Installing Tailscale on Linux - Secure Remote VPN Setup

Summary: This post explains how to install Tailscale on a Linux server to set up a secure remote VPN environment. It also covers outbound-based connections, P2P communication, DERP relay, and how to use Serve and Funnel.

Featured image showing multiple devices connected securely for remote access through a single private network using Tailscale

Overview

Tailscale is a VPN service that ties multiple devices together as if they were on a single private network. Even when a Linux server, NAS, laptop, and smartphone are in different locations, they can be connected as though they were on the same internal network.

A typical server connection requires opening an inbound port from the outside into the server. This approach requires router port forwarding, firewall permissions, and a public IP, and if misconfigured it can expose the server directly to the internet.

Tailscale instead uses outbound connections that go from the device to the outside. This means it can be used in most environments without opening any additional ports. However, in a corporate network or environment with security equipment that strongly restricts outbound traffic, it may still be affected by the firewall’s outbound policy.

The way it works is simple. You install the Tailscale client on each device and register it to the tailnet of the same account. A registered device receives a unique tailnet IP, and devices communicate directly with each other via P2P whenever possible. In NAT or firewall environments where a direct connection is difficult, communication is relayed through DERP, Tailscale’s relay server.

Tailscale also provides device-name-based domains.

Like an nginx reverse proxy, you can connect to an internal service using an address in the form https://{device}.{tailnet}.ts.net.

Serve mode provides a proxy that is only accessible within the tailnet, and Funnel mode is used when you need to expose a service to the internet.

Installation

Using the Install Script

1curl -fsSL https://tailscale.com/install.sh | sudo sh

Starting the Service

Enable it with enable and start it immediately with --now

1sudo systemctl enable --now tailscaled

Running

Registering the Device

Connect the current machine to the Tailscale network of the specified account

e.g.) https://login.tailscale.com/a/xxxxxxxxxxxxx

1sudo tailscale up
2
3# Result
4# To authenticate, visit:
5# 
6#         https://login.tailscale.com/a/xxxxxxxxxxxxx

Account Authentication

Screen showing login to a Tailscale account by visiting the authentication URL printed in the terminal

Connecting the Device

Click the Connect button to access the service

Screen showing the server being connected to the tailnet by clicking the Connect button

Screen showing that the device has been successfully registered to the tailnet

Device Registration Complete

The device has been registered, but the --accept-routes option is false, which means routing between peers has not been set up

1# Result
2# Success.
3# Some peers are advertising routes but --accept-routes is false

Check status

 1ubuntu@a1-free:~$ tailscale status
 2
 3# result
 4# xx.xx.184.107  a1-free           plzhans@        linux    -                            
 5# xx.xx.46.27    iphone-14-pro     plzhans@        iOS      -                                  
 6# xx.xx.192.32   plzhanss-macbook  plzhans@        macOS    -                           
 7# xx.xx.23.68    wee-home          tagged-devices  linux    -                            
 8
 9# Health check:
10#     - Some peers are advertising routes but --accept-routes is false

VPN Communication

There are broadly 3 methods.

Using the internal tailnet IP
Communicating between VPN device nodes via routing with accept-routes
Communicating between VPN device nodes using serve mode
Allowing anyone on the internet to connect using funnel mode (however, only HTTP / HTTPS)

VPN: Tailnet IP Method

When connected to the tailnet, a tailnet-only private IP is assigned by default

It is installed automatically during the basic installation

Assumes a tailscale0 virtual router has been created internally, since tune mode is used

Screen confirming that a tailnet-only private IP and the tailscale0 virtual interface have been created

VPN: accept-routes Method

Since it communicates internally without using Tailscale’s infrastructure, there is no restriction on traffic

Tailscale Configuration

Go to the console: https://login.tailscale.com/admin
Check the subnet

Screen showing the subnet routes advertised by a device in the Tailscale admin console

Machine Configuration

Accept tailscale peer routing

From now on, routing information is retrieved from the Tailscale admin and synced

1tailscale set --accept-routes=true

Check the routing

If the NAS’s private IP is 192.168.35.x

1ip route show table all | grep 192.168.35
2
3# Result
4# 192.168.35.0/24 dev tailscale0 table 52

Verify connection to other devices

Since tailscale uses a P2P method, it is affected by the outbound policy between devices, not the inbound policy.

Hole punching is usually attempted first, and if it fails, it falls back to relay.

1nc -vz 192.168.35.3 1022
2
3# Result
4# Connection to 192.168.35.3 1022 port [tcp/*] succeeded!

VPN: Serve Mode

Accessible via {device-name}.tailnet.ts.net

Since it uses Tailscale’s servers, there is a traffic limit

Reference: https://tailscale.com/docs/reference/tailscale-cli/serve

1# Client -> xxxxx.tailnet.ts.net:443 -> xxxxx:3000
2sudo tailscale serve --https=443 / http://127.0.0.1:3000
3
4# Client -> xxxxx.tailnet.ts.net:80 -> xxxxx:3000
5sudo tailscale serve --http=80 / http://127.0.0.1:3000
6
7# Client -> xxxxx.tailnet.ts.net:1111 -> xxxxx:2222
8sudo tailscale serve --tcp=1111 tcp://127.0.0.1:2222

VPN: Funnel Mode

Accessible via https://{device-name}.tailnet.ts.net