Switching to Tailscale

I’ve finally switched to Tailscale.

I mean that “finally”, because I put it off for a long time. Years ago I set up OpenVPN so I could reach my own home network while traveling, and as an extra layer of security whenever I was on a network I didn’t trust. It worked fine. The big advantage for me was that OpenVPN handles both UDP and TCP. Most hotels let very little through, but TCP on port 443 is almost always open, because that’s just https. That way I could get out anywhere.

Later I switched to WireGuard. Faster and simpler, with a configuration that looks more like exchanging SSH keys than the certificate hassle of OpenVPN. But WireGuard only speaks UDP, and that cost me exactly the advantage I’d started with OpenVPN for. On a restrictive network the tunnel simply wouldn’t come up.

And I ran both myself, with the upkeep that comes with it. Opening a port on my router, creating a config file for every new device and getting it to myself safely. My external IP changes now and then, so I run a Docker container of my own that keeps an eye on it and updates everything the moment it changes. It all works fine, only I built it myself and I have to keep it running myself.

Tailscale solved all of that. Which was exactly my problem with it. It seemed too good to be true. Call me cynical, call me skeptical, but when something sells itself that easily I start looking for where it goes wrong further down the line. So I held back and watched. I followed along and saw other people use it without trouble, while I waited for someone to find the catch.

The catch never came. Tailscale is WireGuard under the hood, with exactly the layer on top that I kept building myself. A coordination server introduces my devices to each other and passes the keys around, so I don’t have to open anything myself anymore. No more port on the router, and behind CGNAT it just works. With MagicDNS I reach a device by its name, instead of by an IP I won’t remember anyway. Adding a new device is logging in and done.

And that old hotel problem? When UDP is blocked, Tailscale falls back on its own relays over https. I haven’t seen the inside of many hotels these past few years, but wherever I end up, I get out. The same problem that once drove me to OpenVPN, that WireGuard then cost me, now solved again, this time without me having to do anything for it.

Something else I like is Tailscale SSH. Logging into a machine without managing keys yourself, with Tailscale handling access based on who you are within your own network. Exactly the kind of chore I used to lose time on.

I did go back and forth between Tailscale and NetBird. NetBird is built on the same idea, but it’s open source and you can run the whole thing yourself. For now I chose convenience, and that turned out to be Tailscale. So I run on their own coordination server. That means there’s an outside party sitting between my devices that I don’t control myself, and for someone who started out with “too good to be true” that’s not a minor detail. The traffic itself is encrypted and goes directly between my devices, but tying them together runs through them.

There’s also Headscale, an open-source version of Tailscale’s server that you run yourself. I’ll take a proper look at that once I’m convinced it’s worth enough to bring back the hassle I just got rid of.

For now it just does what it promises. I didn’t expect that, and it probably says more about me than about Tailscale.