Understand the problem Tailscale solves

A traditional VPN sends every client through one gateway. Before two of your private devices can talk, you have to set up that gateway, expose it to the Internet, patch it, and keep it running.

That gateway is a single point of failure. It is also a public attack surface, because it must accept connections from anywhere. And it bends your traffic in strange ways: two laptops in the same city may talk through a datacenter on another continent. Every new device means another certificate, another routing rule, another firewall change.

Why private connectivity is hard

Most of your devices sit behind NAT, the router trick that lets many devices share one public address. Your laptop has a private address on your home Wi-Fi. Your server may sit behind a cloud firewall. Neither can accept an inbound connection unless you forward ports or expose the service publicly.

The classic workaround is to open SSH to the world and hope for the best:

# expose SSH publicly and hope the firewall rules hold
ssh [email protected] -p 22022

You changed the port. You added fail2ban. Maybe you restricted source IPs. You are still running a public service, and you have to keep protecting it forever.

What Tailscale changes

Tailscale builds an identity-aware overlay network called a tailnet. Devices keep their existing Internet connections. On top of those, they get Tailscale addresses and policies for private communication. You do not open an inbound port on every laptop, and you do not push all traffic through one central server.

Each device authenticates with your identity provider, gets a stable private address, and builds encrypted WireGuard tunnels directly to the peers it needs. The same SSH connection becomes:

ssh flavio@lab-server
# no public port, no port forwarding, no central gateway

The server’s public firewall can drop every inbound packet and this still works. Both sides connect outward, and Tailscale helps them meet in the middle.

I want you to see the shape of the problem before we install anything. Take a piece of paper and draw your laptop, one server, and their ordinary Internet paths. Then draw the private path you want between them. Mark which public ports you would need to expose to get it the old way.

If your answer is “SSH on the server, and maybe a web dashboard”, you found exactly what a tailnet removes from the public Internet. That is the whole promise of this course.