Tailscale

Tailscale is a commercial VPN product that uses WireGuard as its cryptographic transport layer and adds a coordination plane (operated by Tailscale Inc.) to automate key distribution, NAT traversal, and device authentication. It creates a virtual private mesh network (called a tailnet) where every enrolled device can communicate directly with every other enrolled device using stable private IP addresses (100.x.x.x range), regardless of the underlying network topology. For self-hosters and remote builders, Tailscale is the fastest path to securely accessing home or VPS-hosted services from anywhere.

How it works

When a device joins a tailnet, it generates a WireGuard key pair and registers the public key with Tailscale’s coordination server. Tailscale uses a modified STUN/ICE approach to establish direct peer-to-peer WireGuard tunnels between devices, falling back to DERP (Designated Encrypted Relay for Packets) relay servers when direct connections are not possible due to symmetric NAT. MagicDNS assigns stable human-readable hostnames (device-name.tailnet.ts.net) to each device, eliminating the need to track IP addresses.

Key facts

• Free tier: The personal free plan supports up to 3 users and 100 devices, which covers most individual and small-team self-hosting use cases
• Subnet routing: A Tailscale subnet router can expose an entire home network CIDR to the tailnet, giving remote access to devices without Tailscale installed
• Exit nodes: Any tailnet device can be designated as an exit node, routing all internet traffic through it, effectively acting as a VPN in the traditional sense

For builders

Tailscale is the fastest way for builders to set up secure remote access to self-hosted services without exposing anything to the public internet. The typical workflow: install Tailscale on the home server and the travel laptop, and all self-hosted services become accessible via their Tailscale hostname from anywhere, with no port forwarding, no dynamic DNS, and no public-facing attack surface. It is also how many small engineering teams share access to shared development infrastructure.

Sources

• IETF. RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3. datatracker.ietf.org
• Donenfeld, J. A. (2017). WireGuard: Next Generation Kernel Network Tunnel. wireguard.com
• F5 / Nginx. Nginx official documentation. nginx.org
• IETF. RFC 1035: Domain Names, Implementation and Specification. datatracker.ietf.org
• Cloudflare. Tunnel and Zero Trust networking documentation. developers.cloudflare.com