Tailscale takes the computers you own and stitches them into a small private network of their very own – your laptop, your phone, the machine humming away at home – so that each one can reach the others directly, wherever in the world it happens to be sitting. Not “over the internet” the way you reach a website. They behave as though someone had quietly run a cable between them, or plugged them all into the same home router. The little network follows them around.
You install it once on each device, sign in with an account you already have, and from then on those machines can find each other from a café, a hotel, another country – as though they had never left the same room.
The part that makes this remarkable rather than merely handy is what you don’t have to do. You don’t have to make your home reachable by strangers. You don’t have to rent, set up, or look after a server. You install a thing, and the distance stops mattering.
You already know how this feels
Think about being at home. Your phone throws a video onto the television. Your laptop finds the printer without you ever telling it where the printer lives. A tablet on the sofa can pull a file off the desktop upstairs.
None of that is magic, and you probably never wondered about it. Those devices found each other because they’re all on the same small world – your home wifi – and everything on that little world can see everything else on it. It’s a single room, and they’re all in it.
Now pick up the laptop, walk out the front door, sit down in a café. The room is gone. The printer might as well not exist. The desktop upstairs, which was reachable ten minutes ago, has vanished from the face of the earth.
That’s the thing Tailscale gives back to you. The room comes with you.
Why walking out the door breaks it
Here’s the reason, and it’s worth having properly, because the way around it is genuinely clever.
Everything in your home reaches the internet through your router – the box the internet company gave you. A router works rather like the front desk of an apartment building. The whole building has one public street address. The individual flats inside it have no address the outside world can see at all. Post goes out of the building easily. But a stranger on the street cannot address a letter to flat 4F, because as far as the street is concerned, flat 4F does not exist.
Your computer at home is flat 4F. It can reach out to anything on the internet. Nothing on the internet can reach in to it.
And notice: that is not a defect. That front desk is most of the reason random strangers aren’t already poking at your devices. You wouldn’t want to remove it.
The old ways round this – and why they’re both unpleasant
For years there were two answers, and you may have heard people mutter darkly about either.
The first was port forwarding: going into your router’s settings and telling the front desk “anything that arrives asking for door 22, send it up to the machine in the corner.” It works. It also means you have just carved a real, permanent opening in your home network that anyone on the internet can knock on – and the internet is full of automated programs whose entire life is knocking on every door of every building, all day, forever.
The second was running your own VPN server: renting a computer somewhere public, becoming the person responsible for keeping it configured, patched and secure, and routing your machines through it. That works too, and it’s a real skill, and it is a chore that never ends.
Tailscale’s whole appeal is that it is neither. No opening is made, and there is no machine of yours in the middle to look after.
The puzzle, and the lovely answer
So sit with the difficulty for a second, because the escape from it is the entire idea.
Your laptop in the café is behind the café’s front desk. Your computer at home is behind yours. Neither of them can be phoned. Both of them can phone out.
How do two people who can only make calls, and never receive them, ever end up talking?
They both ring the same mutual friend.
That’s it. Each machine, on its own initiative, calls out to a small service Tailscale runs, and says “here I am, this is where I’m standing at the moment.” The service tells each machine exactly where the other one is currently standing. And then both machines, at roughly the same moment, dial out toward each other.
Both calls are outgoing. Every front desk in the world is perfectly happy to let a call go out. The two lines meet in the middle, and a connection exists that neither building would have accepted as an incoming visitor. Nobody opened a door for a stranger. Every door was opened from the inside.
The mutual friend, having made the introduction, drops out of the conversation entirely. From then on your two machines are talking to each other directly, and nothing passes through the middle.
What this trick is called, and what happens when it doesn’t work
Now that you’ve watched it happen, the names are easy. Making two machines meet in the middle like this is called NAT traversal, and the moment where both dial out at once is often called hole punching – a hole is made through both front desks, from the inside, and it only fits the two of them.
Occasionally it fails. Some networks – corporate offices, certain hotels, a few mobile carriers – are locked down tightly enough that the two calls can’t meet. Tailscale keeps a fleet of relay servers around the world for exactly that case, called DERP servers, and your traffic quietly falls back to bouncing off the nearest one. It’s a bit slower, and you will rarely notice.
The relay cannot read what it’s carrying. In Tailscale’s own words, “there is never a way for a DERP server to decrypt your traffic. It just blindly forwards already-encrypted traffic from one node to another.” It’s a postbox, not a reader.
What you end up with: a tailnet
Your own little network has a name: it’s called a tailnet. Yours, holding your machines.
Every device on it gets an address of its own – a number starting with 100., like
100.101.102.103 – and, unlike the addresses your café and your home hand out, this one belongs
to that machine and doesn’t change. Your laptop has the same address in Kyiv as it has in your
kitchen.
Better still, you don’t have to remember numbers. Tailscale gives each machine a plain name –
whatever you called it – and makes that name work. If your home machine is called workhorse,
then workhorse is simply a thing your laptop can reach, from anywhere, forever. (The feature
has a pleasingly unembarrassed name: MagicDNS.)
If Tailscale is installed and running on a machine, there’s a completely harmless command that shows you the whole picture. It changes nothing, sends nothing, and simply prints what’s there:
tailscale statusYou get one line per machine in your tailnet: its 100. address, its name, which operating
system it runs, and whether you’re currently talking to it directly or by way of a relay.
That’s your private network, listed out – the room you’re carrying around with you.
Where it sits next to everything else
Tailscale, on its own, doesn’t do anything with those machines. It builds the road. What you send down the road is up to you.
Overwhelmingly, what people send down it is SSH – the way of sitting down at a faraway computer and typing commands on it as though you were in front of it. The two fit together so naturally that they’re almost one idea: Tailscale makes the machine reachable, SSH lets you work on it. Once your home machine has a name, connecting to it looks exactly like connecting to anything else:
ssh you@workhorseNo address to look up, no port to open, no difference at all between doing it from the next room and doing it from another continent.
That’s the shape behind the laptop that does not sleep: a machine at home with its lid closed and its screen off, still working, reachable by its owner over Tailscale – and, as he puts it, “by nobody else.”
Underneath: WireGuard
For the curious: what’s actually carrying your data
Tailscale didn’t invent the encrypted tunnel itself. It’s built on WireGuard, a piece of work by Jason A. Donenfeld that has become the modern answer to this problem – so well regarded that it now lives inside the Linux operating system itself.
Its whole reputation rests on being small. The older tools for this job were vast, tangled things that no single human could reasonably check for mistakes; WireGuard was deliberately built to be, in its own words, “comprehensively reviewable by single individuals.” In security, small enough to be understood completely is not a modest virtue. It’s the main one.
So the layers, top to bottom: WireGuard is the sealed tunnel between two machines. Tailscale is everything around it that you’d otherwise have to do by hand – introducing your devices to each other, punching through the front desks, handing out names and addresses, and keeping it all working as your machines wander around the world.
”Wait – can Tailscale itself read my things?”
The right question to ask, and the answer is properly reassuring, because of how the pieces are arranged rather than because of a promise.
When Tailscale starts on a machine, that machine makes itself a pair of keys: a public one it hands out freely, and a private one it uses to unlock what’s sent to it. The public keys go up to Tailscale’s coordination service, which Tailscale describes as “a shared drop box for public keys.” The private key stays put. In their words: “the private key never, ever leaves its node.”
Which means the coordination service is an introducer and nothing more. It knows your machines exist and roughly where on the internet they are, so it can point them at each other. It does not carry your traffic, and it holds nothing capable of unlocking it. The only two things on earth that can read what passes between your laptop and your home machine are your laptop and your home machine.
There’s a free tier for personal use – six people and up to a hundred devices – which is comfortably more than a person setting this up for themselves and a few of their own machines will ever come near.
So, in one breath
Tailscale gathers your own devices into a small private network of their own and carries that network with them wherever they go. Each machine reaches out from behind its own wall, an introduction service tells them where to find each other, and they meet in the middle – so nothing is ever left open to strangers and there’s no server of yours in the middle to keep alive. What you’re left with is the plain, useful feeling of your computers all being in one room, no matter which countries they’re actually in.