Free tools Windows power users keep installed
One-click scans. No signup required.
I added Tailscale to my VPS so I could reach it from authorized devices without making SSH access depend on a fixed public IP address. The idea is to connect the VPS and my client device to the same tailnet, then SSH to the server by its Tailscale IP address or MagicDNS hostname. This is private access to the VPS—not a way to route all my internet traffic through it.
Why use Tailscale for VPS access?
A conventional remote-SSH setup may rely on the server being reachable from the internet and on firewall rules that permit connections from a known source address. If the address I connect from changes, those rules can become inconvenient to maintain. Tailscale offers another path: participating devices connect over a private tailnet, so I can target the VPS by its tailnet address or name rather than relying on my current public source IP.
As an Amazon Associate I earn from qualifying purchases.
Tailscale’s server guidance covers remote access to servers, including SSH. The VPS remains a VPS supplied by its hosting provider; adding Tailscale does not itself provide hosting or mean the server has stopped having a public IP address.
Recommended Free Tools
How the connection works
- Install Tailscale on the VPS. Follow the instructions for the VPS operating system and add the server to the intended tailnet. Tailscale documents an AWS Linux VM example in its quick guides; that example is not evidence that every VPS uses AWS or the same installation steps.
- Install and authenticate a trusted client. Add the computer or other device from which you intend to administer the VPS to that same tailnet.
- Choose the SSH path and target. Connect to the server using its Tailscale IP address or MagicDNS hostname, as described in Tailscale’s SSH documentation. Confirm that the selected authentication and access-policy setup permits your user and device to connect.
Choose how SSH is authenticated
Tailscale SSH
Tailscale SSH lets tailnet identity and policy govern SSH authentication and authorization. Tailscale describes it this way: “Tailscale SSH lets Tailscale manage the authentication and authorization of SSH connections in your tailnet.” This is a distinct choice from merely using a Tailscale address to reach a conventional SSH server; check the SSH setup guidance for the prerequisites and policy rules that apply to your environment.
#1 Best Overall
Conventional SSH over a Tailscale address
You can also use ordinary SSH to connect to the VPS over its Tailscale address. In that arrangement, SSH still uses its conventional authentication configuration; Tailscale provides the private network path, while your SSH server and credentials continue to govern login. The method you choose affects which service and policy settings you need to maintain.
Check the tailnet policy before relying on it
Being on the same tailnet should not be treated as proof that access is appropriately restricted. Tailscale’s ACL documentation states: “If you don’t define any access control policies, Tailscale applies the default allow all ACL policy.” When ACLs are configured, they are deny-by-default; the absence of an acls section is different and results in default allow-all.
Review the actual policy for the tailnet and make sure it grants only the intended devices and users the access they need. Tailscale recommends grants for new policy configuration, while continuing to support ACLs. Its AWS Linux VM guide also shows an access grant for TCP port 22; treat that as an example, not a universal policy. See Tailscale’s ACL documentation and adapt the policy to the server and SSH method you actually use.
Private VPS access does not route all browsing through it
Adding the VPS to a tailnet lets participating devices reach one another; it does not, by itself, send ordinary public internet traffic through the VPS. If you want a device’s internet traffic to exit through a tailnet machine, that is a separate exit-node configuration. Tailscale documents this distinction in its exit-node guide.
Rank #3
- HP MicroServer Gen10 Plus Tower Server for Business with Microsoft Windows Server 2019 OS!
- Intel Xeon E-2224 Quad-Core 3.4GHz 8MB CPU, Up To 4.6GHz Turbo
- 32GB (2 x 16GB) DDR4 PC4-21300 2666MHz Unbuffered Memory
- 16TB (4 x 4TB) 7.2K 6Gb/s SATA 3.5" HDDs in RAID
- Hard drives and memory upgrades included separately NOT installed, installation required.
For VPS administration alone, the relevant goal is access to the server from authorized tailnet devices. Configure an exit node only if routing broader internet traffic through a tailnet device is also an intended use.
Quick Recap
Best Value
Rank #4
What to plan for before changing access
- Policy: Verify the tailnet’s effective access rules, especially whether an
aclssection exists and what it permits. - SSH configuration: Decide between Tailscale SSH and conventional SSH over the tailnet, then follow the prerequisites for that method.
- Recovery: Keep an administrative route available while setting up and validating tailnet access. Do not remove an existing access path until you have confirmed that the new one works and you know how to recover if your client or policy changes.
- Firewall exposure: Review the VPS firewall and SSH exposure for your actual setup. Tailscale access can provide a private route, but the documentation cited here does not establish that every host should use the same public firewall rules.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
