Is Tailscale a VPN? What it hides and doesn't
Tailscale is a WireGuard VPN between your own devices. It does not hide your IP from websites or your ISP until you add an exit node. What each setup hides.
#vpn
Filtering by topic #vpn · clear
Run Tailscale in a Docker Compose Stack
The vendor Compose example leaves your app on a public host port. Use a Tailscale sidecar so the container has no published port, only a tailnet name.
What Tailscale's tailnet lock actually protects
Tailnet lock stops a compromised Tailscale coordination server from adding a node to your tailnet. It also gives you ten secrets you must not lose.
What to run when your VPN gets blocked
Your VPN is blocked because its handshake is recognisable. What Outline, obfs4 and WebTunnel change about the bytes, and what they cannot hide.
Self-host an Outline VPN server on a VPS
Run the Outline VPN server, not the wiki app, on your own VPS. Install, access keys, the management API port, and what Shadowsocks does not hide.
Tailscale pricing after the free plan
Tailscale bills per user, not per device. Work out what a household and a five person team really pay, which limit you hit first, and when Headscale wins.
Gluetun kill switch: when the VPN drops
Gluetun installs a real firewall kill switch inside its own network namespace. What your containers see when the tunnel dies, and how to prove it holds.
WireGuard slow speeds: find the real cause
Slow WireGuard is usually an MTU problem. Find your path MTU by bisection, clamp TCP MSS, check steal time, and measure the path before blaming the tunnel.
WireGuard: route to your home LAN
Your WireGuard handshake works but no host on the home LAN answers. Four settings decide whether a packet reaches 192.168.20.10 and finds its way back.
How WireGuard works: cryptokey routing
AllowedIPs is the routing table and the access list at once. Learn cryptokey routing, the Noise handshake and rotation, and every wg0.conf reads clearly.
Is Tailscale secure? The trust model
Tailscale never holds the keys that encrypt your traffic. The real question is what a compromised coordination server or a stolen identity account can do.
Is Tailscale free? What the plans cover
Tailscale is free for up to six users with unlimited user devices. Here is what a seat, a device and a tagged resource cost, and when Headscale wins.
What is Tailscale and how does it work?
Tailscale explained: WireGuard tunnels between your servers, a coordination server for keys and ACLs, NAT traversal, DERP relays, and the threat model.
Tailscale serve vs funnel: which to use
Tailscale serve puts HTTPS on a tailnet-only URL. Funnel opens that same port to the public internet. Which to use, and the policy gate that blocks funnel.
Gluetun Port Forwarding for Torrent Apps
Downloads work but nothing ever connects in. Set up gluetun port forwarding, push the new port to your torrent client on every reconnect, and verify it.
Tor vs a VPN: which do you need?
Tor and a VPN answer different questions. See exactly who learns what at every hop, and why a VPS rented in your name is not an anonymity tool.
Use your VPS as a Tailscale exit node
Turn your VPS into a Tailscale exit node: install, advertise, enable IP forwarding, approve the route in the admin console, then fix DNS and IPv6.
Gluetun: reach the host and other containers
A container behind Gluetun has no interfaces of its own. Publish its ports on Gluetun, and open only the subnets it must reach outside the tunnel.
Route Docker containers through a VPN
Put a container behind a Gluetun sidecar and its ports vanish. Here is why the shared network namespace does that, and the compose file that works.
Headscale: self-host your own Tailscale
Run your own Tailscale control server on a VPS. Install headscale from the official .deb, set server_url before you start it, then join your first node.
VPS vs VPN: what is the difference?
A VPS is a computer you rent. A VPN is an encrypted tunnel for your traffic. What each one does, what each costs, and how one can host the other.
wg-easy: WireGuard with a web UI in Docker
Run WireGuard behind the wg-easy web UI with Docker Compose: the ports, NET_ADMIN, the sysctls that matter, and QR code onboarding for phones.
Fix DNS over WireGuard: three failure modes
Your WireGuard tunnel is up but names do not resolve, or the queries leak to the local router. Find which of the three DNS failures you have, and fix it.
WireGuard vs Tailscale vs Headscale
Tailscale is WireGuard plus a control plane. What that coordination server buys you, what it costs you, and which of the three belongs on your VPS.
WireGuard vs OpenVPN: which to self-host
WireGuard wins for almost every self hoster on speed, config size and audit surface. Here is the evidence, and the four cases where OpenVPN still wins.
Self-host a WireGuard VPN on your VPS
Set up WireGuard on your own Linux VPS: key generation, wg0.conf, IP forwarding, NAT, AllowedIPs semantics, DNS, and the handshake failures that bite.