Choose when Tailscale fits

Tailscale is excellent for private device and service connectivity, but it is not the answer to every networking problem.

After this course you will be tempted to route everything through the tailnet. Resist that. The tool earned your trust for one class of problems. Keep it there.

Where it wins

Choose it when identity-aware private networking, NAT traversal, stable names, and managed policy remove meaningful work.

The pattern: a defined set of people and machines that need to reach each other privately, across networks you do not control. SSH to servers, internal dashboards, databases behind subnet routers, a home lab reachable from anywhere. One policy file, no port forwarding, names that survive reboots and moves.

Where something else wins

Choose plain WireGuard when you need minimal self-managed peers. Two static servers with fixed public IPs do not need a coordination plane. A short WireGuard config connects them with zero external dependencies. You give up NAT traversal, key distribution, and policy management, and with two stable peers there is little to give up.

Use public HTTPS for public users. Customers will not install a VPN client to reach your product. If the audience is “anyone”, the answer is a normal public deployment with TLS, not Funnel as a production strategy.

And keep application authentication even when the network is private. The tailnet decides which machines may talk. It does not know which humans should see which records. A database that trusts every tailnet connection has an authorization model exactly one stolen laptop wide.

The review exercise

Review three systems you use. For each, choose public Internet, Tailscale node access, subnet routing, exit-node routing, or another design, and name the trust tradeoff.

Naming the tradeoff is the real test. “Tailscale node access: I trust the tailnet’s device list and my grants instead of a public firewall” is a decision. “Tailscale because it’s what we use” is a habit. Write the sentence for each system, and keep it where the next person will find it.