3 quick tips to get the most out of Tailscale
Here are just a few things you can try today to make your Tailscale network a bit more robust.
Tailscale touts itself as an affordable, zero-config virtual private network (VPN) that easily connects all of your devices from anywhere in the world. Without going into the nitty-gritty of how it works, Tailscale is built on WireGuard, and it uses a centralized server to make the initial introduction between all of your devices.
I've been using Tailscale for some time now. I first tried it out because I wanted an easy and secure way to access my home media server from anywhere in the world, and I heard Tailscale was a fairly pain-free way to do this.
Not only is that true, but I've actually loved using Tailscale, and I will never go back to using reverse proxies and port forwarding into my local network again. That being said, there are a few things you can do to make your Tailscale experience quite a bit better, and I've compiled a list of three which I believe just might do the trick.
Use an exit node
One of the simplest things you can do to get more out of Tailscale is to configure and use an exit node.
By default, Tailscale simply acts as an overlay network which routes traffic between connected devices. That means Tailscale doesn't touch the public internet out of the box.
Exit nodes are what make Tailscale act more akin to a traditional consumer ready VPN. Once configured, you can route the public traffic from any of the devices on your Tailnet—the name of the network through which your Tailscale devices connect—through an exit node of your choice. This is particularly useful when accessing public Wi-Fi or traveling overseas.
Exit nodes encrypt outbound internet traffic, offering more security and potentially lifting unnecessary geo-restrictions. In short, it's similar to using your own personal version of Mullvad, Proton VPN, etc., but you're in control of the servers.
Get a GUI on Linux with Trayscale or KTailctl
If you're a Linux Tailscale user, and the CLI tool leaves a bit to be desired, then you're in luck. Thanks to the apps Trayscale and KTailctl, there's a solution for you.
If you're a GTK user and want to stay in that ecosystem, Trayscale is your best bet. Are you on KDE instead and prefer QT applications? You've got KTailctl.
No matter which you choose, both applications are available on Flathub, and both provide similar solutions to the same problem: allowing users to interact with Tailscale on a Linux box using a GUI.
I've personally been using Trayscale for a while now since I'm on GNOME. But, thanks to the brief time I tested KTailctl, I can confidently say either would be a solid choice. Check them both out on Flathub in the links below.
Check out Trayscale on Flathub
Perform HTTPS magic with MagicDNS
All traffic on your Tailnet is encrypted. That means only you can see what's going on between your Tailscale connected devices. But, since by default the connections are all made using HTTP instead of HTTPS, your browsers don't know that.
That means every time you try connecting to one of the devices on your Tailnet, you're likely to get one of those nasty “this site isn't safe” warnings. And though this isn't true, it's still annoying, and that's where MagicDNS comes in.
Once configured on your Tailscale account, MagicDNS can automatically create a DNS entry for each one of your devices based on their device names. It can do this because each devices runs its own DNS server which is built into the Tailscale client. Then, like magic, navigating to each of your devices is as easy as accessing http://[device name] in your browser, and you're off to the races.
Once MagicDNS is enabled, you can also go ahead and allow yourself to provision HTTPS certificates for each one of your devices. Once enabled, you can further protect all of your Tailnet traffic with HTTPS URLs thanks to TLS certificates from a public Certificate Authority (CA).
Just keep in mind that if you set this up, all of your TLS certificates will be recorded in the Certificate Transparency (CT) append-only public ledger, which is a public data set that anyone can access for verification purposes. For most people this won't be a problem, but I figured it was worth mentioning.
I personally heavily use NextDNS, and I ran into a few snags when trying to configure both it and MagicDNS, so admittedly this solution isn't for me. I also don't mind the browser popup when I navigate my Tailscale devices because I know my Tailnet is secure.
But, if you don't run into the same issues as I did, you find the warnings cumbersome, or you just want to make your Tailnet a more polished and seamless experience, MagicDNS and HTTPS certificates might be just what you are looking for. All settings are found in the DNS tab of your admin console, and Tailscale's documentation regarding this is truly top-tier.
Conclusion
Like I mentioned at the beginning, I genuinely love Tailscale. It has made managing my home server, performing backups, and sharing files much easier and and more secure than ever before. I can't image my digital life without it anymore.
Plus, Tailscale is entirely free for up to 100 devices. That means there's almost no reason you shouldn't at least give it a try. And even though there are still many more tips and tricks to optimize your Tailnet, I hope you found at least one of these useful.
Are you an existing Tailscale user? Think I missed something crucial? Let me know what other Tailscale power-user tips you have in the comments below, and maybe I'll write up another blog post based on the feedback I receive.
Tags: #Apps #Tutorials Comments: Discuss...