LinuxnetworkingTested on real hardware

Install Tailscale on Linux

One-command Tailscale install that works on Ubuntu, Debian, Fedora, openSUSE, Arch, and most other Linux distros. Official install script from Tailscale.

Distrosubuntu, debian, fedora, opensuse, arch, raspbian, centos
Shellbash
Updated
Script
bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

What this does

Downloads and runs the official Tailscale install script, which detects your distro and configures the correct package repository (apt, dnf, zypper, pacman, etc.) automatically. Then brings Tailscale up and prompts you to authenticate.

Why this approach

Remote access to a homelab traditionally meant either opening ports in your router (punching firewall holes and exposing services to the internet) or setting up a VPN server from scratch (generating certificates, managing clients, handling key rotation). Both options work but have significant maintenance overhead and meaningful security exposure when done carelessly. Tailscale is a managed VPN mesh that eliminates most of that overhead.

Tailscale uses WireGuard under the hood — one of the most well-audited and performant VPN protocols available — but wraps it in an automatic key management system. You install a client on each device, authenticate to your Tailscale account, and each device gets a 100.x.x.x Tailscale IP that’s reachable from every other device in your tailnet. No port forwarding, no static IP required, no certificate management. Devices behind NAT or CGNAT work transparently because Tailscale’s control plane handles NAT traversal.

For homelab use, Tailscale’s free tier is entirely sufficient. It covers unlimited devices (up to 100), lets you set up subnet routing (so one Proxmox node can expose your entire lab subnet to your tailnet), and supports ACLs to restrict which devices can reach which. The setup documented here — install the package, run tailscale up, authenticate — gets you to a working VPN connection in under five minutes and is the foundation for secure remote access to every service in the lab.

The alternative of using Tailscale’s official install script (rather than adding the repository manually) is the right call for most users because Tailscale actively maintains it and it handles distro detection automatically. For distros the script doesn’t know about, the Notes section of this playbook covers the alternatives.

Prerequisites

  • curl installed (sudo apt install curl / sudo dnf install curl)
  • Root or sudo access
  • A Tailscale account (free tier covers homelab use)

After running

  1. Follow the authentication URL printed to the terminal
  2. Approve the device in the Tailscale admin console
  3. Verify connectivity: tailscale status

Useful flags

# Enable subnet routing (expose your LAN to other Tailscale nodes)
sudo tailscale up --advertise-routes=192.168.1.0/24

# Act as an exit node
sudo tailscale up --advertise-exit-node

# Disable key expiry (recommended for servers)
sudo tailscale up --accept-dns=false

Then approve routes in the admin console under the machine settings.

Enable IP forwarding (required for subnet routing)

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Notes

  • The install script is open source: github.com/tailscale/tailscale
  • Tailscale uses WireGuard under the hood — kernel module or userspace depending on your kernel version
  • Service is managed by systemd: sudo systemctl status tailscaled
All playbooks