Is Tailscale a VPN? What it hides and doesn't

Is Tailscale a VPN? The short answer

Is Tailscale a VPN? Technically yes. Tailscale builds WireGuard tunnels between devices you own, and every packet that crosses one of those tunnels is encrypted end to end. In the sense most people mean when they type the question, no. Out of the box, Tailscale does not hide your public IP address from websites, and it does not route your browsing through anyone else's server. The hotel wifi still sees which sites you visit. Tailscale only carries traffic between your own machines. To get the behaviour of a commercial privacy VPN you add an exit node, and that changes what is hidden and from whom.

The rest of this guide separates the two meanings of "VPN" and then states, for each configuration, who can see what. If your real question is "will this hide me", the answer depends on who you are hiding from, so each configuration below names the parties it protects you from and the parties it does not.

The two meanings of "VPN"

The term has two meanings, and the answer to the title depends on which one you hold.

The original meaning is a virtual private network: a private network built on top of a public one. A company office and a remote worker's laptop behave as if they share one cable, even though the packets cross the internet. The point is reachability and encryption between members. Nobody in this model is trying to hide from the websites they visit.

The consumer meaning is a privacy product. You install an app and pick a country. All of your internet traffic then leaves from the provider's server. Websites see the provider's address, and your ISP (internet service provider) sees only an encrypted stream to that one server. The point is to hide your IP and your destinations from the parties on your local path.

Tailscale is the first kind. It is a mesh VPN: every device in your tailnet (the private network Tailscale builds for you) gets a stable private address in the 100.64.0.0/10 range, and it talks to every other device over a direct WireGuard tunnel. What Tailscale is, and how the coordination server and relays fit together covers that architecture, so this guide does not repeat it. One fact from it matters here: by default, traffic to the public internet never enters the tunnel. Only traffic addressed to another device in your tailnet does.

What Tailscale hides, and from whom

The honest answer is a list of parties rather than a single yes or no. Each entry below states the default behaviour first, then what an exit node changes.

Traffic between your own devices

Hidden from everyone on the path. When your laptop reaches your VPS over its tailnet address, the packets are WireGuard-encrypted from one device to the other. The hotel wifi and your ISP see a UDP stream between two addresses and nothing else. Tailscale's own servers do not hold the keys that encrypt this traffic. Each private key is generated on the device and never leaves it, which is why a security review of Tailscale treats the coordination server as a directory rather than a middleman. This protection is on from the moment you install Tailscale. There is nothing else to configure.

Your public IP, as seen by websites

Not hidden by default. Open a browser and visit any site. The request leaves your laptop through its normal network interface, so the site sees the public IP of whatever network you are on. Tailscale is not in that path at all, because the destination is not a tailnet address. With an exit node enabled, the site sees the exit node's public IP instead.

Your destinations, as seen by your ISP or the local wifi

Not hidden by default. Your ISP, or the operator of the café network, sees the IP address of every site you connect to, and usually the hostname as well, because the TLS (transport layer security) handshake sends it in the clear. Tailscale does nothing to this traffic because the traffic never enters the tunnel. With an exit node, the local network sees one encrypted UDP stream to the exit node and nothing more. The ability to see your destinations moves from the local network to whoever hosts the exit node.

Geo-unblocking

No by default, and only partly with an exit node. Streaming services check the country of your public IP. An exit node on a VPS gives you the VPS's country, which helps, but it also gives you a datacenter IP. Streaming services buy lists of datacenter address ranges and often block them outright, since almost nobody watches television from inside a datacenter. An exit node in your own home, on a residential connection, is the setup that usually passes those checks, and it also fits the reachability model Tailscale was built for.

What Tailscale itself can see

Metadata, and never the traffic. The coordination server knows which devices are in your tailnet, their public keys, their current endpoints, and when they were last online. It does not see the contents of the tunnel, and it does not see which websites you visit. When two devices cannot connect directly, an encrypted relay carries the bytes, but the relay cannot decrypt them. That is the part of the design that makes the free plan possible, which comes up again below.

How the exit node path works

An exit node is a device in your tailnet that agrees to forward traffic to the public internet on behalf of the others. When you select it on your laptop, Tailscale installs a default route through the tunnel, so every packet not addressed to your local LAN (local area network) goes to the exit node first, and the exit node sends it out to the internet from its own address. At that point Tailscale behaves like a commercial VPN, with one difference: the server on the other end is yours.

Setting one up on a Linux VPS takes two steps. On the VPS, turn on IP forwarding, then advertise the node. On a device that is already logged in, tailscale set applies at once:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-exit-node

Then approve the exit node in the Tailscale admin console, because an advertised route is not used until an admin accepts it. On the laptop, list the exit nodes your tailnet offers and select one. Then check which node is active:

tailscale exit-node list
sudo tailscale set --exit-node=my-vps
tailscale status

To confirm the route is in place, visit an IP-checking site in your browser and compare the address it reports with the VPS's public IP. To stop using the exit node, pass an empty value: sudo tailscale set --exit-node=. If you still need to reach a printer or a NAS on the local network while the exit node is active, add --exit-node-allow-lan-access=true, because the default route otherwise sends those packets to the exit node as well.

That is the whole mechanism. The guide to running a Tailscale exit node on a VPS covers the firewall, the provider's bandwidth quota, DNS behaviour, and the reasons throughput can drop, so start there when you build one for real.

Why Tailscale is free, and what that tells you

Tailscale's personal plan is free, and the limits are real rather than a trial: the free plan covers a handful of users and far more devices than a household needs. The reason it can be free is the same reason it is not a privacy service. A commercial privacy VPN pays for the servers that carry all of your traffic, so every user costs the provider bandwidth every day. Tailscale carries almost none of your traffic. Direct connections go device to device, and the relays only carry encrypted packets when a direct path fails. Tailscale's cost per personal user is close to zero, and its revenue comes from teams paying for access control and audit features.

That has a consequence for you. There is no crowd of other users sharing an exit address with you, and no company promising not to log your browsing, because Tailscale never sees your browsing. If you want exit traffic to leave from somewhere other than your own machines, Tailscale sells access to Mullvad's servers as a paid add-on (as of September 2026), which turns the product into a hybrid: Tailscale for the mesh and Mullvad for the exit. That is the only configuration in which Tailscale resembles a consumer VPN without you running the exit yourself.

Threat models: what each setup protects against

A threat model is a plain statement of who you are hiding from and what they can see. Each configuration below protects against some parties and not others. Pick the one that matches your actual concern rather than the one that sounds most private.

Plain tailnet, no exit node

Protects against: anyone on the network path between your devices reading or altering the traffic between those devices. On hotel wifi, SSH to your VPS over its tailnet address is safe from the person at the next table even if the wifi is open, and you can close port 22 on the VPS's public firewall entirely.

Does not protect against: anything to do with your normal browsing. Websites see your real IP, and the hotel and your ISP both see your destinations. This configuration makes no privacy claim about the public internet, and you should not treat it as one.

Exit node on your own VPS

Protects against: the local network and your ISP learning your destinations. They see one WireGuard stream to a single VPS address. Websites see the VPS's IP rather than the hotel's.

Does not protect against: the VPS provider. Traffic leaves the exit node in whatever form it entered, so the provider can see every destination address and hostname, and can read anything sent without TLS. The VPS is also linked to you by a payment record, so it offers no anonymity: an exit IP used by one person identifies that person. A datacenter address is easy to classify, so streaming services and some banks treat it with suspicion. Throughput is capped by the VPS's bandwidth allowance and by whether the tunnel goes direct or through a relay, which is what the difference between a direct and a relayed Tailscale connection explains.

Exit node at home

Protects against: the same local-network and ISP exposure as the VPS case, with a residential IP that passes the checks datacenter ranges fail. Useful when you travel and want your traffic to leave from home.

Does not protect against: your home ISP, which now sees all of your travelling traffic as well. Upload speed at home is usually the bottleneck, since every byte you download abroad is first uploaded by your home connection.

Exit through Mullvad, or a commercial VPN

Protects against: the same local-network and ISP exposure as the VPS case, plus the link between the exit IP and your name, since thousands of other customers share the same exit address. This is the threat model a commercial privacy VPN is built for.

Does not protect against: the VPN provider, who is in the same position your VPS provider was. You are trusting their logging policy instead of your own server. It also does not protect against the website itself, which can still identify you through cookies and your login.

When none of these is enough

If the party you are hiding from is the website itself, or a party that can compel the exit operator to hand over records, no VPN configuration helps. That is the threat model Tor is built for, where no single relay knows both who you are and where you are going. The comparison of Tor and a VPN sets out that boundary, and it is the right next read if "hide my IP" was really "stay anonymous".

When is Tailscale the right tool?

Use Tailscale when the problem is reaching your own machines: a NAS behind a home router, a VPS you would rather not expose to the internet, a Raspberry Pi at a relative's house, or a dev box you SSH into from anywhere. For that job it beats a classic VPN server, because there is no port to open and no central server to run, and the trade-offs against plain WireGuard mostly come down to whether you want to manage keys by hand. Add an exit node on a VPS when you also want a fixed exit IP or need to get through a hostile local network. Buy a commercial privacy VPN, or use Tor, when your concern is being identified, because Tailscale was not built to solve that problem.

FAQ

Does Tailscale hide my IP address?

Not by default. Tailscale only carries traffic between devices in your own tailnet. A website you visit in a browser sees the public IP of the network you are on, exactly as it would without Tailscale. To change that, enable an exit node. Websites then see the exit node's public IP, which is the address of your VPS or your home connection, depending on where the exit node runs.

Can I use Tailscale instead of a VPN on hotel wifi?

For reaching your own machines, yes. The tunnel between your laptop and your VPS or home server is encrypted end to end, so the hotel network cannot read it. For general browsing, only if you enable an exit node. Without one, the hotel network sees every site you visit, the same as if Tailscale were not installed.

Does Tailscale work for watching Netflix from another country?

Usually not with an exit node on a VPS. The exit node does give you the VPS's country, but the address belongs to a datacenter range, and streaming services block those ranges on purpose. An exit node on a home connection in the target country has a residential IP and generally works. Tailscale itself has no country picker and runs no exit servers of its own for this purpose.

Does Tailscale see my traffic?

No. The keys that encrypt your traffic are generated on each device and never leave it. Tailscale's coordination server distributes public keys and endpoints, and its relays forward encrypted packets when a direct connection fails, but neither can decrypt what passes through. What Tailscale does hold is metadata: which devices are in your tailnet and when they were online.

Is Tailscale a replacement for NordVPN or Mullvad?

No. A commercial privacy VPN routes all of your traffic through servers shared with thousands of other customers, so your exit IP is not tied to you. Tailscale routes traffic between your own devices, and even with an exit node the exit is a machine you pay for and that is linked to you. The two products solve different problems. Tailscale does sell Mullvad exit nodes as an add-on for people who want both from one client.