How to Install Tailscale on a Homelab

I advertised a subnet route from my Proxmox box, checked the admin console, saw the route sitting there approved, and still couldn't reach anything behind it. The route looked fine. It just wasn't working — because approving a route in the console and actually forwarding packets on the host are two separate steps, and I'd only done one of them.

What You Need Before You Start

A free Tailscale account covers this entire setup — the Personal plan supports up to 6 users with unlimited devices each, more than enough for one person's Ubuntu server, Raspberry Pi, and Proxmox host. You don't need a credit card or a paid tier for anything in this guide.

Installing Tailscale on an Ubuntu Server

Tailscale ships one install script for Debian-based systems, Ubuntu server included:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

tailscale up prints a URL. Open it in a browser, log in with the account you want this tailnet tied to, and the device appears in your admin console immediately — no separate approval step for a normal (non-tagged) device on a personal account.

Installing Tailscale on a Raspberry Pi

The exact same script works on Raspberry Pi OS, since it's Debian-based:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The installer sets up a systemd service automatically, so Tailscale reconnects on its own after a reboot or a power cut — relevant if the Pi is sitting somewhere and rebooting itself unattended.

Installing Tailscale on a Proxmox Host

Proxmox VE is Debian-based, so the same script installs at the host level:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The LXC Container Gotcha

If you'd rather run Tailscale inside an LXC container than on the bare host, an unprivileged container has no /dev/net/tun device by default, and Tailscale needs one to create its network interface. According to Tailscale's own LXC documentation, you fix this by adding two lines to the container's config file on the Proxmox host (/etc/pve/lxc/<CTID>.conf):

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

The container has to be stopped and restarted for this to take effect — a config reload alone doesn't apply it. Skip this and tailscale up inside the container fails or the tunnel never comes up, with no obvious error pointing at the real cause.

The Authentication Flow, Explained

Every tailscale up follows the same pattern: the client generates a device key locally, then opens a login URL against Tailscale's coordination server. Once you authenticate in the browser, the coordination server registers the device's public key against your tailnet and it shows up in the admin console. Nothing about your actual traffic goes through that server afterward — it only ever exchanges public keys and connection candidates between devices, the same architecture covered in our explainer on what Tailscale actually is.

Turning On MagicDNS

By default, every device gets a stable address in the 100.64.0.0/10 range — functional, but not memorable. MagicDNS assigns each device a name instead, so ssh pi.tailXXXXX.ts.net (or the short ssh pi version) works instead of memorizing an IP that never changes but never means anything either. Turn it on once, in the admin console's DNS tab — nothing to configure per-device.

Setting Up a Subnet Router

A subnet router lets one Tailscale device advertise an entire LAN behind it, so the rest of your tailnet can reach devices that don't run Tailscale themselves — useful for a Proxmox host advertising the subnet its VMs sit on.

1. IP forwarding enabled on the host:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

1. The route advertised by the client, then approved in the admin console:

sudo tailscale set --advertise-routes=192.168.1.0/24

Per Tailscale's own subnet router documentation, an advertised route sits in a pending state until an admin approves it from the console — the client-side flag alone is not enough on its own, and neither is IP forwarding alone. I'd done the sysctl step days earlier for something unrelated and forgot the approval step was still outstanding, which is exactly how the intro's dead route happened.

Locking It Down With ACL Tags

By default, every device on a personal tailnet can reach every other device. Tags let you scope that down. Assign a tag when bringing a device up:

sudo tailscale set --advertise-tags=tag:homelab

Then restrict access to it in the tailnet policy file — a minimal example limiting tag:homelab to a specific user:

{
  "acls": [
    {"action": "accept", "src": ["autogroup:member"], "dst": ["tag:homelab:22,443"]}
  ]
}

Tailscale's ACL system defaults to deny — nothing outside a rule you write gets access, which matters the moment more than one device or person shares a tailnet.

Real Gotchas From This Install

Symptom	Cause	Fix
tailscale up fails inside a Proxmox LXC	Unprivileged container has no /dev/net/tun	Add the two config lines above, restart the container
Subnet route approved but unreachable	IP forwarding never enabled on the host	Set net.ipv4.ip_forward = 1 and reload sysctl
Route advertised, IP forwarding on, still nothing	Route never approved in the admin console	Approve it under Machines → the device → Edit route settings
Device stuck as "pending" after tailscale up	Tagged device requiring approval, or a managed/tailnet-lock account	Approve manually in the admin console

What to Do Next

Once every box is on the tailnet, the next useful step is routing your phone's traffic through home when you travel using an exit node, or deciding whether a self-hosted coordination server like Headscale makes more sense than Tailscale's hosted one for your setup. And if you're still deciding what to actually run on this hardware in the first place, start with our homelab beginner's guide and what a Raspberry Pi server can realistically host.

FAQ

Is Tailscale free for a homelab?

Yes — the Personal plan is free for up to 6 users with unlimited devices each, which comfortably covers a homelab's server, Pi, and Proxmox host under one account.

How do I install Tailscale on a Raspberry Pi?

Run the same install script used on any Debian-based system: curl -fsSL https://tailscale.com/install.sh | sh, then sudo tailscale up and open the printed URL to authenticate. It works headless over SSH.

Can I run Tailscale inside a Proxmox LXC container?

Yes, but an unprivileged container has no /dev/net/tun device by default. Add the two config lines from Tailscale's own LXC documentation to the container's config file and restart it, or install Tailscale on the Proxmox host itself instead.

Why isn't my Tailscale subnet route working?

A subnet route needs two things, not one: IP forwarding enabled on the advertising host, and the route approved in the admin console. Either one missing leaves the route silently broken with no error message.