Tailscale Freemium

Tailscale, founded in 2019 and headquartered in Toronto, implements a mesh overlay network. You install a client on each device, sign in with Google, GitHub, Microsoft or Okta, and every device gets a stable 100.x.x.x address inside your tailnet. Devices talk directly to each other using WireGuard tunnels, with Tailscale’s coordination server (free tier) handling key exchange and NAT traversal.

The consequence: there is no central gateway that all traffic funnels through, so a 4K stream from your home NAS to your phone does not round-trip through a data centre. Tailscale only brokers the handshake. When a direct path fails, it falls back to DERP relays, which are slower and slower still for large transfers.

Tailscale product features

• WireGuard mesh. Direct device-to-device tunnels with automatic NAT traversal; DERP relays only as a fallback.
• ACL policy file. A JSON policy defines who can reach which tag. Defaults are broad, so write the ACL before you add the second user.
• Taildrop. Send files between your own devices without a cloud round-trip — handy for moving a 20GB dataset to a GPU box.
• MagicDNS. Every device gets a hostname like gpu-01.tailnet-name.ts.net so you stop memorising IPs.
• Subnet routers and exit nodes. Advertise a whole LAN behind one node, or route all internet traffic through one machine.
• SSH, Serve and Funnel. Built-in SSH with ACL enforcement, plus Serve/Funnel to expose a local port to your tailnet or the public internet.

Product highlights

Pricing: Personal is free (3 users, 100 devices, 3 subnet routers). Personal Plus is about $5/month per user. Business starts near $6/user/month annual with audit logs and SCIM. Enterprise adds annual billing, support SLAs and unlimited subnets.

The reason it keeps appearing in AI infrastructure discussions: self-hosted models. Run Ollama or vLLM on a home GPU box, install Tailscale there, and every laptop on your tailnet reaches http://gpu-01:11434 as if it were local. No tunneling through a public IP, no exposing the API to the internet where it gets scanned within hours. Tailscale funded a small ecosystem of agent networking tooling in 2025-2026 precisely because of this pattern.

Tailscale also runs legitimately on AWS, GCP and Azure VMs to stitch multi-cloud private networks together without VPC peering tickets.

What can you use Tailscale for?

1. Reaching a self-hosted LLM. Point clients at the GPU machine’s tailnet hostname instead of exposing an API port.
2. Remote access to a home lab. NAS, Proxmox, Pi-hole and a security camera server without opening router ports.
3. Multi-cloud private networking. AWS and GCP instances talking over 100.x addresses instead of public endpoints.
4. Remote developer access. SSH into staging boxes from a laptop in a café, gated by ACL instead of a shared key.
5. Demo access for clients. Funnel a local app to a temporary public URL without deploying it.

Where Tailscale gets awkward

Corporate networks sometimes block UDP entirely, forcing DERP relay traffic that throttles bulk transfers to a few hundred KB/s. Tailscale diagnoses this (the tailscale netcheck output shows which endpoints fail), but it cannot fix a hostile firewall.

The ACL language is expressive and easy to get wrong. A permissive policy like “allow everything within the tailnet” means a compromised personal laptop can reach the production database. Add tags and split ACLs from day one, not after the incident. And note that Tailscale is not a privacy VPN — the coordination server sees your device metadata, which is fine for teams and less fine if you wanted anonymity.

Quick Summary

• Tailscale is a WireGuard-based mesh VPN from a Toronto company founded in 2019; devices connect directly, not through a central gateway.
• The free Personal plan covers 3 users and 100 devices; Business is around $6/user/month annually.
• Very commonly used to expose self-hosted LLM APIs (Ollama, vLLM) privately instead of opening a public port.
• Main pitfalls: UDP-hostile firewalls force slow relays, and default ACLs are too permissive for production.

Tailscale is a mesh VPN built on WireGuard that puts your laptops, servers, containers and phones on one flat private network. No port forwarding, no IP tables, no hub-and-spoke appliance. Identity is your existing SSO login. It is free for up to 3 users and 100 devices.

What is Tailscale?

Tailscale, founded in 2019 and headquartered in Toronto, implements a mesh overlay network. You install a client on each device, sign in with Google, GitHub, Microsoft or Okta, and every device gets a stable 100.x.x.x address inside your tailnet. Devices talk directly to each other using WireGuard tunnels, with Tailscale’s coordination server (free tier) handling key exchange and NAT traversal.

The consequence: there is no central gateway that all traffic funnels through, so a 4K stream from your home NAS to your phone does not round-trip through a data centre. Tailscale only brokers the handshake. When a direct path fails, it falls back to DERP relays, which are slower and slower still for large transfers.

Tailscale product features

• WireGuard mesh. Direct device-to-device tunnels with automatic NAT traversal; DERP relays only as a fallback.
• ACL policy file. A JSON policy defines who can reach which tag. Defaults are broad, so write the ACL before you add the second user.
• Taildrop. Send files between your own devices without a cloud round-trip — handy for moving a 20GB dataset to a GPU box.
• MagicDNS. Every device gets a hostname like gpu-01.tailnet-name.ts.net so you stop memorising IPs.
• Subnet routers and exit nodes. Advertise a whole LAN behind one node, or route all internet traffic through one machine.
• SSH, Serve and Funnel. Built-in SSH with ACL enforcement, plus Serve/Funnel to expose a local port to your tailnet or the public internet.

Product highlights

Pricing: Personal is free (3 users, 100 devices, 3 subnet routers). Personal Plus is about $5/month per user. Business starts near $6/user/month annual with audit logs and SCIM. Enterprise adds annual billing, support SLAs and unlimited subnets.

The reason it keeps appearing in AI infrastructure discussions: self-hosted models. Run Ollama or vLLM on a home GPU box, install Tailscale there, and every laptop on your tailnet reaches http://gpu-01:11434 as if it were local. No tunneling through a public IP, no exposing the API to the internet where it gets scanned within hours. Tailscale funded a small ecosystem of agent networking tooling in 2025-2026 precisely because of this pattern.

Tailscale also runs legitimately on AWS, GCP and Azure VMs to stitch multi-cloud private networks together without VPC peering tickets.

What can you use Tailscale for?

1. Reaching a self-hosted LLM. Point clients at the GPU machine’s tailnet hostname instead of exposing an API port.
2. Remote access to a home lab. NAS, Proxmox, Pi-hole and a security camera server without opening router ports.
3. Multi-cloud private networking. AWS and GCP instances talking over 100.x addresses instead of public endpoints.
4. Remote developer access. SSH into staging boxes from a laptop in a café, gated by ACL instead of a shared key.
5. Demo access for clients. Funnel a local app to a temporary public URL without deploying it.

Where Tailscale gets awkward

Corporate networks sometimes block UDP entirely, forcing DERP relay traffic that throttles bulk transfers to a few hundred KB/s. Tailscale diagnoses this (the tailscale netcheck output shows which endpoints fail), but it cannot fix a hostile firewall.

The ACL language is expressive and easy to get wrong. A permissive policy like “allow everything within the tailnet” means a compromised personal laptop can reach the production database. Add tags and split ACLs from day one, not after the incident. And note that Tailscale is not a privacy VPN — the coordination server sees your device metadata, which is fine for teams and less fine if you wanted anonymity.

Quick Summary

• Tailscale is a WireGuard-based mesh VPN from a Toronto company founded in 2019; devices connect directly, not through a central gateway.
• The free Personal plan covers 3 users and 100 devices; Business is around $6/user/month annually.
• Very commonly used to expose self-hosted LLM APIs (Ollama, vLLM) privately instead of opening a public port.
• Main pitfalls: UDP-hostile firewalls force slow relays, and default ACLs are too permissive for production.