Choose when Tailscale fits

Tailscale is excellent for private device and service connectivity. It is not the answer to every networking problem, and after this course you will be tempted to treat it that way.

Resist that. The tool earned your trust for one class of problems. Keep it there.

Where it wins

Choose Tailscale when identity-aware private networking, NAT traversal, stable names, and managed policy remove real work from your plate.

The pattern looks like this: a defined set of people and machines that need to reach each other privately, across networks you do not control. SSH to servers. Internal dashboards. Databases behind subnet routers. A home lab reachable from anywhere. One policy file, no port forwarding, names that survive reboots and moves.

If that describes your problem, use it and stop thinking about networking.

Where something else wins

Choose plain WireGuard when you have a handful of static peers and want zero external dependencies. Two servers with fixed public IPs do not need a coordination plane. A short WireGuard config connects them. You give up NAT traversal, key distribution, and policy management, and with two stable peers there is little to give up.

Use public HTTPS for public users. Customers will not install a VPN client to reach your product. If the audience is “anyone”, the answer is a normal public deployment with TLS, not Funnel as a production strategy. Funnel is for showing a demo to a friend, not for serving customers.

And keep application authentication even when the network is private. The tailnet decides which machines may talk. It does not know which humans should see which records. A database that trusts every tailnet connection has an authorization model exactly one stolen laptop wide.

The review exercise

Pick three systems you use today. For each, choose one design: public Internet, Tailscale node access, subnet routing, exit-node routing, or something else. Then name the trust tradeoff in one sentence.

Naming the tradeoff is the real test. “Tailscale node access: I trust the tailnet’s device list and my grants instead of a public firewall” is a decision. “Tailscale because it’s what we use” is a habit.

Write the sentence for each system and keep it where the next person will find it, in the README or next to the policy file. A year from now, when someone asks why the staging database is only reachable through a subnet router, the answer will be right there.