Introduction

You manage multiple VPS instances across different cloud providers and regions. Have you ever faced these challenges?

• Configuring port mappings for each server is complex and error-prone
• Exposing public IPs for SSH, databases, and remote desktop increases security risks
• Service calls between VPS go through public internet, causing high latency
• Want to build WireGuard VPN but configuration and key management are tedious

Tailscale solves all these problems. It’s a zero-config Mesh VPN based on WireGuard. Simply install the client on each device, and it automatically creates a secure private network. All devices share the same virtual IP range without manual routing, port mapping, or firewall configuration.

This guide will walk you through building a complete private networking solution for your VPS using Tailscale.

Why Choose Tailscale?

Core Advantages

Technical Architecture

Tailscale is built on WireGuard protocol with three components:

1. Control Plane: Tailscale servers handle device authentication and NAT traversal coordination
2. Data Plane: Direct WireGuard connections between devices (P2P)
3. DERP Relay: When P2P fails, traffic is relayed through Tailscale’s servers

Your data transmission is end-to-end encrypted. Even when going through relay servers, the content cannot be decrypted.

Installation & Configuration

Step 1: Create Account

Visit Tailscale Website and log in with Google, GitHub, or Microsoft account. Personal use is free, supporting up to 5 devices.

Step 2: Install Client

Linux (Debian/Ubuntu)

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Linux (CentOS/RHEL)

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Windows

Download Windows Client, run installer, and log in.

macOS

brew install --cask tailscale
sudo tailscale up

Step 3: Configure VPS

Example for Ubuntu 22.04:

# Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh

# Start and authenticate
sudo tailscale up

# View your Tailscale IP
tailscale ip -4

# View connected devices
tailscale status

Step 4: Configure Firewall

Tailscale handles firewall rules automatically. You only need to ensure:

# Allow Tailscale interface communication
sudo ufw allow from 100.64.0.0/10
sudo ufw reload

For firewalld:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="100.64.0.0/10" accept'
sudo firewall-cmd --reload

Real-World Use Cases

Use Case 1: SSH Remote Management

Before configuration:

# Need to know each VPS public IP
ssh root@192.168.1.100
ssh root@10.0.0.50

After configuration:

# Use Tailscale IP with automatic routing
ssh root@100.64.0.1
ssh root@100.64.0.2

Advantages:

• No need to expose SSH port to public internet
• Even if VPS public IP changes, Tailscale IP remains constant
• All connections are end-to-end encrypted

Use Case 2: Service Interconnection

Assume you have three VPS:

• VPS-A: Running database (MySQL)
• VPS-B: Application server
• VPS-C: Web frontend

After configuration, the app server can directly access the database via Tailscale IP:

# VPS-B accessing VPS-A's MySQL
mysql -h 100.64.0.1 -u app_user -p

Web frontend can also access the application server directly:

# VPS-C accessing VPS-B's API
curl http://100.64.0.2:8080/api

Use Case 3: Cross-region VPS Connectivity

VPS from different cloud providers can form a private network:

# Alibaba Cloud VPS
sudo tailscale up

# Tencent Cloud VPS
sudo tailscale up

# AWS VPS
sudo tailscale up

# Now they're all in the same virtual LAN

Advanced Configuration

Subnet Routes

Allow devices in Tailscale network to access your internal resources:

# Enable subnet routes on VPS
sudo tailscale up --advertise-routes=192.168.1.0/24

# Approve the route in admin console

Access Control

Configure ACLs in Tailscale console:

{
  "acls": [
    {
      "action": "accept",
      "src": ["autogroup:members"],
      "dst": ["*:*"]
    }
  ]
}

File Sharing

Use Tailscale’s built-in file transfer feature:

# Send file
tailscale file send user@100.64.0.2 /path/to/file.zip

# Received files are saved to ~/Downloads/tailscale-file-receive/

Comparison with Alternatives

Tailscale vs WireGuard

Tailscale vs Cloudflare Tunnel

Best Practices

1. Use Strong Password and MFA

# Enable two-factor authentication
# Tailscale Console → Account Settings → Two-Factor Authentication

2. Regularly Audit Devices

# View all connected devices
tailscale status

# Remove unused devices
# Tailscale Console → Devices → Delete

3. Restrict Access Permissions

Use ACLs to strictly control which devices can access which services.

4. Monitor Network Status

# Real-time network status
tailscale netcheck

# Test connectivity
tailscale ping 100.64.0.2

FAQ

Q: Is Tailscale free?

Personal use is free, supporting up to 5 devices. Team plan is $6/user/month with unlimited devices.

Q: Is data secure?

Yes. Tailscale uses WireGuard encryption with end-to-end encryption. Even relay servers cannot decrypt the data.

Q: Will it affect network speed?

P2P direct connections have very low latency. Only when P2P fails does it use relay servers, causing slight latency.

Q: Can I self-host the control plane?

Yes. Tailscale supports self-hosted MagicDNS and control plane for enterprise needs.

Summary

Tailscale provides a simple, secure, and efficient networking solution for self-hosted enthusiasts:

• ✅ Zero-config: Install and use immediately, no manual routing
• ✅ Secure: End-to-end encrypted, controllable access
• ✅ Cross-region: VPS from different cloud providers can form private network
• ✅ Cost-effective: Free for personal use

For operators managing multiple VPS, Tailscale is a powerful tool to improve efficiency and reduce risks. Stop letting complex port forwarding and firewall rules bother you — try Tailscale today!

References

• Tailscale Documentation
• Tailscale GitHub
• WireGuard Protocol Introduction