Tailscale: your own private network in twenty minutes

BASIC

Tested for real: I ran this guide on a fresh Ubuntu 24.04 virtual machine (4 CPUs, 8 GB RAM) on 13 August 2026 — up to and including the login step, plus the full undo. Versions at test time: Tailscale 1.102.2, Ubuntu 24.04.4 LTS. My test rig has no browser and I do not create accounts from it. Everything after the login link is written from Tailscale's official documentation — the commands there are the vendor's own, clearly marked below.

Found a problem? Tell me via the contact page.

What you'll end up with

Your machines — server, laptop, phone — on one private network that follows them anywhere. Your laptop in a café can reach your server at home by name, encrypted end to end. No port opened on your router, no fixed addresses to memorise.

The moment the magic starts, from my real test run:

$ sudo tailscale up

To authenticate, visit:

	https://login.tailscale.com/a/dd28abd0139e3

One command, one link, and the machine is ready to join your network. That link appeared half a second after I pressed Enter.

Who this is for

BASIC. One path, copy-paste-safe, nothing to edit mid-line. If you have a fresh Ubuntu machine and a phone, you can do this.

Time and cost

The command part took my test machine about 1 minute (the install itself was 8 seconds). Budget 20 minutes end to end, including the browser sign-up and adding your phone. Cost: At test time, Tailscale documented a free personal plan; check current limits before relying on them.

Words you'll meet

• VPN (virtual private network) — a private, encrypted network laid on top of the ordinary internet. (basics)
• WireGuard — the modern, fast, heavily-audited encryption protocol underneath Tailscale. You never touch it directly; it is the engine, Tailscale is the car. (basics)
• Tailnet — Tailscale's word for your private network: your account plus every device you have joined to it.
• NAT traversal — the trick of getting two machines that both sit behind home routers to talk directly, without opening ports on either side. Tailscale does this for you; it is the reason this guide never touches your router. (basics)
• MagicDNS — the Tailscale feature that lets you type a machine's name instead of its address. On by default on new tailnets.
• Admin console — Tailscale's web page where you see and manage every device on your tailnet.

Placeholders

Anywhere you see CAPS-WITH-DASHES, swap in your own value. This guide uses one, late on: YOUR-SERVER-NAME — the hostname of the machine you install on, which becomes its name on your tailnet.

Before you start

• A computer running Ubuntu 24.04 that you can type commands on, with a user that can use sudo. If it is brand new, do First hour with a new Ubuntu server first.
• An account to sign in with — Tailscale uses Google, Microsoft, Apple, GitHub or plain email; there is no separate password to invent.
• A phone or second computer, to feel the point of all this at the end.

One honest aside before we install anything: Ubuntu will happily give you Tailscale as a snap package, and I am deliberately not using it. The snap does not support Tailscale's SSH feature, which the end of this guide points you towards. So we use Tailscale's own repository, exactly as their docs recommend.

The steps

Step 1 — Add Tailscale's official software source

Same trusted pattern as my other guides: fetch the vendor's signing key, then add their package shelf, tied together so nothing unsigned can sneak in.

Fetch the signing key:

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null

No output means it worked. Then add the repository line:

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list

The important line is:

# Tailscale packages for ubuntu noble
deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu noble main

Check it worked. The signed-by= part is the proof the key and the shelf are tied together.

Step 2 — Install Tailscale

Refresh the package lists so Ubuntu notices the new shelf:

sudo apt update

You should see something like:

Get:5 https://pkgs.tailscale.com/stable/ubuntu noble InRelease
Get:8 https://pkgs.tailscale.com/stable/ubuntu noble/main amd64 Packages [15.5 kB]
[...snipped...]
Reading package lists...

Now install it — 39 MB down, 8 seconds on my test machine:

sudo apt install -y tailscale

A passing run includes:

0 upgraded, 2 newly installed, 0 to remove and 26 not upgraded.
Unpacking tailscale (1.102.2) ...
Setting up tailscale (1.102.2) ...

The important line is 2 newly installed. Two packages is correct, not a mistake — Tailscale also installs a small tailscale-archive-keyring package that keeps its signing key fresh from now on. Remember it exists; the undo section deals with it.

Check it worked. Ask for the version:

tailscale version

1.102.2
[...snipped...]

Your version may be newer — that's fine. The background service is already running and set to start with the machine:

systemctl status tailscaled

● tailscaled.service - Tailscale node agent
     Loaded: loaded (/usr/lib/systemd/system/tailscaled.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-08-13 17:05:04 UTC; 3s ago
       Docs: https://tailscale.com/docs/
   Main PID: 1620 (tailscaled)
     Status: "Needs login: "
[...snipped...]

The important lines are Active: active (running) and Needs login:. That Needs login: status is exactly right — installed, running, not yet part of any network:

tailscale status

Logged out.

Step 3 — Ask to join, and get your login link

This is the last tested command in this guide — everything after the link is the browser's territory.

sudo tailscale up

You should see something like:

To authenticate, visit:

	https://login.tailscale.com/a/dd28abd0139e3

The important line is the login URL. In my timed run it appeared 0.5 seconds after Enter. Yours will be a different code. The link is a one-time invitation for this machine, tied to whoever logs in with it. So use it yourself, promptly, and do not post it anywhere, for the same reason you would not post a house key.

The command now waits for you to visit the link. Open it in a browser on any device — your normal computer is fine — and sign in with Google, Microsoft, Apple, GitHub or email. The moment you approve, the waiting command prints Success. and your machine is on your tailnet.

Check it worked (and one reassurance I tested on purpose): if you pressed Ctrl+C, closed the terminal, or wandered off, nothing is lost. The invitation stays live, and this asks for it again:

tailscale status

Logged out.
Log in at: https://login.tailscale.com/a/dd28abd0139e3

The important line is Log in at: — the invitation link, offered again.

On my test machine that link came back reliably after an interrupted tailscale up. Once you have logged in, tailscale status stops saying Logged out. and starts listing machines — which is the next section.

---

The honest boundary: my test ends at that login link — I stop where creating an account begins. Everything below is written from Tailscale's own documentation; the commands are the vendor's own, and they match what I run on my own machines outside this lab.

Step 4 — (after login) See your tailnet

Documented, not VM-tested: from here on, the commands come from Tailscale's official documentation, past the point where my recorded test run stops.

Sign-in complete? Then you now have a tailnet with one machine on it, and two ways to see it:

• The admin console at login.tailscale.com/admin/machines lists the machine, with a name matching its hostname and an address starting 100..
• On the machine itself, per the docs:

tailscale status

lists every device on your tailnet with its 100.x.y.z address, and:

tailscale ip -4

prints this machine's own tailnet address.

Step 5 — (after login) Add your phone, and feel the point

Documented, not VM-tested: this step is written from Tailscale's official documentation, not the recorded test run.

Install the Tailscale app from your phone's app store and sign in with the same account; then confirm it appears in the admin console, next to the server.

Now the payoff. Put the phone on mobile data — off your Wi-Fi. In the Tailscale app, or any browser on the phone, reach your server by name (MagicDNS is on by default on new tailnets). A service like Uptime Kuma at http://YOUR-SERVER-NAME:3001 now loads from anywhere, while staying invisible to the rest of the internet. No port forward. No public address. That is NAT traversal earning its keep.

Step 6 — (after login) The next prize: retire your public SSH port

Documented, not VM-tested: this command is the vendor's own, from Tailscale's documentation — my recorded run ends before login.

I will not walk this here — it deserves its own guide — but you should know the door exists. Per the docs, one command:

sudo tailscale up --ssh

turns on Tailscale SSH: SSH into this machine over the tailnet, with access decided by your tailnet policy instead of whoever finds port 22. Prove it works from another tailscale device first. Then your firewall's public port 22 rule — the one First hour made you add — can close. This is the feature the snap package lacks, and the reason step 1 used Tailscale's own repository.

Something went wrong?

My recorded run came back clean, so this list is short and honest:

• You pressed Ctrl+C during tailscale up, or lost the terminal before opening the link → nothing is broken; the invitation survives → run tailscale status and use the link it shows, or run sudo tailscale up again. Tested on the VM.
• You see context canceled after interrupting tailscale up → that is the command reporting it stopped waiting, not an error → same recovery as above. I captured this exact message in testing.
• tailscale status still says Logged out. after you signed in → the sign-in may have gone to a different account or browser profile than you thought → check login.tailscale.com/admin/machines for the machine; if it is not there, run sudo tailscale up and repeat the link flow.

Undo all of this

Tested for real on the same machine, top to bottom, in under a minute. (If you logged in, first remove the machine in the admin console — Machines → your machine → Remove — so your tailnet does not keep a ghost entry.)

Remove the program. On my test machine, purging also deleted /var/lib/tailscale — the folder holding the machine's identity keys — so nothing lingers:

sudo apt remove --purge -y tailscale

Your output will vary, but look for:

Removing tailscale (1.102.2) ...
Purging configuration files for tailscale (1.102.2) ...

The important line is Purging configuration files — remove alone would leave them behind.

Remove the keyring package from step 2 — this is the step most guides forget, and it takes the signing key file with it:

sudo apt remove --purge -y tailscale-archive-keyring

Remove the repository entry:

sudo rm /etc/apt/sources.list.d/tailscale.list

Refresh the package lists so apt forgets the shelf:

sudo apt update

No pkgs.tailscale.com lines in the output — the shelf is forgotten.

Check it worked.

tailscale version

tailscale: command not found

And the network interface Tailscale created is gone too:

ip addr show tailscale0

Device "tailscale0" does not exist.

Both refusals are the pass mark. When I ran this undo the machine was back to its starting state.

Where to go next

• Put something on the server worth reaching from the sofa: a tiny monitoring setup or a chat interface for your local AI are both perfect tailnet-only services.
• For things the public should reach — with a real domain name — that is the opposite tool: a named Cloudflare Tunnel.
• Official docs: tailscale.com/kb/1017/install — the install guide this one follows, and the door to Tailscale SSH.

---

Last tested: 13 August 2026 on Ubuntu 24.04.4 (4 vCPU, 8 GB RAM) — install, tailscale up to the login link, and full undo; post-login steps from official docs. Versions: Tailscale 1.102.2. Measured: install 8 s, login link in 0.5 s, undo under a minute.