I was doing a lot of work with SSH tunnels, but it seems Tailscale is an easy way into WireGuard. For now I just have one node running on my office setup to ac

I was doing a lot of work with SSH tunnels, but it seems Tailscale is an easy way into WireGuard. For now I just have one node running on my office setup to access everything there and it seems to work pretty well from home. More convenient than mapping ports anyway. Although...I don't quite grok how it might be more secure than something like certificate based SSH, seems like the Tailscale attack surface might be bigger even though you can go back and close off the firewall stuff that allows SSH to work. Would seem that instead of concentrating on breaking your (probably obscure) public IP address / port combo, an attacker would simply go to Tailscale and attack that instead.