How to Set Up Tailscale on a VPS and Connect to Services Without Open Ports

Imagine: you have rented a server in the cloud, for example, a powerful VPS, to run a website, database, or game server. Everything works, but the question of network security arises. Every open port is a potential attack vector that can be discovered during scanning. Configuring firewalls and classic VPN solutions typically takes time and a certain level of expertise. There is an approach that allows you to grant access to services on the server without needing to open ports to the public network.

The tool that implements this approach is Tailscale. It is a solution for creating private (overlay) networks that connects devices (from a local computer to a cloud server) into a single secured network. In this article, we will explore what Tailscale is, describe how it works, and provide step‑by‑step instructions for setting it up on a VPS to access services without exposing ports.

Definitions and Basic Concepts

Tailscale is a service for creating private networks that operates over the public internet. Devices in such a network (tailnet) can communicate directly as if they were on the same local network. The key feature is that there is no need to manually open ports on routers or servers.

Main components of the Tailscale ecosystem:

• Tailnet: the private network that connects all enrolled devices (nodes).
• Nodes: devices connected to the tailnet: laptops, servers, smartphones, single‑board computers.
• Control Plane: the cloud component that manages device authentication and key distribution. In the case of Tailscale, this component is hosted on the developer’s infrastructure.
• Data Plane: traffic transmitted directly between devices using the WireGuard protocol, without passing through the control plane server.

Tailscale uses WireGuard — a modern protocol with strong encryption, a minimal codebase, and high performance. This is not the only technology for building overlay networks. There are open‑source projects, such as Headscale, that allow you to run your own implementation of the Tailscale control plane. However, in this article we focus on the official service as a simpler solution to get started.

How It Works: NAT Traversal and Direct Connections

The key difference between Tailscale and traditional VPNs lies in how connections between devices are established.

With a traditional VPN, all traffic passes through a central VPN server, which can introduce latency and limit throughput. Tailscale, in contrast, tries to establish a direct (peer‑to‑peer) connection between devices whenever possible. This provides higher speed and lower latency.

The connection establishment mechanism works as follows:

1. Installation and authentication: On each device (including the VPS), a Tailscale agent is started. On first run, the agent contacts the coordination server to authenticate the user (via OAuth providers: Google, Microsoft, GitHub). After successful authentication, the device receives an internal IP address from a dedicated pool (e.g., 100.64.0.0/10) and becomes part of the tailnet.
2. Key exchange: The coordination server distributes information about other nodes in the tailnet to all devices, including their WireGuard public keys and current network addresses. The coordination server itself does not participate in transmitting user traffic and does not have access to the devices’ private keys.
3. Direct connection setup (NAT traversal): When device A tries to connect to device B, the Tailscale clients on both ends attempt to establish a direct UDP connection. This uses techniques known as NAT traversal, based on the STUN and ICE protocols. In most cases a direct connection is successfully established.
4. Fallback relaying (DERP): If a direct connection is impossible due to firewall restrictions (e.g., symmetric NAT), traffic automatically switches to using DERP (Detoured Encrypted Routing Protocol) relay servers, also owned by Tailscale. Traffic through DERP servers remains end‑to‑end encrypted.

Example: You are travelling and connect your laptop to a hotel Wi‑Fi network. Your VPS running a control panel application is located in a data centre. The Tailscale agents on both devices will establish a direct encrypted connection (or use DERP if necessary). Your laptop can then open the control panel by accessing the server’s internal IP address (e.g., 100.64.0.1:8080), without needing to open any ports on the VPS’s public IP address. All traffic between the laptop and the server is encrypted.

Cloud Servers from $5 / moIntel Xeon Gold 6254 3.1 GHz CPU, SLA 99,9%, 100 Mbps channelTry

Comparison: Tailscale vs. Traditional VPN

Characteristic	Traditional VPN (OpenVPN/IPsec)	Tailscale
Traffic routing	Centralised: all traffic goes through the VPN server	Mesh network: direct (P2P) connection between devices
Performance	Limited by the VPN server’s bandwidth	High, close to the speed of the direct internet connection
Setup complexity	High: key/certificate generation, routing and firewall configuration	Low: install agent and authenticate via OAuth
Access control	Based on IP addresses or certificates	Based on user accounts and ACLs (Access Control Lists)
Open ports	Requires open ports on the server and possibly on client firewalls	Not required: clients initiate outbound connections

Installing Tailscale on a VPS

To get Tailscale working on a server, you need to run a few standard commands. The example uses Ubuntu 22.04/24.04.

1. Update the system

sudo apt update && sudo apt upgrade -y
sudo apt install curl -y

2. Add the official Tailscale repository

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list

3. Install the package

sudo apt update
sudo apt install tailscale -y

4. Connect the server to the tailnet

sudo tailscale up

The system will output a URL like https://login.tailscale.com/a/xxxxxxxx. Open it in a browser and log into your Tailscale account (via Google, Microsoft, or GitHub).

5. Verify the connection

tailscale status
tailscale ip -4

The first command shows the list of devices in the network, the second shows the internal IPv4 address of your VPS (e.g., 100.64.0.1).

Exit Node: Routing All Internet Traffic

The mechanism described above concerns traffic between devices inside your tailnet. By default, Tailscale does not route public internet traffic (e.g., browsing websites) — such traffic goes directly from your device, bypassing the tailnet. However, Tailscale allows you to change this behaviour with the Exit Node feature.

What is an Exit Node? It is a node in your tailnet that can act as a gateway for all internet traffic from other devices. If a client device is configured to use an Exit Node, all its internet traffic will be routed through that node, effectively using its public IP address and network environment.

Why might you need this?

• Security in public networks: When connecting to an untrusted Wi‑Fi network (cafe, airport, hotel), you can route all your internet traffic through your own Exit Node (e.g., a home server or VPS), where it will be encrypted by the Tailscale tunnel, protecting your data from possible interception by other local devices on the same public network.
• Bypass geographic restrictions: Some online services (streaming platforms, banking apps) provide different content based on the user’s location. By setting up an Exit Node on a VPS in the desired country, you can access such services from anywhere in the world.
• Fixed public IP for outbound traffic: If your scripts or integrations need to access external APIs from a whitelisted (known and permitted) IP address, you can use your VPS as an Exit Node for those tasks.

Step‑by‑step configuration of an Exit Node on a VPS

Assume we already have a VPS with Tailscale installed and connected to a tailnet (as described in the previous section). Let’s configure it as an Exit Node.

1. Enable IP forwarding on the VPS

For the server to be able to forward internet traffic from other devices, IP forwarding must be enabled in the Linux kernel. Edit the file /etc/sysctl.conf and uncomment or add the following line:

net.ipv4.ip_forward = 1

Apply the changes:

sudo sysctl -p

2. Configure firewall rules (optional)

On most modern Linux distributions, Tailscale automatically configures the necessary netfilter (iptables/nftables) rules. If you use custom firewalls or your distribution does not support automatic configuration, you may need to add rules manually. In general, enabling IP forwarding in step 1 is sufficient.

3. Advertise the node as an Exit Node

On your VPS, run:

sudo tailscale up --advertise-exit-node

This command notifies the coordination server that this node is ready to act as an Exit Node. After running the command, restart Tailscale to apply the new settings:

sudo systemctl restart tailscaled

4. Approve the Exit Node in the web console

For security, an administrator must explicitly approve the node as an Exit Node. Go to the Tailscale web console (login.tailscale.com/admin/machines). Find your VPS in the device list. Click the three dots («...») next to it and select Edit route settings. In the window that opens, enable the Use as exit node option and save the changes.

5. Use the Exit Node on a client device

On any device (laptop, phone) that you want to use with the VPS as the exit, open the Tailscale application. In the application interface, find the Exit Node section and select your VPS from the list of available nodes.

• Linux (CLI): sudo tailscale up --exit-node=<VPS-tailnet-IP>
• Windows / macOS: through the graphical Tailscale interface: right‑click the system tray icon, choose «Use exit node» and select the desired node.
• iOS/Android: In the Tailscale app settings, under Exit Node.

After selection, all internet traffic from the client device will be routed through your VPS.

To verify, open any IP‑address checking service (e.g., ifconfig.me) — it should display the public IP address of your VPS, not the client’s original network.

Limitations and Considerations for Using an Exit Node

• Availability: The Exit Node feature is available on all Tailscale pricing plans, including the free tier. The free plan allows up to 3 devices to be used as Exit Nodes.
• Performance: Because all client traffic now passes through the VPS, the client’s internet speed will be limited by the VPS’s bandwidth and the quality of the connection between the client and the VPS.
• VPS bandwidth allowance: When using a VPS as an Exit Node, keep in mind any data transfer caps that may apply to your hosting plan, especially if you actively stream video or download large amounts of data through the Exit Node.

Redundancy: Tailscale supports automatic selection of the optimal Exit Node among several using the Auto Exit Nodes feature, which takes into account latency and client location.

Windows Cloud Servers from $5 / moLicense includedTry

Advantages, Limitations, and Risks

Like any solution, Tailscale has its strengths and aspects to consider.

Advantages:

• Reduced attack surface: With no open ports on the server, it becomes invisible to automated scanners and bots on the public network, reducing the risk of unauthorised access.
• Simplified network configuration: Setting up a network of several devices takes minutes and does not require deep knowledge of network administration (static routing, VPN servers).
• Performance of direct connections: When a direct P2P connection (without DERP) is established, latency and packet loss are minimal, which is critical for real‑time applications.
• Flexible access control: Access to resources can be granted or restricted based on user accounts (via ACLs) rather than IP addresses.

Limitations and aspects that require attention:

• Dependence on the coordination server: Access to the Tailscale coordination server is required for initial connection setup and authentication of new devices. Existing direct connections between devices will continue to work even if the control plane becomes unreachable, but connecting new nodes or changing network configuration will be impossible.
• Key expiry: By default, Tailscale requires periodic re‑authentication of nodes. For servers that must be permanently accessible, it is recommended to disable key expiry in the web console (option «Disable key expiry»).
• Latency when using DERP: When a direct P2P connection cannot be established (e.g., due to strict corporate firewall rules), traffic goes through DERP relay servers, which may increase latency and slightly reduce throughput compared to a direct connection.
• Ecosystem: To use all Tailscale features (MagicDNS, Tailscale SSH, Exit Node), you need to install the client application on each device. Accessing a device without the Tailscale agent installed is possible but requires additional configuration (e.g., via a Subnet Router).

Use Cases for Tailscale on a VPS

Tailscale offers several practical scenarios for individuals and small teams.

• Access to control panels and server administration: You run a web‑based control panel (e.g., Portainer for Docker, phpMyAdmin for databases) on your VPS, or you simply want to connect via SSH. Using Tailscale allows you not to expose those services’ ports to the public network. Access is only available to devices connected to your tailnet.
• Securing development and staging environments: A staging server running an application does not need to be publicly accessible. Team members can connect to it for testing through your tailnet without using separate VPN solutions.
• Secure database access: Developers can connect to databases deployed on a VPS (e.g., PostgreSQL, MySQL) from their local machines using Tailscale. This eliminates the need to open database ports (typically 5432, 3306) to the outside.
• Private gaming network: When hosting a game server (e.g., Minecraft) on a VPS, you can make it accessible only to members of your tailnet without opening the game’s port to the internet. Friends connect via Tailscale and see the server using its internal IP address.
• Secure CI/CD runner: In CI/CD pipelines (e.g., GitHub Actions, GitLab CI), you can deploy a runner that connects to your VPS via Tailscale to execute deployment commands. This is more secure than storing SSH keys for external network access.

Typical Errors and How to Fix Them

During Tailscale setup and use, some typical problems may arise. Below are ways to diagnose and solve them.

Error 1: Devices cannot see each other.
Cause: Usually the problem is that UDP traffic (port 41641 used by WireGuard) is blocked by client firewalls or the ISP network.
Solution: Check that Tailscale is running on both devices. Run tailscale status to confirm the devices are visible in the network. If a direct connection cannot be established, Tailscale will automatically fall back to DERP. You can force‑check DERP usage with tailscale ping --verbose <device-IP>.

Error 2: Low connection speed.
Cause: Traffic may be going through a DERP relay because a direct connection could not be established, increasing latency. Or one of the devices has limited bandwidth.
Solution: Check the connection type with tailscale ping. If the output shows DERP, try to optimise network settings (e.g., check firewall rules, allow UDP). For latency‑sensitive applications, consider placing the VPS in a data centre geographically close to most clients.

Error 3: The key on the server expired, and the server disconnected from the tailnet.
Cause: The node’s authentication key has a limited validity period (180 days by default).
Solution: In the Tailscale web console, in the settings for the corresponding node (Machine Settings), enable the «Disable key expiry» option. For existing nodes this can be done at any time. After that the key will not require periodic renewal.

Error 4: MagicDNS does not work; devices cannot be resolved by name.
Cause: The system DNS resolver on the device may conflict with DNS settings provided by Tailscale.
Solution: Ensure that the «Use Tailscale DNS settings» option is enabled in the Tailscale client. On some OSes you may need to restart the network stack or restart the Tailscale client. For diagnostics use tailscale status — it shows both IP addresses and device names (if MagicDNS is active).

Tailscale as a Tool for Secure Access

Tailscale offers a method to access services on remote servers, including VPS, without needing to open ports on the public network. Key features of the solution:

• Reduced attack surface by eliminating open network ports.
• Direct encrypted connections between devices (P2P) with automatic NAT traversal and fallback DERP relaying.
• Simple configuration and access management based on user accounts.
• Additional features: Exit Node (route all internet traffic through a chosen node), MagicDNS, Tailscale SSH.

For readers who want hands‑on experience:

• Register a Tailscale account and install the client on a VPS and a local device, following the step‑by‑step instructions in the «Installing Tailscale on a VPS» section.
• After verifying basic access to a service (e.g., via a Python HTTP server), explore the Exit Node capabilities to unlock additional use cases for your VPS — from secure internet egress on public networks to a fixed IP for calling external APIs.
• For further reading, refer to the official Tailscale documentation, which details access control (ACL) features, custom DERP server setup, and integrations.

Frequently Asked Questions (FAQ)