Install Tailscale on VPS — Private Mesh VPN Setup

Tailscale is a mesh VPN built on top of WireGuard that lets you securely connect all your devices — VPS servers, laptops, phones — without dealing with complex firewall rules or port forwarding. Install the agent on each machine, sign in with the same account, and every device instantly gets a private 100.x.x.x IP that can reach all others.

Unlike traditional WireGuard, Tailscale handles key exchange and routing automatically. No manual public key distribution required. It's ideal for home labs, teams needing secure access to multiple VPS instances, or anyone who wants to self-host services without exposing ports to the public internet.

Requirements

• VPS running Ubuntu 20.04/22.04/24.04 or Debian 11/12
• Tailscale account (free at tailscale.com — supports 1 user / 100 devices)
• root or sudo access on the VPS
• IPv4 forwarding capability (for subnet routing)

Install Tailscale on Your VPS

Tailscale maintains an official Linux repository. The quickest way is the install script:

# Download and run the official install script
curl -fsSL https://tailscale.com/install.sh | sh

# Manual setup for Ubuntu/Debian
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/jammy.noarmor.gpg \
  | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg > /dev/null

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/jammy.tailscale-keyring.list \
  | sudo tee /etc/apt/sources.list.d/tailscale.list

sudo apt-get update && sudo apt-get install tailscale -y

Verify the installation:

tailscale version

Start Tailscale and Authenticate

Enable the Tailscale daemon and authenticate with your account:

# Enable and start the service
sudo systemctl enable --now tailscaled

# Authenticate — this prints a URL to open in your browser
sudo tailscale up

Open the printed URL in a browser and sign in with Google, GitHub, or Microsoft. Your VPS will immediately appear in the Tailscale admin console at login.tailscale.com/admin.

Enable IP Forwarding for Subnet Routing

To use your VPS as a gateway that lets Tailscale devices reach your VPS's local subnet:

# Enable persistent IP forwarding
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Advertise the subnet (e.g., your VPS's private network)
sudo tailscale up --advertise-routes=10.0.0.0/24

Then in the Admin Console → Machines → select your VPS → Edit route settings → approve the advertised route.

Set VPS as an Exit Node

An exit node routes all internet traffic from your other devices through the VPS — exactly like a traditional VPN:

# Advertise this VPS as an exit node
sudo tailscale up --advertise-exit-node

# Enable NAT masquerading so traffic can flow out
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Persist the iptables rule
sudo apt-get install iptables-persistent -y
sudo netfilter-persistent save

Then in the Admin Console → Machines → select your VPS → Edit → check "Allow this device to be used as an exit node".

On any other Tailscale device, go to the Tailscale menu → "Use exit node" → select your VPS.

Connect Other Devices

Install Tailscale on each device you want in your private network:

• Linux: Same install script, then sudo tailscale up
• macOS/Windows: Download the app from tailscale.com/download
• iOS/Android: Install from the App Store / Google Play, then sign in

All devices signed in with the same account instantly see each other through the 100.64.0.0/10 Tailscale address space.

MagicDNS and HTTPS

Tailscale's MagicDNS automatically assigns stable hostnames like my-vps.tail1234.ts.net to every machine — no more remembering IP addresses:

# List all devices and their hostnames
tailscale status

# Test connectivity by hostname
ping my-vps.tail1234.ts.net

# Issue an HTTPS certificate for the Tailscale hostname
sudo tailscale cert my-vps.tail1234.ts.net

Tailscale ACL (Access Control)

Control which devices can reach which services with a JSON policy in Admin Console → Access Controls:

{
  "acls": [
    // Admins can reach all ports on tagged VPS machines
    {"action": "accept", "src": ["group:admin"], "dst": ["tag:vps:*"]},
    // Developers can only SSH (port 22)
    {"action": "accept", "src": ["group:dev"], "dst": ["tag:vps:22"]}
  ],
  "tagOwners": {
    "tag:vps": ["group:admin"]
  }
}

Verify Tailscale Is Working Correctly

# Show status and IPs of all devices in your network
tailscale status

# Show your VPS's Tailscale IP
tailscale ip -4

# Ping another device in the network
tailscale ping 100.x.x.x

# Check advertised routes
tailscale status --active

# Inspect the daemon log
sudo journalctl -u tailscaled -n 50 --no-pager

# Confirm IP forwarding is enabled
sysctl net.ipv4.ip_forward

Troubleshooting Common Issues

Error: "failed to connect to coordination server"

The VPS cannot reach Tailscale's coordination server. Usually caused by firewall rules blocking outbound HTTPS or broken DNS.

# Check outbound HTTPS connectivity
curl -sv https://login.tailscale.com/machine/register

# Verify DNS resolution
dig login.tailscale.com

# Temporary nameserver override if DNS is broken
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

Error: "subnet router not accepting routes"

Either the route hasn't been approved in the Admin Console, or IP forwarding isn't enabled.

# Verify IP forwarding
sysctl net.ipv4.ip_forward
# Must show: net.ipv4.ip_forward = 1

# Re-advertise the route
sudo tailscale up --advertise-routes=10.0.0.0/24

# Then approve it: Admin Console → Machines → VPS → Edit route settings

Error: "connection is over DERP" (not direct)

Tailscale is falling back to a relay because NAT or a firewall blocks UDP for the WireGuard tunnel.

# Open UDP 41641 for direct WireGuard connections
sudo ufw allow 41641/udp comment "Tailscale"
# Or with iptables
sudo iptables -A INPUT -p udp --dport 41641 -j ACCEPT

# Re-check connectivity
tailscale netcheck

Error: "tailscaled: permission denied" when running tailscale up

The daemon isn't running or the current user lacks access to the socket.

# Start and check daemon status
sudo systemctl start tailscaled
sudo systemctl status tailscaled

# Inspect socket permissions
ls -la /var/run/tailscale/tailscaled.sock

Error: "node key expired"

The node's authentication has expired and needs to be renewed.

# Re-authenticate interactively
sudo tailscale up --force-reauth

# Or use a fresh auth key from the Admin Console
sudo tailscale up --authkey=tskey-auth-NEWKEY

Frequently Asked Questions

How many devices can I use on the free Tailscale plan?

The free Personal plan supports 1 user and up to 100 devices — more than enough for a home lab. The Starter plan ($6/month) allows 2 users and 100 devices, while the Business plan ($18/user/month) removes device limits and adds SSO/SAML/SCIM support.

What's the difference between Tailscale and WireGuard?

WireGuard is a kernel-level VPN protocol that requires manual setup: generate key pairs, distribute public keys, configure each peer individually. Tailscale is an orchestration layer built on WireGuard that automates all of this through a central coordination server. Adding a new device takes seconds instead of minutes. The trade-off is a dependency on Tailscale's cloud for authentication — Headscale is a self-hosted open-source alternative that removes this dependency.

Does my traffic pass through Tailscale's servers?

No — the data plane travels directly between devices peer-to-peer using WireGuard encryption. Tailscale's servers only handle the control plane (key exchange and coordination). If both sides are behind strict NAT, Tailscale falls back to DERP relay servers, but the payload remains WireGuard-encrypted end-to-end.