LifeBytes Journal

Overview

Tailscale is a modern mesh VPN built on WireGuard that makes secure connectivity across laptops, servers, and containers almost effortless. Instead of managing keys and gateways by hand, you sign in with your identity provider and every device gets a stable, encrypted connection. In this tutorial, you will set up Tailscale on Linux, Windows, and Docker, enable MagicDNS for human‑friendly names, create fine‑grained ACL rules, and configure subnet routers and exit nodes. By the end, you will have a production‑ready, zero‑config VPN that can replace brittle port forwards and site‑to‑site tunnels.

Prerequisites

You need a Tailscale account (Google, Microsoft, GitHub, or SSO), admin rights on the devices, and outbound internet access. Optional but recommended: the ability to change local firewall rules. Tailscale supports Windows 10/11, Windows Server, macOS, Linux (Debian/Ubuntu, RHEL, Fedora, Alpine), and containers (Docker, Kubernetes).

Step 1 — Create the network and enable MagicDNS

Sign up at the Tailscale Admin Console and create a tailnet (your private network). In Settings → DNS, enable MagicDNS to get easy hostnames like web01.tailnet-name.ts.net. Also enable device approval if you want an admin to approve new devices before they can join.

Step 2 — Install on Windows

Download and install the Tailscale client for Windows. Launch it, click Log in, and complete the browser prompt. After the device appears in the Admin Console, give it a readable name (for example, win-laptop). To allow others to route their traffic through this machine later, you can designate it as an exit node in Settings, then in the client select Use exit node when needed.

Step 3 — Install on Linux

On Debian/Ubuntu, install and bring the service up. Example:

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/jammy.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null; \

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/jammy.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list; \

sudo apt-get update && sudo apt-get install -y tailscale; \

sudo systemctl enable --now tailscaled; \

sudo tailscale up

Follow the login URL, approve the device, and verify you can ping another device’s Tailscale IP or its MagicDNS name. On RHEL/Fedora, use dnf install tailscale with the corresponding repo instructions from Tailscale’s docs, then run systemctl enable --now tailscaled and tailscale up.

Step 4 — Join Docker containers

For containers, the simplest pattern is a Tailscale sidecar or running Tailscale inside the container with --net=host. Create an auth key in the Admin Console (Keys → Generate auth key). For ephemeral containers, mark it reusable and ephemeral. Then:

docker run --rm --net=host --cap-add NET_ADMIN --cap-add SYS_MODULE \

-e TS_AUTHKEY=tskey-XXXXX -e TS_HOSTNAME=app01 --name ts \

ghcr.io/tailscale/tailscale:stable

Alternatively, keep Tailscale in a sidecar and expose your app container over the Tailscale interface. Using ephemeral keys avoids long‑lived credentials inside images.

Step 5 — Use MagicDNS and stable names

With MagicDNS, you can connect to devices by name instead of IP, for example ssh ubuntu@web01. If a device is multihomed, Tailscale handles routing without your input. If you cannot resolve names, ensure MagicDNS is enabled and your OS DNS cache is clean (flush with ipconfig /flushdns on Windows or systemd-resolve --flush-caches on Linux).

Step 6 — Create Access Control Lists (ACLs)

ACLs define who can reach what. In the Admin Console, open Access controls and edit the JSON. Example to allow the Helpdesk group SSH to Linux servers and RDP to Windows only:

{ "groups": { "group:helpdesk": ["[email protected]","[email protected]"] }, "tagOwners": { "tag:linux": ["group:helpdesk"], "tag:windows": ["group:helpdesk"] }, "acls": [ { "action":"accept", "src":["group:helpdesk"], "dst":["tag:linux:22","tag:windows:3389"] } ] }

Tag devices by starting Tailscale with tags, for example sudo tailscale up --advertise-tags=tag:linux. Use the principle of least privilege and review the policy on every new service.

Step 7 — Advertise a subnet router

To reach an entire LAN behind a Linux box (like a lab or on‑prem server), advertise routes from that machine:

sudo tailscale up --advertise-routes=192.168.10.0/24

Approve the route in the Admin Console. If you prefer the LAN device IPs to be the source (no SNAT), add --snat-subnet-routes=false and ensure your LAN gateway routes replies back via the router.

Step 8 — Offer an exit node for internet egress

An exit node lets clients send all internet traffic through a trusted device; useful on public Wi‑Fi. On the chosen device run:

sudo tailscale up --advertise-exit-node

Enable it in the Admin Console, then on clients open the Tailscale client and select Use exit node. Confirm DNS and split‑tunnel settings match your security policy.

Step 9 — Firewall and auto‑start tips

Tailscale uses outbound UDP on random high ports (WireGuard) and falls back to TCP/443 via DERP relays when direct NAT traversal fails. Allow outbound UDP and HTTPS. On Linux, Tailscale manages its own interface (tailscale0), but you should avoid conflicting rules that drop established/related traffic. Ensure auto‑start with systemctl enable --now tailscaled (Linux) and verify the Windows service is running after reboots.

Troubleshooting

If a device shows offline, verify system time (NTP), restart the service with sudo systemctl restart tailscaled, and check that your identity provider token has not expired. If pings work but names do not, re‑enable MagicDNS and flush DNS caches. If a container cannot join, confirm it has --net=host or appropriate capabilities and that you used a valid auth key. For route issues, ensure routes are approved and that upstream routers have return routes when SNAT is disabled. As a last resort, try tailscale bugreport and review logs at /var/log or the Windows Event Viewer.

Security best practices

Use short‑lived, ephemeral auth keys in CI and containers. Turn on device approval and SSO/MFA. Rely on tags, not users, to grant access in ACLs. Keep systems patched and enable client auto‑updates. Prefer exit nodes you control and monitor. Regularly audit your ACL JSON and remove unused devices from the tailnet.

What you built

You now have a resilient, zero‑config mesh VPN that spans Windows, Linux, and Docker. With MagicDNS, ACLs, subnet routing, and exit nodes, you can securely reach any service without exposing ports to the internet, and you can grow the network in minutes instead of days.

Overview

Tired of port forwarding, dynamic DNS, and brittle VPN configs? Tailscale gives you a zero-config mesh VPN built on WireGuard, letting your devices talk to each other securely from anywhere. In this step-by-step guide, you will install Tailscale on Linux, Windows, and macOS, enable MagicDNS, set up an exit node, publish LAN subnets, and lock everything down with access controls. By the end, you will have a private, encrypted network for your home lab or remote team that takes minutes to deploy and scales without hassle.

Prerequisites

You need a Tailscale account (Google, Microsoft, GitHub, or email sign-in), admin access to your devices, and a stable internet connection. For subnet routing and exit nodes, a Linux or always-on device is recommended. Enable multi-factor authentication in your identity provider for best security.

Step 1: Create Your Tailnet

Go to the Tailscale website and sign in to create your tailnet. This is your private network. Open the Admin Console and confirm your tailnet name. Under Settings, enable device approvals if you want manual approval before new devices join. This is useful for production and shared environments.

Step 2: Install Tailscale

Linux (Debian/Ubuntu)
Run:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
When prompted, sign in to link the device. If your distro uses a service, ensure tailscaled is running.

Linux (Fedora/RHEL derivatives)
Install and start:
sudo dnf install tailscale -y
sudo systemctl enable --now tailscaled
sudo tailscale up

Windows
Download the Windows client from Tailscale, install it, and sign in. The client will assign a 100.x Tailscale IP and show your hostname in the Admin Console.

macOS
Install the app from the Mac App Store or from Tailscale’s website. Sign in to connect the Mac to your tailnet.

iOS/Android
Install the mobile app and sign in. You can toggle the VPN on/off and optionally route all traffic through an exit node.

Step 3: Turn On MagicDNS (Human-Friendly Names)

In the Admin Console, open Settings → DNS and enable MagicDNS. This lets you reach devices by name, for example builder.tailnet-name.ts.net, instead of by 100.x IPs. Keep “Override local DNS” enabled on clients so name resolution just works across platforms.

Step 4: Enable Tailscale SSH (Passwordless, Keyless)

In Settings → Tailscale SSH, enable it for your tailnet. On servers, run:
sudo tailscale up --ssh
You can now SSH between devices using identity-based auth, e.g.:
ssh ubuntu@server-name
Access is controlled by the tailnet policy (ACLs) rather than managing per-host SSH keys.

Step 5: Use an Exit Node (Full-Tunnel Internet)

An exit node routes all internet traffic from a device through a trusted peer (great for coffee shops and travel). On the machine that will be the exit node, run:
sudo tailscale up --advertise-exit-node
In the Admin Console, approve the exit node. On the client, open the Tailscale app and choose “Use exit node” → select your device. Optionally enable “Allow LAN access” to still reach your local network while tunneling the internet.

Step 6: Publish Your LAN with a Subnet Router

A subnet router lets remote devices reach a private LAN (e.g., 192.168.1.0/24) through Tailscale. On a Linux host connected to that LAN, enable IP forwarding:
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
Persist these settings in /etc/sysctl.d/99-tailscale.conf. Then advertise routes:
sudo tailscale up --advertise-routes=192.168.1.0/24
In the Admin Console → Machines, approve the advertised routes. Clients can now access printers, NAS devices, and servers on that LAN using IP or hostnames (with your DNS). If needed, add --snat=false to preserve client IPs for upstream firewall logs.

Step 7: Lock It Down with ACLs and Tags

Open the Admin Console → Access Controls and edit the policy. Use groups and tags to define who can reach what. Example: allow helpdesk to RDP to Windows servers, and engineers to SSH into Linux hosts. A minimal snippet could look like:
{ "groups": { "group:helpdesk": ["[email protected]"] }, "tagOwners": { "tag:server": ["group:helpdesk", "group:eng"] }, "acls": [ { "action": "accept", "src": ["group:helpdesk"], "dst": ["tag:server:3389"] }, { "action": "accept", "src": ["group:eng"], "dst": ["tag:server:22"] } ] }
Apply tags on devices by running:
sudo tailscale up --advertise-tags=tag:server
Only tagged and authorized devices will accept those connections.

Step 8: Headless and Auto-Join with Auth Keys

For servers and containers, create a reusable or short-lived auth key in the Admin Console → Keys. On the device, run:
sudo tailscale up --authkey=tskey-abcdef --hostname=ci-runner-01 --advertise-tags=tag:server
Use ephemeral keys for throwaway CI agents, and rotate long-lived keys on a schedule. You can also inject TS_AUTHKEY as an environment variable in Docker or systemd units.

Step 9: Troubleshooting Essentials

If a device looks offline, first check the local service:
sudo systemctl status tailscaled (Linux). Then test reachability:
tailscale status
tailscale ping device-name
tailscale netcheck
Ensure outbound UDP 41641 is open; Tailscale falls back to relays (DERP) if direct NAT traversal fails. On Linux firewalls, allow UDP/41641 and established/related traffic. If routes are not working, confirm “Accept routes” is enabled and IP forwarding is on. For deep diagnostics, run tailscale bugreport and review logs in the Admin Console.

Security Best Practices

Require SSO and MFA for all users. Enable device approval and machine key expiry. Use groups and tags to enforce least privilege in ACLs. Restrict exit node usage to trusted admins. Regularly prune unused devices, rotate auth keys, and audit connections in the logs. Avoid exposing services publicly; instead, use MagicDNS, Tailscale SSH, or consider Tailscale Funnel selectively with HTTPS for public endpoints.

What You Can Do Next

With your mesh VPN live, map drives to a NAS over the tailnet, RDP into Windows servers from anywhere, tunnel VS Code SSH to a remote lab, or back up endpoints securely to a central repository. Tailscale scales from a weekend project to a production-ready fabric without the usual VPN pain. Most changes are policy-driven, so you can iterate quickly and keep operations clean.