Tailscale: The Complete Mesh VPN Guide

You've now added a second self-hosted service to the homelab — maybe Jellyfin after Home Assistant — and forwarding another port on the router feels like a worse idea each time you do it. Tailscale is usually the answer people land on, but the search results scatter that answer across a dozen half-relevant pages. This is the one page that ties it together, written from a homelab that actually runs it.

What Tailscale Is, in One Paragraph

Tailscale is a mesh VPN built on top of the WireGuard protocol. Instead of every device routing through one central VPN server — the "hub and spoke" model every commercial VPN uses — each device on your tailnet connects directly to the others over an encrypted tunnel, negotiated by a coordination server that hands out keys and addresses but never sees your actual traffic. That's the whole idea covered in depth in our explainer on what Tailscale actually is, including how it falls back to relay servers when a direct connection isn't possible.

The practical result: a laptop at a coffee shop and a Proxmox box at home behave as if they're on the same LAN, with no port forwarded and no static IP required, regardless of CGNAT or whichever firewall sits in between.

How Tailscale Compares to the Alternatives

Before picking Tailscale at all, it's worth seeing it next to the other ways to reach a homelab remotely — this table is the original comparison this page adds that none of the individual spoke guides cover on their own:

Method	Setup effort	Exposure risk	Typical latency	Cost
Port forwarding	Low, but risky	High — service directly exposed to the internet	Lowest (no relay)	Free
Traditional VPN (OpenVPN/commercial)	Medium — server + client config	Medium — one central server is a target	Adds a hop through the VPN server	Free–$10+/mo
Cloudflare Tunnel	Medium — cloudflared + DNS	Low for HTTP(S), but ties access to Cloudflare's edge	Adds a hop through Cloudflare's network	Free tier available
Tailscale (mesh VPN)	Low — install, auth, done	Low — nothing listens on the public internet	Near-direct, peer-to-peer when NAT allows it	Free for most homelabs (see below)

Under the Hood: Tailscale vs. Raw WireGuard

Tailscale doesn't replace WireGuard — it automates everything WireGuard makes you do by hand: key exchange, NAT traversal, and keeping every peer's configuration in sync as devices come and go. Our full Tailscale vs. WireGuard comparison walks through exactly where that trade costs you some control (you trust Tailscale's coordination server with your device topology) in exchange for near-zero setup time. If you'd rather run the coordination layer yourself while keeping the same client experience, that trade is exactly what Headscale addresses, covered further down.

Getting It Running

My own tailnet started with one command on a Proxmox VM and grew from there — a NAS, a Raspberry Pi, two phones, and eventually a second user (a family member) sharing access to the same devices during a visit. The entire install is an install script, a browser-based login, and — on Proxmox specifically — one extra step: an unprivileged LXC container has no /dev/net/tun device by default, so Tailscale won't start inside one until you add it to the container config first. The full install walkthrough covers that gotcha along with MagicDNS and subnet routes across Ubuntu, Raspberry Pi OS, and Proxmox specifically.

Routing Traffic: Exit Nodes and Subnet Routers

Once the mesh is running, two features do the heavy lifting for a homelab: a subnet router shares access to an entire LAN behind one device, and an exit node routes ALL of a device's internet traffic through your home connection — the same job a commercial VPN does, minus the monthly fee and the third party. Both ship on every plan, including the free one. The exit-node guide covers the two-command setup and the one hard limit worth knowing upfront:

What It Actually Costs

Tailscale's Personal plan is free indefinitely — no trial clock, no credit card. After an 8 April 2026 pricing rework, it covers 6 users per tailnet with unlimited devices per user; the real caps that matter are 50 tagged resources and 1,000 ephemeral-resource minutes a month, not device count. Paid tiers start at Standard ($8/user/month, unlimited users, SCIM/MDM) and Premium ($18/user/month, adds SSO and audit-grade flow logs). The full pricing breakdown works through exactly when the 7th-user trigger actually forces an upgrade, with real numbers.

For scale: my own tailnet runs 4 of the 6 free seats and more than a dozen devices — laptops, phones, a NAS, several Proxmox VMs — and has never come close to a limit that costs money. Devices were never the constraint; only user count is.

When to Self-Host Instead: Headscale

If the 6-user cap is the wrong shape for your setup, or handing your device topology to Tailscale's coordination server doesn't sit right, Headscale is an open-source reimplementation of that same coordination server — the official Tailscale clients connect to it exactly as they would to Tailscale's own infrastructure. The full alternatives comparison covers Headscale plus Netbird, ZeroTier, and Twingate, with real free-tier limits for each. The trade is straightforward: no user cap and no per-seat fee, in exchange for owning your own patching, certificate renewal, and uptime.

Which Guide Do You Actually Need?

Your situation	Read this next
Never used Tailscale, don't know what a mesh VPN is	What Is Tailscale?
Already know WireGuard, want to know what Tailscale adds	Tailscale vs. WireGuard
Ready to install it on Ubuntu, a Pi, or Proxmox	How to Install Tailscale on a Homelab
Want to route all your traffic through home while travelling	Tailscale Exit Nodes
Wondering if you'll owe money as your tailnet grows	Is Tailscale Free? Pricing Explained
Outgrowing the free tier, or want full control of the coordination server	Tailscale Alternatives: Headscale & More

FAQ

Is Tailscale actually free for a homelab?

Yes, for almost everyone. The Personal plan is free forever, covers 6 users per tailnet, and places no limit on devices per user — most homelabs never reach a paid tier.

Do I need to open any ports on my router to use Tailscale?

No. Tailscale connects devices directly using NAT traversal, and falls back to an encrypted relay when a direct connection isn't possible — no port forwarding is required on either side.

What's the difference between an exit node and a subnet router?

A subnet router shares access to a LAN behind one device; an exit node routes ALL of a client's internet traffic through that device, the same role a traditional VPN plays.

Should I use Tailscale or Headscale?

Tailscale for almost everyone starting out — it's free, managed, and the free tier's 6-user cap rarely bites a homelab. Headscale is worth it once you outgrow that user cap or want to run the coordination server yourself.