Skip to content

Tailscale

Jump to bottom
DJBenson edited this page Jun 9, 2026 · 4 revisions

What is Tailscale?

Tailscale is a virtual private network (VPN) tool that connects your devices together over the internet as if they were all on the same local network. Once set up, any device running Tailscale can reach any other device on your Tailscale network (called a tailnet) directly and securely - regardless of where in the world it is.

How it works

Tailscale builds an encrypted peer-to-peer connection between your devices using a technology called WireGuard. Unlike traditional VPNs, traffic travels directly between devices rather than through a central server, which keeps speeds fast and latency low.

Tailscale handles all the complex networking automatically - there is no need to configure port forwarding, open firewall rules, or manage certificates.

What you can use it for

  • Accessing your home server, NAS, or Home Assistant remotely as if you were on your home network
  • Securely connecting to self-hosted services without exposing them to the public internet
  • Linking devices across multiple sites into a single private network

Setting up an account

  1. Go to tailscale.com and click Get started.

  2. Choose how you want to sign in — Tailscale does not use a separate username and password. Instead, you sign in using an existing account such as Google, Microsoft, GitHub, or Apple.

  3. Follow the prompts to authorise Tailscale to use your chosen account. You will be taken to the Tailscale admin console at login.tailscale.com/admin.

  4. Your tailnet is now created and ready to use. The admin console is where you manage all connected devices, users, and settings.

Installing the client

Windows

  1. Download the installer from tailscale.com/download.
  2. Run the .exe file and follow the installation wizard.
  3. Once installed, click the Tailscale icon in the system tray and select Log in.
  4. A browser window will open — sign in with the same account you used to create your tailnet.
  5. The device will appear in your admin console once connected.

macOS

  1. Download Tailscale from the Mac App Store or from tailscale.com/download.
  2. Open the app and click Log in.
  3. A browser window will open — sign in with your tailnet account.
  4. The device will appear in your admin console once connected.

Linux

  1. Run the following command in a terminal:
   curl -fsSL https://tailscale.com/install.sh | sh
  1. Once installed, start and connect Tailscale:
   sudo tailscale up
  1. A URL will be displayed in the terminal — open it in a browser and sign in with your tailnet account.
  2. The device will appear in your admin console once connected.

Advertising a subnet route

If you want other devices on your tailnet to access a local network (for example 192.168.100.0/24) through a device, that device needs to be configured as a subnet router.

Windows

  1. Open a PowerShell window as Administrator.
  2. Run the following command, replacing the subnet with your own if different:
   tailscale up --advertise-routes=192.168.100.0/24
  1. You will also need to enable IP routing in Windows. In the same PowerShell window run:
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "IPEnableRouter" -Value 1
  1. Restart the device for the routing change to take effect.
  2. Approve the route in the admin console — see Authorising a subnet route.

macOS

  1. Open a Terminal window.
  2. Run the following command, replacing the subnet with your own if different:
   sudo tailscale up --advertise-routes=192.168.100.0/24
  1. You may be prompted for your macOS password.
  2. Approve the route in the admin console — see Authorising a subnet route.

Linux

  1. Run the following command, replacing the subnet with your own if different:
   sudo tailscale up --advertise-routes=192.168.100.0/24
  1. Enable IP forwarding for routing to work:
   echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
   sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
  1. Approve the route in the admin console — see Authorising a subnet route.

Authorising a subnet route in the admin console

Advertised routes must be approved before other devices can use them.

  1. Go to the admin console at login.tailscale.com/admin/machines.
  2. Find the device that is advertising the route and click the three-dot menu (⋯) next to it.
  3. Select Edit route settings.
  4. Under Subnet routes, toggle on the route you want to approve (e.g. 192.168.100.0/24).
  5. Click Save. Devices on your tailnet can now reach that subnet.

Generating an auth key

Some devices or applications (such as servers, containers, or home automation systems) cannot open a browser to complete sign-in interactively. An auth key lets them authenticate automatically on first connection.

  1. In the admin console, go to Settings → Keys or visit login.tailscale.com/admin/settings/keys.
  2. Click Generate auth key.
  3. Configure the key options:
    • Reusable — leave this off if the key is for a single device; turn it on only if multiple devices will use the same key.
    • Expiry — set how long the key remains valid for authentication (not how long the device stays connected).
    • Ephemeral — enable this for temporary devices (such as containers) that should be removed from your tailnet automatically when they disconnect.
    • Tags — optionally assign a tag to devices that connect using this key, useful for applying access policies.
  4. Click Generate key and copy the key — it will only be shown once.
  5. Paste the key into the application or device when prompted during its initial setup. The device will connect to your tailnet without requiring a browser sign-in.

Keep auth keys secure. Treat them like a password — anyone with the key can add a device to your tailnet.

GivLocal Configuration

Once Tailscale is installed, open GivLocal, turn on the Use Tailscale option and paste your auth key into the box provided then tap on "Connect" button. The app will register with Tailscale then connect to your tailnet. Only traffic from the app will be routed over the tailnet so the rest of your phone traffic will not be impacted.

Once enabled, Tailscale should connect automatically when the app is launched, giving you full remote access outside of your network (you can leave it enabled permanently, it will work fine both inside and outside of your network over Tailscale).

<-- Insert Screenshot(s) -->

Clone this wiki locally