Is Tailscale free? Free tier limits explained
Tailscale's Personal plan is free for noncommercial use, with six users and unlimited user devices. See tagged resource limits and when Headscale wins.
#tailscale
Filtering by topic #tailscale · clear
Self-host the NetBird VPN server on a VPS
Run the NetBird mesh VPN on one VPS: DNS and TLS setup, the pinned quickstart script, setup keys for unattended peers, and how it compares to Headscale.
Headscale: self-host your own Tailscale
Run your own Tailscale control server on a VPS. Install headscale from the official .deb, set server_url and restart it, then join your first node.
Run a Tailscale subnet router on a VPS
Advertise a private network to your tailnet from a VPS: route approval, IP forwarding that survives a reboot, and the --accept-routes flag Linux needs.
WireGuard vs Tailscale vs Headscale
Tailscale is WireGuard plus a control plane. What that coordination server buys you, what it costs you, and which of the three belongs on your VPS.
Tailscale: what it is and how its mesh VPN works
Tailscale is a WireGuard mesh VPN: a coordination server hands out keys and ACLs, NAT traversal links devices directly, and DERP relays step in when it fails.
Tailscale alternatives compared: 6 real options
NetBird, ZeroTier, Nebula, Netmaker, Headscale and Twingate, sorted by whether you can really self-host the control plane, and what breaks when you do.
Fix Tailscale install errors on Ubuntu
Most Tailscale install errors on Ubuntu are apt errors. Read the status code apt printed, then fix the release codename or the signing keyring.
Tailscale pricing and plans: what you really pay
Tailscale bills per user, not per device: free up to 6 home users, then $8 or $18 per user a month. See what a five person team pays and when Headscale wins.
Reach the DSH web UI on your VPS
The DSH web UI binds to 127.0.0.1:3080, so the URL your VPS prints will not open on your laptop. Three safe ways to reach it, and one you should avoid.
Reach your Hermes agent from your phone
Your Hermes agent runs on a VPS. Reach it from a phone over a private mesh or a public HTTPS endpoint, and revoke access when the phone goes missing.
Tailscale ports: what to open on your firewall
Tailscale needs no inbound port in most setups. See the outbound ports it uses, why 41641 is not 51820, and the ufw and firewalld rules that help on a VPS.
Tailscale instead of port forwarding
Reach a home NAS, Pi or Minecraft server without opening a router port. How Tailscale gets through NAT, when it falls back to a relay, and what it cannot do.
How to connect two Tailscale tailnets
Reach across two tailnets with node sharing, user switching, a two-daemon VPS bridge or one tailnet with ACLs. See what each option exposes to the other side.
AdGuard DNS vs AdGuard Home: which do you need
AdGuard DNS is a resolver AdGuard runs for you. AdGuard Home is one you run yourself. See which fits a phone or a household, and how to run it safely on a VPS.
Gluetun: reach the host and other containers
A container behind Gluetun has no interfaces of its own. Publish its ports on Gluetun, and open only the subnets it must reach outside the tunnel.
Is Tailscale safe & secure? What if it's hacked
Tailscale never holds the keys that encrypt your traffic. Its safety hinges on what a compromised coordination server or stolen identity account can do.
Use your VPS as a Tailscale exit node
Turn your VPS into a Tailscale exit node: install, advertise, enable IP forwarding, approve the route in the admin console, then fix DNS and IPv6.
What Can You Do With Tailscale? 8 Real Uses
Eight jobs people run over a tailnet: reach home, borrow a VPS exit IP, share or publish one service, and SSH with no open ports. One command each.
Is Tailscale a Canadian company?
Yes, Tailscale Inc. is a Canadian corporation registered in Toronto. But new accounts contract with a US entity, and its control plane runs on AWS.
Tailscale Funnel: ports, limits, bandwidth
Tailscale Funnel accepts only ports 443, 8443 and 10000. Here are the prerequisites, the bandwidth reality, and how to check yours is serving.
Why Tailscale is slow: relay vs direct
Tailscale over a DERP relay is slow, direct is close to line rate. Two commands tell you which you have, plus the blocked UDP and hard NAT fixes for a VPS.
Is Tailscale a VPN? What it hides and doesn't
Tailscale is a WireGuard VPN between your own devices. Websites see your real IP until you add an exit node, and your ISP always does. What each setup hides.
Run Tailscale commands without sudo
Set the Tailscale operator user once, then run serve and funnel from a deploy account without sudo. What the setting changes, and what still needs root.
Tailscale serve vs funnel: which to use
Tailscale serve puts HTTPS on a tailnet-only URL. Funnel opens that same port to the public internet. Which to use, and the policy gate that blocks funnel.
Run Tailscale in a Docker Compose Stack
The vendor Compose example leaves your app on a public host port. Use a Tailscale sidecar so the container has no published port, only a tailnet name.
Connect two VPS on a private network
Two VPS, one private network: a provider VPC, a WireGuard tunnel you own, or a managed mesh. Subnet choice, service binding, firewall rules and MTU included.
NetBird vs Tailscale: which mesh VPN to run
Both run WireGuard, so the choice is elsewhere: who runs the control plane, how you write access rules, how relays work, and what self-hosting NetBird takes.
Tailscale student and education discounts
Tailscale has no student checkout. Read on 2026-08-31: schools and nonprofits get 50% off list prices via Support, and Personal stays free for you.
tailscale serve: the commands that matter
Every tailscale serve command you will use, checked on Tailscale 1.102.4: foreground versus background, HTTPS ports, path routing, static files and raw TCP.
What Tailscale's tailnet lock actually protects
Tailnet lock stops a compromised Tailscale coordination server from adding a node to your tailnet. It also gives you ten secrets you must not lose.