Tailscale as the backbone: everything private, reachable from anywhere

Level IntermediateEstimated time 1 hRead first Homelab 6: reach home from anywhere without opening a portA word you don't know? Glossary

The best way to secure a service is not to publish it. A private mesh network such as Tailscale (or its self-hosted counterpart, Headscale) links your laptop, phone and servers wherever they are, as if they shared one local network. In our lab, most services live only there. Here is what goes through it, and how.

What you get. Your whole lab in your pocket, from any network, with nothing to open on your router: the model gateway, the phone console, game streaming, admin consoles. Each service on the private network gets a real HTTPS address, and the public internet sees none of it.

A bit of history

For decades, reaching home from outside meant a VPN server, an open port and certificates to manage, or a port forward per service. WireGuard, written by Jason Donenfeld and merged into the Linux kernel in 2020, made encrypted tunnels small, fast and simple. Tailscale, founded in 2019, added what WireGuard leaves to you: exchanging keys, finding each device behind its router, naming machines. Each device talks directly to the others; a coordination server only introduces them. Headscale is an open-source reimplementation of that coordination server, for those who want to host it too. Addresses come from a range reserved in 2012 for carriers (RFC 6598), so they never collide with your home network.

1. What lives only on the private network here

The model gateway: it listens only on the private network's interface.
The API behind the phone console, and the agents' sessions.
The fingerprint relay that approves a sudo on the server.
Game streaming from the headless gaming PC.
Health reports from the laptop when it is away from home: they reach the lab through the private network, not a public address.
Admin consoles: behind the proxy, they answer only to the local and the private network (see the audit).

2. Publish a service with real HTTPS, privately

tailscale serve --bg --https=443 http://127.0.0.1:8460

The service keeps listening on the machine itself; Tailscale gives it an address of the form https://machine.your-tailnet.ts.net with a valid certificate, reachable only by your devices. No proxy, no open port, no certificate to renew by hand.

3. Open a port to the private network only

ufw allow in on tailscale0 to any port 4000 proto tcp

Rules on the tailscale0 interface never apply to the local network or the internet. Combined with a service bound to the private address, a mistake in one layer is caught by the other.

4. Tighten the defaults

Access rules: the default policy lets every device reach every other. Write rules by tag: the phone may reach the console and the gateway, a guest device nothing.
Names: enable MagicDNS, and on the phone "use Tailscale DNS settings", or names will not resolve.
Allow-lists elsewhere: the private network's address range (inside the 100.64/10 block) can be trusted in your proxy's access lists, your fail2ban ignoreip and your rate limits.

Traps

A sleeping machine does not answer even a tailscale ping. Wake it first (see sleep and wake) before concluding the network is broken.

Do not confuse "on the private network" with "safe": a compromised laptop is on it too. Keep logins, and keep the access rules tight.

Sources

Found this useful? Tell us what to measure next.