Let’s Use Tailscale for Remote SSH Access
language
eng
date
Dec 17, 2025
slug
tailscaleForRemote
author
status
Public
tags
Product
Remote
Tailscale
VPN
summary
After a security incident, I found an answer: building a safe and convenient remote SSH setup with Tailscale.
type
Post
thumbnail
category
😎 Daily
updatedAt
Jan 4, 2026 04:40 AM
I often need to connect to servers that are physically far away. On the client side, I don’t always know whether I’ll be using Windows, macOS, or Linux, but the destination is usually Linux. In many cases, I just use SSH to do quick checks or development work.
If everything is on the same internal network, it’s easy—just type:
ssh user@address
But when you’re not on the same network, you need a different approach. Here are a few common options:
1) The most straightforward (and brutish) way: router port forwarding
Using your router’s port-forwarding feature to expose SSH to the internet.
- Pros: Simple and easy
- Cons: Extremely, extremely, extremely insecure. You’re basically opening your server to the entire world.
2) ngrok
A tunneling approach: it creates a tunnel to an external cloud server, and you connect through that cloud address. It’s often used for web development testing.
- Pros: No router configuration needed, and your IP isn’t directly exposed
- Cons: Traffic goes through ngrok (latency constraints), and there’s still a risk of scanning and brute-force attacks
3) Tailscale
A WireGuard-based solution. If you install the Tailscale client on your devices, it forms a mesh VPN and assigns stable internal IPs.
- Pros: Stable device IPs, not reachable via internet scanning
- Cons: You have to install and log in to the Tailscale client
In my case, I used two of the methods above—public IP + port forwarding, and ngrok—and I actually got hacked.
- With port forwarding, I got hit by IP scanning and brute-force attacks and ended up infected with ransomware.
- With ngrok, someone connected, changed the password, and disappeared.
After that, I started looking for a remote SSH method that I could use all the time—something both safe and convenient. The service ChatGPT recommended was Tailscale.
Tailscale is essentially a private VPN that makes registered devices behave as if they’re on the same internal network. Out of the box, it has solid security, and the ability to use stable IPs is a huge plus. Even from remote locations, you can access various server ports relatively safely.
Another big advantage: even on the personal free plan, you can register up to 100 devices. I use about three laptops and around six machines total when you combine my local servers across Windows and Linux—so managing everything through Tailscale is pretty effective for me. You can place all devices on the same VPN network, and you can also configure very granular Access Control (ACL) rules—the more devices you have, the more Tailscale’s strengths show up.
Most importantly, even on the free plan, your traffic doesn’t have to “go through Tailscale servers” in the typical sense, so there aren’t practical bandwidth or data-cap limitations. For hobbies or light work, it’s basically enough to cover everything. And if you ever reach the point where you’re managing lots of servers seriously, you can just move to a paid plan.
Of course, Tailscale hasn’t been free of security issues in the past. But unless someone compromises the Google account you use for login or steals a device that has Tailscale installed, the risk doesn’t feel significant for the average user. And you can harden security even more by using ACL rules—for example, only allowing access to a specific server from a specific source device.
At this point, I can tie together all of my PCs, Macs, tablets, and phones with Tailscale. And if you have a personal server that’s always on, you might not even need to subscribe to many cloud services. It’s like having a file server permanently connected to your “home network,” no matter where you are.
I haven’t tried this fully yet, but if you have a server PC, you could host open-source alternatives to many tools and SaaS products yourself. Since you can access them via the web from mobile devices or tablets, you might be able to avoid paying subscription fees altogether.
When I have time, I want to write another post: “Replacing paid SaaS with Tailscale.”
Related posts
The Future of Vibe Coding, as I See It
May 6, 2026
Vibe coding makes it seem as if anyone can build software now, but beneath that promise lie new constraints: token costs, platform moderation, market concentration, and relentless quality competition. This essay looks at the future of vibe coding from both optimistic and skeptical angles, and argues that what we really need is not a fantasy of easy money but the ability to adapt to the AI era.
talkie: The Language Model Frozen in 1930
May 1, 2026
An experiment in conversing with talkie, a language model trained only on texts written before 1930. From lunar travel and Korean independence to predictions about 2026, it is a fascinating record where the biases and insights of a century-old worldview collide.
Labor song recommendation channel - An era where anyone can create, yet some are still chosen.
Feb 27, 2026
With AI-composed concentration music overflowing in YouTube work playlists, a sense of 'familiar yet unappealing' fatigue has emerged. As this happens, channels that create song selections and videos manually become even rarer. Even in an era where anyone can create, there is a clear reason why certain content gets chosen.