What does Tailscale do?

Tailscale connects your devices into a private network, wherever they are. Your laptop, your phone and your server see each other as if they were in the same office. The connection is encrypted and usually runs directly from device to device. You do not have to open a port on your router or server for it.

Is Tailscale free to use?

For most business owners, yes. The Personal plan costs nothing and allows up to 6 users with unlimited personal devices. Teams pay 8 US dollars per user per month on the Standard plan and 18 US dollars on Premium. As of October 30, 2026, according to the Tailscale pricing page.

What is the difference between WireGuard and Tailscale?

WireGuard is the technology for the encrypted connection. Tailscale builds on it and handles the rest, distributing keys, finding devices and building connections through routers and firewalls. With WireGuard alone, you set up every device yourself and open a port on the server. With Tailscale, you just sign in.

Is Tailscale trustworthy?

The data between your devices is end-to-end encrypted. According to Tailscale's own description, its service only distributes keys and rules and does not pass on any readable data. If a direct connection does not work, the already encrypted data runs through Tailscale relay servers that cannot read it. If you want to host it yourself, you can use Headscale, a free reimplementation of the coordination service.

Can Tailscale hide my IP?

Not in normal use. Tailscale does not change how you browse the internet. Only if you set up a device as an exit node does all your traffic run through that device.

How do I turn off Tailscale?

On a Mac or phone, you switch off the connection in the Tailscale app. On a Linux server, the command sudo tailscale down disconnects it and sudo tailscale up connects it again. Be careful with a server you can only reach through Tailscale. If you disconnect it there, you lock yourself out.

What is the downside of using Tailscale?

You depend on an outside service. If your server is only reachable through Tailscale, you need an emergency exit. Without one, a disruption locks you out. Tailscale also does not replace security updates, backups and careful permissions on the server.

AI in practice

What Is Tailscale? How I Lock Down My Server Without Open Ports

By Artur Neumann. Updated October 30, 2026.

I run my business in Germany. Monetary examples use euros unless another currency is stated.

On October 21, 2026, I took the remote access to my server off the open internet. Since then, it no longer answers from outside. My website keeps running as usual. And I can still reach the server at any time, just like my AI agents. The tool behind this is called Tailscale.

In this article, I explain what Tailscale is, how I set it up and where its limits are.

What is Tailscale?

Tailscale connects your devices into a private network. Tailscale calls it a tailnet. Your laptop, your phone and your server see each other in it as if they were in the same office. The server can sit in a data center while you sit in a café.

Three things make Tailscale interesting for business owners:

Encrypted: Tailscale uses WireGuard, a modern technology for encrypted connections. The data is end-to-end encrypted.
Usually direct: Devices normally connect directly to each other. If that does not work, the already encrypted data runs through a Tailscale relay server that cannot read it.
No open port: You do not have to open anything on your router or your server for the connection. Tailscale builds the connection from the inside out.

According to its own description, the Tailscale service only distributes the keys and the rules about who may talk to whom. Your data itself does not run through it.

Why I use Tailscale

My server runs my website, my email system and several small programs. AI agents build and maintain most of them. I describe what I want, and Claude Code logs in to the server via SSH and does it. SSH is the encrypted remote access for administrators. How working with AI like this looks in practice is covered in my Claude Code Tutorial.

This remote access used to be open to the entire internet. It was well protected, and password logins were already switched off. Still, every open door is an attack surface. If you take building with AI seriously, you give AI agents access to real systems. That makes it all the more important that nobody else gets to that door.

How I set it up

Tailscale on Mac and iPhone: Install the app, sign in. Both devices are then part of the tailnet.
Tailscale on the server: On a Linux server, you install it with the official command curl -fsSL https://tailscale.com/install.sh | sh and connect it with sudo tailscale up. The command shows a link you use to add the server to your account.
Testing: I logged in via SSH using the new Tailscale address. Only once that worked reliably did I take the next step.
Closing the door: Since then, the remote access only accepts connections from the tailnet. In my hosting provider’s firewall, only the ports for the website are still open, plus the port Tailscale uses to build direct connections.
Writing down the emergency exit: If Tailscale fails, I reopen the access for a few minutes through my provider’s management console. That works without SSH and is written down as a ready-made guide in my notes.

I checked the result from outside: The remote access no longer answers, neither over IPv4 nor over IPv6. The website delivered the same pages before and after. Between my Mac and the server, the connection runs directly, not through a relay server.

In everyday work, I hardly notice anything. My AI agents connect using the same short name as before. Only on my iPhone do I have to switch on the Tailscale app before I connect to the server.

What Tailscale costs

Plan	Price	For whom
Personal	free	up to 6 users, unlimited personal devices
Standard	8 US dollars per user per month	teams
Premium	18 US dollars per user per month	teams with strict rules

As of October 30, 2026, according to the Tailscale pricing page. For a business owner with a laptop, a phone and one server, the free plan is enough.

Tailscale or WireGuard?

WireGuard is the technology underneath Tailscale. You can also use it on its own. Then you create the keys yourself, add every device by hand and open a port for WireGuard on the server. For a single connection into your home network, that is enough. Newer Fritzbox routers, which are common in Germany, even have WireGuard built in.

Tailscale takes this work off your hands. You simply sign in new devices, and Tailscale builds connections through routers and firewalls on its own. In return, you depend on an outside service. If you do not want that, you can run the coordination service yourself with Headscale. For me, the math was simple: Tailscale was set up in one evening, and the free plan covers my case.

The limits

Dependency: If your server is only reachable through Tailscale, you need an emergency exit. Without one, a disruption locks you out.
No replacement for updates: Tailscale closes one door. You still need security updates, backups and careful permissions on the server.
No hidden IP address: In normal use, Tailscale does not change how you browse the internet. Only if you set up a device as an exit, which Tailscale calls an exit node, does all your traffic run through it.
Not for visitors: Your website and your customers notice nothing. Tailscale only protects the access points meant for you and your tools.

If you work with AI agents on real systems, Tailscale is one of the simplest steps toward more security. Which other tools I use every day is listed in AI Tools for Solopreneurs.