How to Use Tailscale: The Beginner's Guide (First Tailnet, Second Device, Exit Node, and the No-Open-Ports Rule)

CodexFuse Team · 2026-10-30T05:33:23.697Z · 12 min read

What is Tailscale, exactly?

Tailscale is a mesh VPN built on WireGuard that connects your own devices into one private network, called a tailnet. Every device gets a stable 100.x.y.z address that works from anywhere — home, work, a coffee shop, or mobile data — with no port forwarding, no firewall rules, and no open router ports.

Here are the two truths no beginner guide should bury. First, Tailscale is not a privacy VPN: it connects your own devices to each other, but it does not hide your browsing from the websites you visit. If your goal is to browse anonymously, a commercial VPN like the one in our Proton VPN beginner guide is the right tool; Tailscale is for reaching your own stuff. Second, the free Personal plan covers the entire beginner arc in this guide — no paid plan is needed to start.

Step 1: Create your Tailscale account and first tailnet

Go to tailscale.com and sign up with a Google, Microsoft, GitHub, or Apple account — no credit card is required for the free Personal plan. Signing in creates your tailnet automatically: this is your private network, and it will carry your account's name.

One caution before you go further: if you sign up with a custom domain, Tailscale may auto-enroll you in a 14-day Enterprise trial — downgrade before the trial ends if you want to stay on the free plan (fahimai.com, Tailscale pricing, checked 2026).

Step 2: Install Tailscale on your first device

Install the Tailscale app on the device that matters most — usually your server or your laptop — and sign in with the same account you just created. The device joins your tailnet immediately; there is nothing to configure.

On a Linux server, sudo tailscale up prints a URL — open it in a browser and sign in to authenticate the device. Note that Tailscale works through native apps, not browser extensions (selfhosting.sh, Tailscale setup for self-hosting, updated March 2026).

Step 3: Add a second device and check your tailnet

Install Tailscale on a second device — your phone is the perfect test — and sign in with the same account. Open the admin console at admin.tailscale.com and look at the Machines page: both devices appear there, each with a stable 100.x.y.z address.

Confirm connectivity from the command line on either device:

tailscale ip -4     # your device's permanent 100.x.y.z address
tailscale status    # every device on your tailnet
ping 100.x.y.z      # your other device answers, anywhere on Earth

From your phone on mobile data, try SSH to your home server's tailnet address — it works exactly as if you were on the same LAN, because the traffic is encrypted end-to-end with WireGuard and goes directly between devices whenever possible (codewithromi.com, "How I Access My Entire Homelab from Anywhere with Tailscale," March 2026).

Step 4: Stop memorizing IPs — turn on MagicDNS

MagicDNS gives every device on your tailnet a human-readable name so you never type a 100.x.y.z address twice. Enable it in the admin console under DNS, then use the device's hostname instead of its IP:

ssh user@homelab          # instead of ssh [email protected]
http://homelab:8096       # your media server, by name

Device names come from the machine's hostname, so set a meaningful one first — sudo hostnamectl set-hostname homelab on Linux — because defaults like ubuntu-server make MagicDNS useless (selfhosting.sh).

Step 5: Reach your whole home network with a subnet router

By default, Tailscale only reaches devices with Tailscale installed. A subnet router advertises your entire home LAN, so you can reach devices that can't run Tailscale — printers, IoT gear, a NAS — from anywhere. The classic home for a subnet router is a Raspberry Pi, as our Raspberry Pi beginner guide explains; once the Pi runs Tailscale, one command turns it into your network's front door:

sudo tailscale up --advertise-routes=192.168.1.0/24
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Two steps beginners always miss: you must enable IP forwarding on the Pi (without it, packets arrive and die), and you must approve the route in the admin console (Machines → your server → approve routes) — advertising from the CLI alone does nothing until an admin approves it (selfhosting.sh).

Step 6: Route your traffic through home with an exit node

An exit node routes all of a device's internet traffic through one of your own machines — like a traditional VPN, but through your home connection instead of a provider's server. The use cases are honest ones: encrypting traffic on untrusted café Wi-Fi, using your home's DNS from anywhere, or reaching geo-restricted services from your own home IP while traveling.

On the machine that should be the exit node, run:

sudo tailscale up --advertise-exit-node

Then approve it in the admin console and select that machine as the exit node in the Tailscale app on your client device. Tailscale's own apps describe this under "Use exit node" — the admin-console approval step is the security boundary, so it cannot be skipped (selfhosting.sh).

A word of honesty the guides owe you: an exit node framed as a way around a workplace network policy is not what this feature is for. Use it for your own network's remote access.

Tailscale vs a VPN vs the alternatives: which one is your job?

Beginners waste hours mixing up tools that solve different problems. Here is the decision table:

The free-plan line: what costs money and what doesn't

The Personal plan is free — 3 users, up to 100 devices, nearly all features including MagicDNS, subnet routing, exit nodes, and ACLs — and it is enough for any beginner's tailnet. The pricing tiers above it exist for bigger jobs: Personal Plus at $5/month (6 users, 100 devices), Starter at $6 per user per month for small teams, and Premium at $18 per user per month for companies needing full access controls and network logging (toolradar.com, Tailscale pricing, verified from tailscale.com/pricing in October 2026).

Plan limits move, so check tailscale.com/pricing before you commit — but nothing in this guide requires leaving the free tier.

Five mistakes every Tailscale beginner makes

These are the failures that eat beginners' evenings, collected from working setup guides (selfhosting.sh):

• Forgetting IP forwarding — subnet routes silently fail without net.ipv4.ip_forward = 1 on the router device.
• Advertising routes but never approving them — the admin console approval is a security step, not a formality.
• Using Tailscale when you need public access — a blog, a shared file server, or a website needs a tunnel or port forwarding instead; Tailscale is for private access.
• Running Tailscale and another VPN client at the same time — WireGuard/OpenVPN clients fight over routing; configure split tunneling carefully or pick one.
• Leaving the default hostname — rename machines to something human before enabling MagicDNS, or you'll SSH to ubuntu-server-4f2 forever.

One more habit for server owners: Tailscale SSH (sudo tailscale up --ssh) gives you key-based SSH over your tailnet without opening port 22 to the world. Pair it with real SSH key hygiene — our SSH key generator guide shows how to make proper keys if you still manage servers the old way.

Sources

• selfhosting.sh, "Tailscale Setup for Self-Hosting" — install commands, MagicDNS, subnet router, exit node, ACLs, common mistakes; updated March 9, 2026; read 2026-10-30.
• codewithromi.com, "How I Access My Entire Homelab from Anywhere with Tailscale" — install steps, MagicDNS enable, 100-device free tier; published March 2026; read 2026-10-30 via web search.
• dev.to/avgskully, "Access Your Home Server from Anywhere — Tailscale, Oracle VPS, and frp" — install.sh flow, tailscale ip -4, UFW allowance on tailscale0; read 2026-10-30 via web search.
• toolradar.com, "Tailscale Pricing 2026" — Personal free (3 users, 100 devices), Personal Plus $5/mo, Starter $6/user/mo, Premium $18/user/mo; verified from tailscale.com/pricing October 2026; read 2026-10-30.
• fdaytalk.com, "Replace Cloud Subscriptions With a Home Server and Tailscale" — Personal plan 3 users / 100 devices, Personal Plus 6 users; read 2026-10-30 via web search.
• gist.github.com/brennanMKE, "Getting Started with Tailscale" — tailscale up --ssh flag for SSH access via Tailscale without public SSH keys, Raspberry Pi subnet-router approval steps; read 2026-10-30.

Frequently Asked Questions

Is Tailscale really free?

Yes — the Personal plan is free forever for personal use, covering up to 3 users and 100 devices with nearly all features (MagicDNS, subnet routing, exit nodes, ACLs). Paid plans start at $5/month for families and $6 per user per month for teams (toolradar.com, October 2026 pricing verification).

Is Tailscale a VPN like NordVPN or Proton VPN?

No. Tailscale connects your own devices to each other; it does not hide your IP address from the websites you visit. If you need anonymous browsing, use a commercial privacy VPN — our guide to using Proton VPN walks through one.

Do I need to open ports on my router for Tailscale?

No. Tailscale traverses NAT automatically — no port forwarding, no firewall rules, no DDNS. Your services stay invisible to the public internet while remaining reachable from your devices.

How is Tailscale different from WireGuard?

Tailscale is built on WireGuard but adds automatic key management, NAT traversal, and a coordination layer. Plain WireGuard requires manual key exchange and static endpoints; Tailscale removes that configuration work (selfhosting.sh).

Can I reach my home computer from my phone?

Yes — install the Tailscale app on both, sign in with the same account, and your home computer is reachable from anywhere via its 100.x.y.z address or its MagicDNS name, on Wi-Fi or cellular data. This is the setup media-server owners use to reach Plex from anywhere, and privacy-minded readers pair it with DuckDuckGo for searching without tracking.