Tailscale links your devices into a private network over WireGuard. You can reach home apps from anywhere without opening ports on your router.
What it is
Tailscale is a mesh VPN. You install the Tailscale app on your phone, laptop, and home server, then sign in with the same account. Those devices can then reach each other as if on the same local network, wherever they sit. A phone on mobile data can open a photo app on your home server by name. Nobody else on the internet sees that app.
Tailscale calls this private network a tailnet. Every device receives a private address from the 100.64.0.0/10 range and keeps it across network changes.
Choose your front door compares Tailscale with tunnels and reverse proxies. This guide covers how Tailscale works and what it costs.
How it works
WireGuard tunnels between your devices
Tailscale runs on WireGuard, an open-source VPN protocol. Each device creates a key pair. The private key never leaves the device. When two devices communicate, they form an encrypted WireGuard tunnel straight to each other. Your phone talks directly to your server rather than through a central hub. That direct link is the mesh design.
A coordination server that hands out keys
Your phone needs the public key and address of your server. Tailscale's coordination server handles this task. When a device signs in, it uploads its public key. The coordination server assigns addresses, shares public keys between devices, and pushes access rules.
The coordination server only exchanges keys and policies and carries virtually no traffic. It lists your devices, but it cannot read their traffic because it lacks the tunnel keys.
You sign in with an account from a provider like Google, Microsoft, GitHub or Apple. Tailscale stores no passwords. Whoever controls that identity account controls your tailnet, so turn on two-step verification. Use a personal address from a public provider: signing up with your own domain starts a 14-day Enterprise trial, though you can switch to the free plan.
A device key expires after 180 days by default. The device then drops off your tailnet until you sign in again. For a remote home server, disable key expiry or tag the device, which disables expiry by default.
Getting through your router
Your server sits behind a home router, and your phone sits behind a mobile network. Neither accepts incoming traffic. Tailscale resolves this through NAT traversal: both devices transmit packets at the same moment. Each router treats the incoming stream as a reply and lets it pass. Tailscale uses techniques based on the STUN and ICE standards. How NAT traversal works on the Tailscale blog details the process.
Because of this design, you do not forward ports on your router.
Direct and relayed connections
NAT traversal sometimes fails. Certain networks block required packets, such as restrictive public Wi-Fi or mobile carriers that share one IP address across many users. If a direct link fails, Tailscale routes your traffic through a DERP relay server. A DERP server forwards traffic that is already encrypted and cannot inspect it.
Relays reduce speed. Tailscale documents state that DERP connections are generally slower than direct connections and may offer lower maximum throughput. Packets take a detour through a relay that may sit in another city or country. A password manager will feel fine; a video stream might stutter. Advanced users can host a peer relay to lower latency compared to DERP. This requires an open UDP port reachable by your devices, so it is not an entry-level task.
MagicDNS
MagicDNS gives every device a name. You can type homeserver instead of an IP address starting with 100.. Each device also receives a full name ending in .ts.net. MagicDNS is active by default on tailnets created since October 2022.
Subnet routers
Some devices cannot install Tailscale, like printers, older NAS hardware, or smart plugs. A subnet router forwards traffic from your tailnet to devices on your local network. Turn one home computer into a subnet router, and your phone can reach your printer through it. Tailscale notes that a client on each device is more secure. Devices behind a subnet router lack internal Tailscale controls, so use strong passwords on them and use access rules to limit who reaches them.
Exit nodes
An exit node routes all your internet traffic through one device on your tailnet. Route your phone through your home server while on hotel Wi-Fi, and your phone browses as if you were home. That helps on networks you do not trust. It remains entirely optional.
What it costs
Tailscale's free Personal plan lists, as of October 2026:
- up to 6 users
- unlimited user devices
- up to 3 ACL groups (groups of users for access rules)
- up to 50 tagged resources, such as servers that do not belong to one person
The plan applies to non-commercial use. It covers most households. Limits and terms can change, so check the pricing page before building around them.
Tailscale or plain WireGuard?
Tailscale runs WireGuard, providing identical encryption. The surrounding setup marks the real difference.
With plain WireGuard, you create each key pair yourself and copy public keys between devices manually. Usually, one home server accepts incoming traffic through an open router UDP port. This setup requires a public IP address at home. Tools like wg-easy offer a web console to manage devices and show QR codes for phone pairing, cutting down on manual copies.
With Tailscale, the coordination server automates key distribution, NAT traversal eliminates port forwards, and every device can reach every other device, not only the home server. By default policy, every device can talk to every other device until you restrict them with access rules.
Choose plain WireGuard if you want no outside service involved and have a public IP. Choose Tailscale if you prefer simpler setup or lack a public IP from your provider.
Headscale: run the coordination server yourself
Tailscale clients are mostly open source, but the coordination server is proprietary. Headscale provides an open-source, self-hosted implementation of the Tailscale coordination server. You host it yourself and connect official Tailscale apps to it. It remains an independent project outside Tailscale.
Requirements: a server with a public IP address and HTTPS on port 443. In practice, this means renting a small VPS and registering a domain.
Limitations:
- It runs a single tailnet. This fits one household.
- It provides no built-in web interface. You manage settings through the terminal or third-party web tools.
- The stable release does not support Funnel, Serve or network flow logs, and rules cannot use OIDC groups.
- Default settings route fallback traffic through Tailscale's public DERP relays. To disconnect from them, enable the embedded DERP relay and set
derp.urls: []. If your solo relay drops, direct-link failures will break device connections entirely. It requires open UDP port 3478. - You must apply updates, handle backups, and monitor uptime yourself.
Tip: if a remote app feels slow
If an app at home responds slowly, check if your connection runs direct or relayed. From your current device, run:
tailscale ping homeserver
Initial responses often show via DERP(fra) (or another location code) while finding a path. Direct routes will switch to show via followed by an IP address and port. If replies continuously list DERP and conclude with direct connection not established, the path is relayed. Review the connection types page for output examples.
Next, check status:
tailscale status
Find your server. Direct paths list direct alongside an IP and port. Relayed paths show relay and a short DERP region code like fra or nyc. If connections consistently fall back to relays, test another network: switch between Wi-Fi and mobile data to identify which side causes the block. Use tailscale netcheck to diagnose what your local network permits.
Checked October 2026.