Connect a Linux server

The second node is a disposable Ubuntu or Debian server. Before we start, one rule: keep your existing way in until the new private path is proven.

I want you to internalize that sentence. Never cut off the current access before the new one works. If your only access today is SSH over the public address, keep that session open through this whole lesson.

Install and authenticate

Use Tailscale’s official installer or the documented package repository, then bring the client up:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The server has no browser, so the command prints a URL for you to open somewhere else:

To authenticate, visit:

	https://login.tailscale.com/a/1b2c3d4e5f6a7

Open it from your laptop, approve the device, and the command on the server returns. The server now appears in the same tailnet.

Notice what did not happen. You did not open an inbound port on the server firewall. The client made an outbound connection to the coordination server and to your laptop. Nothing new is exposed to the public Internet.

Verify from both sides

On the server:

tailscale status

100.101.9.23   lab-server   flavio@   linux   -
100.87.12.44   flavio-mbp   flavio@   macOS   active; direct 93.44.120.15:41641

The laptop shows as active; direct, so the two devices already found a direct path. Check the admin console too: the server should be listed, owned by your user, and seen recently.

Now, from your laptop, test the private path while the old session stays open:

ssh [email protected]

If this connects, you have two independent paths to the machine. If routing or policy breaks something in a later lesson, the public session is your recovery path. That is why we never close it early.

One common surprise

A strict host firewall can block the new path. Tailscale traffic arrives on the tailscale0 interface. A ufw ruleset that only allows the public SSH port will reject SSH over the tailnet IP until you allow it on that interface:

sudo ufw allow in on tailscale0 to any port 22

If the SSH test hangs with no error message, check the firewall before you suspect Tailscale.