Tailscale is a secure, identity-based networking tool built on WireGuard that makes it easy to connect devices, servers, and private services across networks.
- Connects your devices into a private network
- Makes remote access to servers and services simpler
- Helps avoid exposing internal services directly to the public internet
- Create a Tailscale account
- Log in with your identity provider
- Follow the setup flow to add the devices you want to connect
- Repeat the process on each machine you want in the same tailnet
For personal use, the free Personal plan is usually more than enough.
- Free forever
- Up to 6 users
- Unlimited user devices
- Access to nearly all core features
- Accessing a VPS or homelab remotely
- Reaching private services from your laptop
- Connecting machines across different networks with less VPN setup overhead
On the VPS, run:
sudo tailscale upCheck the current connection status:
tailscale statusCheck that you can reach another machine on your tailnet:
tailscale ping your-other-machineIf you want to use the regular system ping instead, use the machine name or Tailscale IP:
ping -c 4 your-other-machineTo expose a local service only inside your tailnet, run this on the machine hosting the service:
sudo tailscale serve --bg --https=9119 localhost:9119This runs in the background, and Tailscale Serve stays configured even after a reboot.
Check the current Serve status:
tailscale serve statusYou should see something similar to:
Serve is enabled
Proxy: http://127.0.0.1:9119
Available within your tailnet at:
https://your-machine.your-tailnet.ts.net:9119
From your Mac, open the URL in a browser:
open https://your-machine.your-tailnet.ts.net:9119To disable all Serve configuration on that machine, reset it:
tailscale serve resetIf you want to disable only that one Serve mapping, use:
tailscale serve --https=9119 offIf you are using multiple Serve mappings or non-default flags, use the matching off form for the specific mapping you want to remove.
- Use the machine name or Tailscale IP when testing connectivity
- If MagicDNS is enabled, machine names are usually the easiest option
tailscale serveshares the service only inside your tailnet, not publicly on the internettailscale serve resetclears all Serve configuration on that machine, while matchingtailscale serve ... offcommands are better when you want to remove only one specific mapping
For a VPS that already uses the base hardening guide, see SSH Over Tailscale For VPS to keep normal OpenSSH users and keys while removing public SSH exposure