Tailscale

Tailscale is a VPN service built on the WireGuard protocol. It creates a private mesh network, called a tailnet, across every device that has the Tailscale client installed. Devices on the tailnet can communicate with each other as if they were on the same local network, regardless of where they are physically located.

The problem it solves

Accessing home lab services remotely without Tailscale means either opening ports on a home router, which exposes those services to the public internet, or configuring a traditional VPN server, which requires a static IP and significant setup. Tailscale avoids both. Devices connect directly to each other using WireGuard tunnels brokered by Tailscale's coordination servers, with no inbound ports required on the home network.

How it works

Each device on the tailnet gets a stable private IP address and an optional machine name. Traffic between devices is encrypted end to end using WireGuard. Where devices can communicate directly, Tailscale establishes a peer to peer connection. Where NAT or firewalls prevent direct communication, traffic is relayed through Tailscale's DERP servers.

Access control lists allow fine-grained rules about which devices can reach which services, supporting the least privilege principle across a home lab.

Deployment

The Tailscale client is available for Linux, macOS, Windows, iOS, and Android. On a Raspberry Pi, the client installs as a system service. At the time of writing, Tailscale offers a free tier covering personal use. The client code is open source and available at github.com/tailscale/tailscale. The coordination server is operated by Tailscale Inc. An open source self-hosted alternative to the coordination server, Headscale, is maintained separately by the community.