Build a private Linux network with Tailscale

A private overlay network is often a better first step than opening ports on your router. Tailscale builds an encrypted network—called a tailnet—between your devices and normally lets peers connect directly.

Install and enroll the first Linux machine

Follow the official Linux installation instructions for your distribution. Tailscale publishes repositories for mainstream distributions and documents separate paths for Arch Linux and NixOS.

After installation:

sudo tailscale up
tailscale status
tailscale ip

The first command prints an authentication URL. After you approve the machine, tailscale status shows peers and connection state. tailscale ip prints its stable tailnet addresses.

Install Tailscale on a second device and enroll it in the same tailnet. Test connectivity using its machine name:

ping server-name
ssh user@server-name

Machine names are easier to remember than addresses when MagicDNS is enabled.

Do not disable your existing access yet

Keep your current SSH session open while testing. Confirm that a second terminal can connect over the tailnet before changing firewall rules or router forwarding.

Once private access works, remove any unnecessary public port-forwarding rule. On the server, make sure the local firewall still allows the traffic you intend. A private network does not replace host updates, SSH key authentication, or least-privilege access.

Choose between regular SSH and Tailscale SSH

You can run normal OpenSSH over the tailnet, which keeps your existing SSH configuration. Tailscale SSH is another option that moves authentication and authorization into tailnet policy.

To enable Tailscale SSH on a supported machine:

sudo tailscale set --ssh

Then define who may connect in the tailnet access policy. Do not assume network membership should automatically grant administrative shell access.

Reach a whole home subnet

A subnet router advertises routes to devices that cannot run Tailscale, such as printers or older appliances. On a trusted Linux machine, enable IP forwarding according to the current Tailscale documentation, then advertise only the subnet you need:

sudo tailscale set --advertise-routes=192.168.10.0/24

Approve the route in the admin console. Avoid advertising overlapping networks unless you have a deliberate routing plan.

Use an exit node deliberately

An exit node routes a device’s general internet traffic through another tailnet machine. This is useful on untrusted Wi-Fi or when you need your home egress address, but it changes latency and trust boundaries.

On the machine acting as the exit node:

sudo tailscale set --advertise-exit-node

Approve it in the admin console, then select it from the client that should use it. Confirm your DNS behavior and public IP after connecting.

A sensible security checklist

1. Give devices descriptive names and remove devices you no longer own.
2. Use groups and tags in access rules instead of individual exceptions everywhere.
3. Allow only the ports and identities each role needs.
4. Keep key expiry enabled for portable devices.
5. Disable key expiry only for trusted unattended servers, understanding the trade-off.
6. Test policy changes with a non-administrator account.

Verify the result

Your server should be reachable by tailnet name, unnecessary router forwards should be gone, and access rules should describe intent clearly. Document which device is a subnet router or exit node so future-you does not have to rediscover the topology.