Tailscale is a mesh VPN service that connects your machines into one private network, the tailnet, using WireGuard encryption between each pair. Devices get stable private addresses and names, connect directly through NAT where possible, and can reach services that listen only on the tailnet address, so nothing has to be exposed to the public internet. Headscale is a self-hosted alternative to Tailscale's coordination server.
At a glance
Built on
WireGuard, one encrypted link per pair of devices
What you get
Private addresses and names for every device, anywhere
Why it matters
Services stay off the public internet and still reach your phone
Self-hosted option
Headscale replaces the coordination server
Why use it instead of opening a port?
Because an open port is reachable by everyone, and every service behind it must
then defend itself against the whole internet. On a tailnet, a dashboard or an
API listens only on the machine’s tailnet address; your own devices reach it,
nobody else even sees it. Combined with TLS certificates for tailnet names, a
phone gets a proper HTTPS connection to a home server without any public
exposure.
What is the common mistake?
Binding a service to 0.0.0.0, all interfaces, and assuming the tailnet protects
it. It does not: the service is then also on the LAN and on any other network
the machine is in. Bind to the tailnet address (or loopback) explicitly, and let
the firewall back that up.
Tailscale makes easy
Reaching a home server from a phone without port forwarding
Binding a dashboard to the tailnet address only
TLS certificates for machine names inside the tailnet
Keep in mind
The coordination server is Tailscale's unless you run Headscale
A service bound to 0.0.0.0 is still on every network, not only the tailnet
Every device in the tailnet is inside your perimeter