How to Set Up Tailscale on Three Devices in Ten Minutes

October 25, 2026

Tailscale creates a private mesh network over WireGuard between your devices, with automatic NAT traversal so it usually works without opening any router ports. Install the client, sign in with the same identity on each machine, and the devices can reach each other by a stable 100.x.y.z address. The free plan covers 3 users and 100 devices.

Ten minutes is realistic for three devices. Most of that is authenticating on the phone.

What do you install, per platform?

Linux uses a package plus one command:

curl -fsSL https://tailscale.com/install.sh | sh
tailscale up --ssh

macOS has two options: the App Store build (sandboxed, fine for most) and the standalone build (needed if you want the CLI to manage the network extension). The App Store version cannot run tailscale up --ssh in the same way, which trips up people following Linux tutorials.

Windows installs a service and a tray app. Phones use the store apps and a single tap to connect.

How do you verify the mesh, step by step?

Sign in on device one with the same identity provider — Google, GitHub, Microsoft or SSO.
Confirm it joins the tailnet with tailscale status. You should see your own node.
Install on device two and sign in with the same account. It joins automatically; no approval needed by default.
Ping by hostname, not IP. tailscale ping laptop confirms the path; tailscale ping shows whether it is direct or relayed through DERP.
If it says “via DERP”, check UDP 41641. Symmetric NAT and some corporate firewalls block direct connections, so traffic routes through a relay — slower but functional.
Enable MagicDNS in the admin console. After that you can use laptop.tailnet-name.ts.net instead of IPs.
Turn on tailnet lock once the devices are stable, so a stolen auth key cannot silently add a node.

What is the ACL decision people skip?

Default Tailscale allows every device to reach every other device. For two personal devices that is fine. For a team, it is not.

Before adding the second person, write an ACL. The default policy file has a single rule granting * to *. Replace it with group-based rules:

"acls": [
  {"action": "accept", "src": ["group:eng"], "dst": ["group:eng:*"]},
  {"action": "accept", "src": ["group:eng"], "dst": ["tag:db:5432"]}
]

Without this, a contractor’s laptop can reach your NAS.

What does it cost?

Plan	Price	Users	Devices
Free (Personal)	$0	3	100
Starter	$6/user/mo	3+	100
Premium	$18/user/mo	Unlimited	Unlimited

The free tier is unusually generous and genuinely fits a solo developer with a home server, phone, and laptop. The 3-user cap is the only hard wall.

What is Tailscale not good at?

It is not a VPN for hiding your IP. Exit nodes exist but that is not the product’s purpose and throughput is modest.

It is also not a replacement for a reverse proxy when you want to expose a service publicly. Tailscale Funnel can do it, but the domain is *.ts.net, which is not what you want for a customer-facing app.

For remote access to a home lab or a database on a VPS, Tailscale is the fewest-moving-parts option available.

Key Takeaways

Tailscale builds a WireGuard mesh with no port forwarding, using a 100.x address space.
Free plan: 3 users, 100 devices — enough for a solo developer.
“Via DERP” means relayed, not direct; check UDP 41641 if that happens.
Default ACLs allow every device to reach every device — write rules before adding people.
MagicDNS lets you use hostnames instead of IP addresses.

Tags:

Tailscale