Skip to content

tailscale-server.md

Latest commit

 

History

History
148 lines (104 loc) · 2.96 KB

tailscale-server.md

File metadata and controls

148 lines (104 loc) · 2.96 KB

Tailscale Server Setup

Setup Tailscale on your server to join the tailnet.

Docs: https://tailscale.com/kb/1031/install-linux

1. Create Tailscale Account

  1. Go to tailscale.com and sign up
  2. Note your tailnet name (e.g., tail123456) from the admin console

Tip

Change tailnet name now if needed!

Go to Settings → General and update your Tailnet name before proceeding.

Changing it later is complicated — it affects:

  • All machine hostnames (*.ts.net)
  • DNS records
  • Kubernetes ingress configurations
  • Saved bookmarks and scripts

2. Install Tailscale (Linux)

SSH to your server (via local network or provider console):

curl -fsSL https://tailscale.com/install.sh | sh

3. Connect to Tailnet

sudo tailscale up

Follow the link to authenticate with your Tailscale account.

4. Verify

tailscale status

Your server is now part of your tailnet.

Optional: Tailscale SSH

Tailscale SSH allows secure SSH access without exposing port 22 to the internet.

Docs: https://tailscale.com/kb/1193/tailscale-ssh

Add SSH Policy to ACL

Open ACL Editor and add:

{
  "tagOwners": {
    "tag:server": ["autogroup:admin"]
  },

  "ssh": [
    {
      "action": "check",
      "src": ["autogroup:admin"],
      "dst": ["tag:server"],
      "users": ["autogroup:nonroot", "root"]
    }
  ]
}
Parameter Value Purpose
action check Browser prompt to confirm SSH session
src autogroup:admin Only admins can SSH
dst tag:server Only devices with tag:server
users nonroot, root Can login as ubuntu or root

Enable SSH on Server

sudo tailscale up --ssh --advertise-tags=tag:server

Install Tailscale on Your Machine

  • macOS: brew install tailscale or download
  • Windows: download
  • Linux: curl -fsSL https://tailscale.com/install.sh | sh

Connect to your tailnet:

tailscale up

Connect to Server

Find your server's Tailscale hostname in admin console.

ssh user@<server-tailscale-hostname>
# or using Tailscale IP
ssh user@100.x.x.x

Benefits

  • No exposed SSH port (22) to internet
  • No SSH key management needed
  • Access from anywhere via Tailscale
  • Automatic encryption via WireGuard

Troubleshooting

Cannot connect via SSH

  1. Check both machines are in same tailnet:

    tailscale status

  2. Check Tailscale SSH is enabled on server:

    tailscale status --self
# Should show: offers: ssh

  3. Re-enable SSH:

    sudo tailscale up --ssh

Connection refused

Check Tailscale is running:

sudo systemctl status tailscaled