Tailscale: no port open to the internet

Three jobs on the router, all by hand

The traditional fix meant the router itself: port forwarding so a public port reaches the machine, a DDNS service binding a hostname to today's IP or a static IP from your ISP, then firewall rules kept straight by hand.

Get one step wrong and you cannot get in, or you have exposed your whole home network. Get them all right and a door still faces the internet.

Why does port forwarding plus a dynamic IP keep breaking?

Four parts have to hold at the same time, and any one of them gives way at an inconvenient moment.

• The address changes. Your ISP reassigns it, and a DDNS client needs a few minutes to catch up. For a window after every change, nothing you saved points at home. If that update fails while you are away, the hostname belongs to somebody else.
• Sometimes the address is not yours. Behind carrier-grade NAT your router holds an address inside the ISP's own network, so no forward can work.
• One forward is one more door into a network shared with a smart TV and an old camera.
• It has to stay right forever. A firmware update resets the rules; a new router means rebuilding them.

The worst part is the debugging. You are on mobile data, trying to fix a home router from your phone, and the machine you want is unreachable.

What Tailscale does

Tailscale is a WireGuard mesh. Install it on each device, sign in to the same account, and the devices build an encrypted link straight between themselves. The setup opens no public entry point and leaves no port on the internet for a bot to scan.

Each device makes a WireGuard key pair, and the private half never leaves the device. The public halves are exchanged, and the tunnels are built from them. The account is bookkeeping: it introduces devices, tracks where each is reachable, and hands out private addresses the public internet does not route to.

MagicDNS gives each device a name you can remember and resolves it for you, so NAT, an address that changed overnight, and the switch from home Wi-Fi to mobile data all stay out of sight.

Why the mesh works when your phone has no address

Mobile data makes it worse. Your phone has no public address either: on 4G and 5G it sits behind carrier-grade NAT, sharing one outward address with many other subscribers. A design that depends on incoming connections fails at both ends.

A mesh works the other way round: both sides only have to send packets outward. The phone sends one, the machine sends one, each learns where the other appears to be, and the two attempt a direct path through their NATs. WireGuard supplies the encryption, and the mesh supplies the introductions. Where no direct path exists, traffic falls back to a relay and stays encrypted end to end.

A private address only your devices can reach

Your machine gains a private address. Only devices signed in to the same Tailscale account can see it or reach it. The scanning bots do not know it exists, because it never appeared on the public internet.

From here on, SSH goes to that address instead of a port 22 that gets knocked on all day.

Which address do you type?

The LAN address is the one to skip. Your machine holds three addresses at once, and only two of them are worth saving.

A LAN address identifies a local network, not your machine. Save the name, and the entry survives the machine changing Wi-Fi, changing IP, or moving flats. tailscale status prints both.

When SSH fails although both devices look connected, check the address first. Tailscale says connected, SSH still can't reach it covers that, including a signed-out machine.

What does the mesh cost you?

There are three costs, and you should know them before you are on a train.

One more program on the machine. It starts at boot, updates itself occasionally, and has its own bugs. That is one more thing to rule out before you blame SSH.

A control plane you need at the wrong moment. Traffic goes device to device, but the introductions do not. A new laptop, a replaced phone, or stale credentials are not on your network until they sign in. Fail that sign-in while you are out and the machine is fine but unreachable. Keep another way in.

A phone that has to stay connected. The tunnel is a VPN profile, and phones drop those: after a restart, when another VPN takes over, or when you dismiss the prompt. Check it before debugging anything else. It carries only traffic to your own addresses.

A private network still needs a key

A machine nobody can reach from the internet still needs a lock on the door, for two reasons.

The mesh's security is now your account's security: any device that signs in is inside, and inside means a device you already trusted. A laptop left in a taxi is inside the network you built, where every machine is reachable and nothing else checks it. A key means the machine still has to prove something.

The second reason is defence in depth. The mesh keeps strangers out; a key stops a stranger who is already inside from going further. Two independent things have to fail before anyone reaches your project. A password is one guessable thing, and a key is not. How keys do the proving covers the mechanics.

When you don't need Tailscale

If the machine and the phone are on the same Wi-Fi and always will be, skip this. The LAN address works, you install nothing, and you sign in to nothing. You lose it the moment you walk outside.

A hosted server changes the arithmetic. Its address does not move, there is no router of yours to configure, and a failed experiment cannot lock you out. The risk moves to port 22 facing the internet permanently. Some people still run the mesh there, to put SSH behind a private address; others keep it public and lean on keys. What is not workable: a password on an exposed port.

If you already reach the machine through a network someone else runs, a work VPN for example, take that path. Two overlapping tunnels make debugging worse without making the connection better. If you are not sure which case you are in, the setup page asks three questions and hands you a checklist.