info. This is standard OAuth -- they just need your name and email to identify your account.
4. 4.You'll land on the admin console at login.tailscale.com/admin/machines. This is your control plane where you'll see every device on your network.

You're now a proud owner of a tailnet -- your own private network namespace. The free plan gives you up to 100 devices and 3 users, which is more than enough for personal and hobby projects.

Step 2. Install Tailscale on Your Devices

Now you need the Tailscale client on every device you want connected. The client is lightweight and runs quietly in the background. Here's where to get it for each platform:

Linux install example (Debian/Ubuntu):

On mobile, Tailscale sets up a VPN profile -- iOS and Android will ask for permission to add it. This is normal and required for the tunnel to function. On desktop, it just runs as a background service with a menu-bar / system-tray icon.

Step 3. Connect Your Devices

Once the client is installed, each device needs to log in to your tailnet. Here's the flow:

1. 1.Open the Tailscale app or run tailscale up on Linux.
2. 2.A browser window pops open. Log in with the same Google/Microsoft/GitHub account you used in Step 1.
3. 3.Approve the device request. Tailscale will register the device and assign it a 100.x.x.x IP automatically.
4. 4.Repeat on every device you want on the network -- your laptop, desktop, phone, Raspberry Pi, home server, etc.
5. 5.Open the admin console and confirm all your devices show up in the Machines list with their assigned IPs and hostnames.

If a device goes offline, Tailscale will simply mark it as disconnected in the admin console. The moment it comes back online, it rejoins the tailnet automatically -- no manual reconnection needed.

Note: by default new devices authenticate as soon as someone on your tailnet approves them. You can tighten this in Settings > Device Approval so every new join requires explicit approval -- highly recommended for shared tailnets.

Step 4. Access Devices by IP

Now comes the fun part. Every device on your tailnet can reach every other device by its 100.x.x.x IP, just as if they were on the same local Wi-Fi network -- except this works from anywhere on the planet, through any firewall, even on mobile data.

Here are the common things you'll want to access:

• •SSH into a home server: ssh [email protected] -- manage your Linux box from your laptop at a coffee shop.
• •File shares: SMB/CIFS works straight over Tailscale, so Windows shares and NAS drives are reachable from anywhere.
• •Web services: If your home lab runs a dashboard on port 8080, just point a browser at http://100.x.x.x:8080.
• •Remote desktop: Use RDP, VNC, or anything else -- Tailscale doesn't care which protocol you run on top.
• •Print from anywhere: Expose a printer's IP and your laptop can print to it no matter where you are.

You don't need to memorize IPs -- Tailscale can use MagicDNS (covered in Step 5) to address devices by hostname instead. But IPs work everywhere if you'd rather keep things old-school.

The traffic between devices is encrypted end-to-end with WireGuard keys. Tailscale's coordination servers help establish connections but never see your data -- they only route keys and help with NAT traversal.

Step 5. Useful Features to Explore

Tailscale has a pile of genuinely useful extras beyond the core VPN. Here are the ones you should know about:

Tailscale Funnel -- Public Access

Tailscale Funnel lets you expose a service on your device to the public internet -- no port forwarding, no DDNS, no router config. It's perfect for sharing a self-hosted site or webhook endpoint. Just run:

Tailscale will give you a public HTTPS URL on *.ts.net. Great for testing webhooks, demos, or temporary shares. Note: this is a public endpoint, so only funnel services you want the world to see.

MagicDNS -- Names Instead of IPs

MagicDNS lets you address devices by their hostname instead of the 100.x.x.x IP. So instead of typing the IP every time, you can simply:

Enable it in the admin console under DNS > MagicDNS. It integrates with your tailnet's DNS and works automatically on connected devices.

Mullvad Exit Nodes -- Privacy VPN

Tailscale integrates with Mullvad's VPN network so you can route your Internet exit through a server in any of dozens of countries. Run:

This effectively turns Tailscale into a commercial VPN too. You'll need a Mullvad subscription for exit nodes -- but for many users it's a worthwhile upgrade since you get both your own private mesh and a public VPN exit.

Taildrop -- File Sharing Between Devices

Taildrop lets you beam files between your own authenticated devices -- like AirDrop but cross-platform and reaching your Linux server too. Files are encrypted end-to-end and never touch a third-party cloud. Enable it in Settings > File Sharing.