What Is Tailscale? A Mesh VPN Explained
Tailscale explained: how its WireGuard-based mesh VPN, coordination server, and NAT traversal actually work, what the free plan includes in 2026, and who it fits.
You're at a coffee shop trying to reach your home Proxmox box, and it's not there. No static IP, your ISP hides you behind CGNAT, and the idea of opening a port on your router feels like leaving a window unlocked. That specific wall — not "I want a VPN" in the abstract — is the problem Tailscale was built to solve.
TL;DR
- Tailscale is a mesh VPN built on WireGuard: devices connect directly to each other instead of routing through a central VPN server.
- A coordination server only exchanges public keys and connection info — it never sees your actual traffic, which flows peer-to-peer over encrypted WireGuard tunnels.
- When a direct connection isn't possible (CGNAT, strict firewalls), Tailscale falls back to relay servers called DERP, still fully encrypted end-to-end.
- The free Personal plan (reworked in April 2026) covers up to 6 users, unlimited devices, and subnet routers/exit nodes — no device cap and no time limit.
- It trades some of raw WireGuard's control for near-zero setup time; the WireGuard vs OpenVPN comparison covers the option Tailscale is built on top of.
What Tailscale Actually Is
A traditional VPN is hub-and-spoke: every device connects to one central server, and all traffic passes through it, which is exactly the bottleneck you feel when a "VPN" slows down video calls. A mesh VPN flips that model — devices talk directly to each other, and no single node has to relay everyone else's traffic. Tailscale is the most widely used implementation of this idea, built directly on top of the WireGuard protocol rather than inventing its own encryption.
In practice, that means installing Tailscale on your laptop and on your homelab server gives them a private, encrypted, routable connection to each other — as if they were on the same LAN — regardless of which network either one is actually sitting on. See Tailscale's own explanation of how a mesh VPN differs from a traditional one for the full architectural contrast.
How It Works Under the Hood
Tailscale splits itself into two separate jobs, and understanding the split is what makes the security model make sense.
The coordination server is the control plane. Each device logs in, uploads its WireGuard public key and the network addresses it believes it can be reached at, and downloads the same information for every other device on your network (your "tailnet"). According to Tailscale's own architecture writeup, this server never carries your actual data — it's closer to a shared address book than a VPN gateway, and your WireGuard private key never leaves the device that generated it.
Once two devices have each other's public keys and candidate addresses, they attempt a direct peer-to-peer connection using STUN-based NAT traversal — both sides send packets toward each other's guessed address at the same moment, so each router sees an outbound flow first and lets the reply back in. Tailscale's NAT traversal documentation reports this succeeds directly more than 90% of the time.
Note
When a direct connection genuinely can't be established — double NAT, symmetric NAT, or a very locked-down firewall — Tailscale falls back to a relay server (DERP). Traffic still stays end-to-end WireGuard-encrypted through the relay; DERP just forwards encrypted packets it can't read.
Tailscale vs Setting Up WireGuard Yourself
Tailscale isn't a different protocol from raw WireGuard — it's WireGuard with the manual parts automated. If you've read our WireGuard vs OpenVPN comparison, the setup steps below are what Tailscale removes.
| Step | Raw WireGuard | Tailscale |
|---|---|---|
| Generate & exchange keys | Manual, per device pair | Automatic on login |
| Router/port forwarding | Usually required for NAT | Not required (STUN-based traversal) |
| Config file editing | Hand-edit .conf per peer | None — tailscale up on each device |
| New device joins network | Edit every existing peer's config | Appears automatically to the whole tailnet |
| Roaming IP changes (mobile) | Manual reconnect/rekey | Handled automatically |
| What you give up | None — full control | Trust in Tailscale's coordination server |
The tradeoff is real, not just marketing: raw WireGuard keeps every key and route under your own control with no third party in the loop, while Tailscale accepts a coordination server it doesn't operate itself in exchange for that setup time disappearing. Which one is worth it depends on how many devices and how much NAT complexity you're dealing with.
Getting My Proxmox Homelab Online Behind CGNAT
My home connection sits behind carrier-grade NAT — no static IP, no way to forward a port to my Proxmox host even if I wanted to. Before Tailscale, reaching it remotely meant a workaround like a self-hosted WireGuard peer on a VPS.
Installing it took three commands, run once per device:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale status
The tailscale status output listed every device on my tailnet with its assigned 100.x Tailscale IP and MagicDNS name. From my phone, on mobile data, ssh proxmox just worked — no VPN app toggle, no IP to remember, no port opened on my router at any point.
Tip
Turn on MagicDNS in the admin console before adding devices — it's what lets you type a device's name (proxmox, nas) instead of memorising its 100.x address, and it's free on every plan including Personal.
What's Free in 2026 (Personal Plan Limits)
Tailscale reworked its plans in April 2026, retiring the old "Personal Plus" tier and folding its allowance into the free plan. A lot of older comparison articles still quote the pre-rework numbers, so it's worth stating the current ones plainly.
KEY-STAT: 6 — users allowed on the free Personal plan, with unlimited devices per user, per Tailscale's pricing page.
Per Tailscale's pricing page, the free Personal plan currently includes:
- Up to 6 users in one tailnet, unlimited devices per user
- Up to 3 ACL groups and up to 50 tagged resources
- 1,000 minutes per month for ephemeral resources
- Subnet routers and exit nodes included (not gated behind a paid tier)
- MagicDNS, Tailscale SSH, and Serve available to try
Warning
Funnel — Tailscale's feature for exposing a service to the public internet, not just your tailnet — is a separate, opt-in step. Don't enable it on anything you don't specifically want reachable by anyone, since it changes a private tailnet resource into a public one.
For a solo homelab operator or a small household, this is enough to run indefinitely without paying anything — the free tier isn't a trial.
Who Should Use Tailscale (and Who Shouldn't)
Tailscale is a strong fit if you want remote access to a homelab, NAS, or personal devices without router changes, or you're setting up secure access for a small team without deploying VPN infrastructure. It's a weaker fit if you need every packet to stay on infrastructure you fully control end-to-end — the coordination server, even though it never sees your traffic, is still a third-party dependency some fully self-hosted setups want to avoid (Headscale is the open-source, self-hosted alternative to that piece, worth its own comparison). If remote access is part of a wider hardening pass on your home network, our home network security guide covers the rest of that picture.
Frequently asked questions
Is Tailscale free to use?
Yes — the Personal plan is free indefinitely for up to 6 users with unlimited devices per user, including subnet routers and exit nodes, per Tailscale's current pricing page.
Is Tailscale a VPN in the traditional sense?
Not exactly. It uses VPN encryption (WireGuard) but skips the traditional hub-and-spoke model — devices connect directly to each other in a mesh rather than routing through one central VPN server.
Does Tailscale see or log my traffic?
The coordination server only exchanges public keys and connection metadata to help devices find each other — actual data flows peer-to-peer over end-to-end encrypted WireGuard tunnels, and even the DERP relay fallback only forwards encrypted packets it can't read.
What's the difference between Tailscale and WireGuard?
Tailscale is built on WireGuard, not a replacement for it. Raw WireGuard requires manually generating keys, editing config files per device, and usually forwarding a router port. Tailscale automates all of that and adds NAT traversal, at the cost of relying on its coordination server.
Can I self-host the Tailscale control server?
Not Tailscale's own coordination server, but Headscale is an open-source, self-hostable alternative implementation of the same control-plane protocol, for anyone who wants the mesh-VPN model without a third-party coordination server.
More from Self-Hosting & Privacy
Passkeys and hardware security keys use the same FIDO2 standard but solve different problems. What device-bound vs synced passkeys mean, where a physical key still matters, and the setup that covers both.
Every 'best security key' list names the same products in the same order. This one matches your devices, protocols, and budget to a real answer instead — including a cheaper Yubico line most guides skip.
A hardware security key stops phishing in a way SMS codes and authenticator apps can't. Start here to find out if you need one, then jump straight to the guide that matches your situation.
Stay in the loop
Get the latest articles delivered to your inbox. No spam, unsubscribe anytime.
YubiKey and Hardware Security Keys: The Guide
A hardware security key stops phishing in a way SMS codes and authenticator apps can't. Start here to find out if you need one, then jump straight to the guide that matches your situation.
Continue Reading