9 ms·
How I use Tailscale
- sixothree 1y agoI love me some tailscale. But it kills the battery on my phone and it kills resolve.conf every time I boot wsl. I wish I had better luck.
- 8n4vidtmkvmk 1y agoSounds a bit like a fancier ngrok. Accidentally wiring everything to everything else sounds kind of scary. There's 1 or 2 things I wouldn't mind securely exposing to the internet (like Plex) but nothing I need so desperately while I'm out and about that I'd even want to take that risk. Sounds like this is just for self-hosting?
- oliyoung 1y ago> Sounds a bit like a fancier ngrok. Well, yes and no. You can use it like ngrok, and I'm sure you could configure wireguard and ngrok to give you something similar to what Tailscale does, but Tailscale does it out of the box, with polished and well built client and server apps. I'm no infra guy, I'm just a former front-end eng, but it gives me the confidence to expose media centres and file servers etc to "the wild" without it being public. Using Jellyfin to watch content from my home server on my iPad while I'm away from home is as "easy" as Disney or Netflix with Tailscale, just installed the clients and servers and .. voila?
- mh- 1y agoI was an infra guy early in my career, and I'm still savvy, and I still prefer using Tailscale. It's very polished and reliable. But personally, I'm past the point of wanting to fiddle with things like this and would much prefer them to just work out of the box.. so I can fiddle with the things I wanted to, and not end up down a (personally) unenjoyable rabbit hole. No judgment on people who do enjoy it, though! I used to, and maybe I will again at some point.
- elcritch 1y agoIt's pretty handy to setup an exit node on your home network so that when you go abroad you can still watch your streaming services too! More importantly you can use it to access your bank or other services which often block non-US IPs. It's saved me a few times in the last year or two.
- Larrikin 1y agoHaving all your mobile traffic routed through AdGuard Home (or PiHole) is a game changer. It's also nice using an exit node through my home network whenever I am on public wifi.
- burnt-resistor 1y agoPlex already supports remote access via UPnP. https://support.plex.tv/articles/200289506-remote-access/ https://support.plex.tv/articles/200289506-remote-access/
- c0wb0yc0d3r 1y agoTo me WireGuard is safer than exposing services directly to the internet.
- burnt-resistor 1y agoSure, it's pretty simple. I had WG provided by an Deciso OPNsense router with an automatic VPN profile on most user devices. All of my infrastructure also had PKI. (I moved recently and have yet to set it up again.)
- 15155 1y agoTailscale is able to hole punch in scenarios where UPnP is disabled (just good practice) as well as many NAT environments.
- em-bee 1y agoSpeaking of SSH, Tailscale has special support for it whereby it handles any incoming connection to port 22 from the Tailscale network, and deals with authentication itself. No public keys or passwords: if you’re logged into Tailscale you can be logged into the machine. This is particularly handy when you SSH from a phone, as proper credential management is a bit of a nightmare there. this has me worried. i would not want that. i use zerotier, not tailscale, but the principle is the same. i have my laptops and my phone connected to my servers. given that all of those machines are already on the internet, connecting them into a virtual network does not add any risk in my opinion. (at least as long as you don't use features like the above). all i get is a known ip address for all my devices, with the ability to connect to them if they have an ssh server running. when i am outside the primary benefit is that i can tell which devices are online.
- 15155 1y agoThis feature isn't enabled by default.
- miunau 1y agothis is for teams where you don't want to create passwords or keep track of ssh keys for everyone by hand. it greatly simplified our server usage as we can simply ssh user@machine and it just works. you can create access controls for it as well.
- jaxxstorm 1y agoI wrote a POC for using Tailscale serve and funnel similarly to ngrok here: https://github.com/jaxxstorm/tgate https://github.com/jaxxstorm/tgate
- thrown-0825 1y agoI use a similar setup, but for anyone following this guide i would not recommend hosting your custom oidc server behind the same tailnet it authorizes. Any configuration issues will lock you out entirely and you will need to have tailscale support re-enable an oauth provider and its not reversible. I use an oauth provider to log in to tailscale and keycloak internally as an oidc provider for service to service auth.
- redat00 1y agoNeat way to use Tailscale ! I have a similar set-up, without authentication however, relying on Nebula! https://github.com/slackhq/nebula https://github.com/slackhq/nebula
- abdusco 1y agoI tried using `tailscale funnel` against a dummy server `python -m http.server`, and within 10 seconds the bots started to check for vulnerabilities. Tailscale warns you about how enabling it will issue an HTTPS certificate which will be in a public ledger. But I wasn't expecting it to be this quick. 127.0.0.1 - - [10/Aug/2025 00:11:34] "GET /@vite/env HTTP/1.1" 404 - 127.0.0.1 - - [10/Aug/2025 00:11:34] code 404, message File not found 127.0.0.1 - - [10/Aug/2025 00:11:34] "GET /actuator/env HTTP/1.1" 404 - 127.0.0.1 - - [10/Aug/2025 00:11:34] code 404, message File not found 127.0.0.1 - - [10/Aug/2025 00:11:34] "GET /server HTTP/1.1" 404 - 127.0.0.1 - - [10/Aug/2025 00:11:35] code 404, message File not found 127.0.0.1 - - [10/Aug/2025 00:11:35] "GET /.vscode/sftp.json HTTP/1.1" 404 - 127.0.0.1 - - [10/Aug/2025 00:11:35] code 404, message File not found 127.0.0.1 - - [10/Aug/2025 00:11:39] "GET /s/7333e2433323e20343e2538313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1" 404 -
- mh- 1y agoYeah, I have mixed feelings about CT (certificate transparency) for this reason. Folks are just consuming the firehose and scanning. And in this case, if the thing you're funnel'ing is on your residential connection, it basically amounts to you summoning a DDoS. One (obvious?) tip I'd offer is to put your stuff on high non-standard ports if you can. It'll reduce the amount of connections you get dramatically.
- modernpacifist 1y agoA DoS that will disappear once you close the funnel. Tailscale are proxying the traffic so your public IP isn’t exposed. Your choice of port makes no difference.
- tptacek 1y agoWhen you care about this, if you're managing your own certificates, you can issue wildcard certificates.
- mh- 1y ago
- mlhpdx 1y agoI’ve been experimenting with different ways of using WireGuard but hadn’t heard of the header based authentication Tailscale does. Interesting stuff.
- Lammy 1y ago> It’s a subscription product, but it has an insanely generous free tier that covers basically anything you’d ever want to do as an individual. Tailscale do have a very nice product, but privacy-conscious users should be aware that you must disable Tailscale's real-time remote collection of your behavior on your “private” network. See KB1011: https://tailscale.com/kb/1011/log-mesh-traffic https://tailscale.com/kb/1011/log-mesh-traffic “Each Tailscale agent in your distributed network streams its logs to a central log server (at log.tailscale.io). This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.” It's possible to opt out of this spying on Unix/Windows/Mac clients by starting Tailscale with `--no-logs-no-support` or `TS_NO_LOGS_NO_SUPPORT=true` environment variable (see https://tailscale.com/kb/1011/log-mesh-traffic#opting-out-of-client-logging https://tailscale.com/kb/1011/log-mesh-traffic#opting-out-of...), but it is not currently possible to opt out in the Android/iOS clients: https://github.com/tailscale/tailscale/issues/13174 https://github.com/tailscale/tailscale/issues/13174 For an example of how invasive this is for the average user, this person discovered Tailscale trying to collect ~18000 data points per week about their network usage based on the number of blocked DNS requests for `log.tailscale.com`: https://github.com/tailscale/tailscale/issues/15326 https://github.com/tailscale/tailscale/issues/15326 Also see their privacy policy: https://tailscale.com/privacy-policy#information-we-collect-through-automated-means https://tailscale.com/privacy-policy#information-we-collect-... “When you use the Tailscale Solution, we collect limited metadata regarding your device used to access the Tailscale Solution, such as: the device name; relevant operating system type; host name; IP address; cryptographic public key; user agent (where applicable); language settings; date and time of access to the Tailscale Solution; logs describing connections and containing statistics about data sent to and from other devices (“Inter-Node Traffic Logs”); and version of the Tailscale Solution installed.” (emphasis mine) Anyway, the reason I quoted that part of your post is because Tailscale are using some Fear, Uncertainty, and Doubt tactics here by naming the privacy-preserving option “no-support”, and if you are a free user then you aren't getting support from them anyway, so there should be no downside to keeping your private network private :)
- mcsniff 1y agoThis comment should really be much higher.
- ezst 1y agoI think I "get" what tailscale is about, what I don't get is how much of it is re-implemented and available out of the box in headscale. I already do most of the things mentioned in the article (from hand-rolled WG, Apache and firewall configurations), so this level of centralised automation and orchestration has some appeal, but I'm not willing to hand over the keys to my entire network to them and would rather keep things in-house. And on the topic of headscale, some people bring up netbird as an alternative. Netbird gets some immediate sympathy from me as they put lots of emphasis opensource and self-hosted, but I'd be curious to see how they compare for the use-cases described in the article.
- m11a 1y agoI don't know enough about networking as I should, so to plug for my gap in knowledge, I generally prefer to use more comprehensible (to me) forms of security. And a feature like this: > Speaking of SSH, Tailscale has special support for it whereby it handles any incoming connection to port 22 from the Tailscale network, and deals with authentication itself. No public keys or passwords: if you’re logged into Tailscale you can be logged into the machine. kinda worries me (given also IP spoofing is possible?), compared to SSH keys whose mechanism is more obvious and thus easier to trust. I definitely like the idea of Tailscale as an extra layer of protection, but I'm not sure I'd loosen existing protections while using it, whereas many Tailscale articles often present it as a panacea for internal-network-over-the-internet security. Are my concerns misplaced?
- codethief 1y ago> kinda worries me (given also IP spoofing is possible?), It's not, Tailscale authenticates incoming connections. (Note that we're not talking a regular SSH connection to the server's public IP here. You'd connect to the server's SSH daemon through Tailscale.)
- elcritch 1y agoConnections are also encrypted with the wire guard protocol using a per-device private key.
- raesene9 1y agoOne useful additional aspect to Tailscale that I've not seen mentioned so far, is the integration with Mullvad. Using that you can get the benefit of their network servers, appearing just as standard Tailscale exit nodes, which is handy if you need to geo-shift traffic at all.
- oulipo 1y agoCan you give more details for the un-initiated? What is Mullvad? How and why would you use this feature? Is it to use it as a kind of VPN to make traffic "appear" from any country, and, eg, watch Netflix?
- raesene9 1y agoIndeed, Mullvad is a VPN provider (https://mullvad.net/en https://mullvad.net/en) they provide several privacy focused services including a VPN and a browser. Using Mullvad (or other VPN products) allows someone to make their traffic originate from specific countries, which can allow for testing to see what it'll look like from different countries, or to access content which is restricted to people in a specific country. It can also allow for bypassing age check restrictions that apply to specific geographies (e.g. the UK) Integrating it with Tailscale makes it easier to use (if you're an existing tailscale user) as instead of having to install and manage a separate product, it integrates with your existing tailscale setup, allowing you to dynamically choose a mullvad exit node in a give country, and then your Internet traffic will appear from that country. (that all sounds somewhat ad-like but I'm not in any way affiliated with Tailscale or Mullvad apart from being a user (Tailscale did give me a nice hoodie one time for writing a blog though ))
- codethief 1y ago> One useful additional aspect to Tailscale that I've not seen mentioned so far, is the integration with Mullvad. Indeed, this saved my butt earlier this year when I was at Qatar airport and they tried to MITM most of my connections (including to mullvad.net). Luckily, they didn't MITM tailscale.net, so I could log in, enable Mullvad, and thereby secure my entire traffic.
- marcogarces 1y agoif you guys love Tailscale, perhaps take a look at NetBird, an open source solution, which also has a commercial offer. Really recommend this one
- user3939382 1y agoAre people using this because they don’t want to configure dynamic DNS and NAT?
- elcritch 1y agoYes, but more so as a VPN. It's much easier than any traditional VPN to setup.
- _1tem 1y agoFor me, the benefit was simple: I blocked off ssh and Postgres on my production server from the public internet, making it such that these are only accessible from my development machine and other servers. Yet from inside the tailnet I can still talk to Postgres as if it was on LAN. I’m not sure of any easy way to do this without Tailscale.
- bornfreddy 1y agoAny VPN (including WireGuard) would allow you to do the same, and this in indeed how the systems are usually set up. Tailscale just makes the setup a bit easier, though for this use-case not by much, imho.
- jncfhnb 1y agoI just wish Tailscale let you use taildrop to directly send files to other people
- codethief 1y ago> For a long time I didn’t bother with any kind of ACLs within my Tailscale network. […] Then one day a thought hit me. […] That means anyone with access to any of my machines (or who managed to get Tailscale credentials out of one of my apps) would be able to SSH into anywhere else on my network. I'm a happy Tailscale user but I'll keep saying this whenever Tailscale comes up: We need a way to `tailnet lock` (sign) not just the tailnet nodes but also the tailnet config (ACLs). Otherwise the above scenario of an attacker taking over the entire network is still possible even if you set all ACLs correctly. All it takes is for an attacker to take over the coordination server (to manipulate ACLs) and a single tailnet node. (Which, if you run Headscale, might even be the same machine.) Until this is fixed I am not going to trust Tailscale with authenticating connections too much and will trade in convenience for defense in depth.
- EVa5I7bHFq9mnYK 1y agoMy primary use of tailscale is as a VPN. I have exit VPSes in 4 different countries, so usually at least one of them is not blocked from or to where I am trying to connect.