How to Set Up Tailscale on a Linux Server (VPN with No Port Forwarding)
WireGuard (tutorial 33) is excellent, but it needs a port forwarded on your router and a public IP that's actually yours. If your ISP uses carrier-grade NAT, or you simply don't want to touch the router, Tailscale gets you the same result in five minutes. It's WireGuard underneath, with a coordination service that handles the connections. Every device gets a stable private address and a name, wherever it is.
Quick reference
| Task | Command | |
|---|---|---|
| Install | `curl -fsSL https://tailscale.com/install.sh | sh` |
| Connect | sudo tailscale up | |
| See devices | tailscale status | |
| Server's Tailscale address | tailscale ip -4 | |
| Share your home network | sudo tailscale up --advertise-routes=192.168.1.0/24 | |
| Use the server as an exit node | sudo tailscale up --advertise-exit-node |
1. Install on the server
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
It prints a link. Open it on any device, sign in (Google, Microsoft, GitHub or an email) and the server joins your network. Free for personal use up to 100 devices.
tailscale status
shows the server's address, something like 100.101.102.103.
2. Install on your phone and laptop
Install Tailscale from the app store, sign in with the same account. That's it — ssh john@100.101.102.103 works from the café, with nothing opened on the router.
3. Use names, not numbers
In the admin console (login.tailscale.com) → DNS, enable MagicDNS. Now the server is simply homeserver on every device: ssh john@homeserver, http://homeserver:8096. With HTTPS certificates enabled there too, tailscale cert gets a real certificate for homeserver.tailnet-name.ts.net.
4. Reach everything else at home
Tailscale on the server only reaches the server. To reach the printer, the NAS and the router from outside, make the server a subnet router:
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale up --advertise-routes=192.168.1.0/24
Then approve the route in the admin console (Machines → server → Edit route settings). Your phone can now open 192.168.1.1 from anywhere.
5. Send all traffic through home
On dodgy Wi-Fi, route everything through your server:
sudo tailscale up --advertise-exit-node --advertise-routes=192.168.1.0/24
Approve it in the console, then on the phone choose the server under Exit node.
Sharing with someone outside
Machines → server → Share sends a link; the other person adds the device to their own Tailscale and can reach it (only that device) — handy for a family member's backup to your server, or a friend's Jellyfin access.
Tailscale and WireGuard together
They don't conflict. Keep wg-easy for devices you'd rather not sign in with an account, and Tailscale for everything else.
Troubleshooting
"Tailscale is stopped" after a reboot. sudo systemctl enable --now tailscaled, then sudo tailscale up once more (flags are remembered).
Subnet route doesn't work. Not approved in the admin console, or ip_forward isn't set. tailscale status shows the route as "not approved" if that's the case.
Connection is slow / shows "relay". Direct connection isn't possible on that network, so traffic goes via a relay. Usually temporary; tailscale netcheck explains.
Logged out after a few months. Keys expire by default. In the console, Machines → server → Disable key expiry for a server.
Wrapping up
One install script, one sign-in, and the server is reachable from anywhere with nothing forwarded. Turn on MagicDNS, advertise your home subnet, disable key expiry on the server. For most people this replaces the WireGuard setup entirely.
