How to Set Up Tailscale on Linux

Tailscale wraps WireGuard in a control plane that handles key exchange, NAT traversal, and device authentication automatically. The result is a zero-config mesh VPN where every device gets a stable 100.x.x.x address and an optional DNS name — no server to manage, no port forwarding required. This guide walks through installation, authentication, access control lists (ACLs), and MagicDNS on Linux.

How Tailscale Works

Each device runs a Tailscale daemon (tailscaled) that authenticates to Tailscale's coordination server using your identity provider (Google, GitHub, Microsoft, or email). The coordination server exchanges WireGuard public keys between devices; actual traffic flows peer-to-peer over WireGuard without passing through Tailscale's infrastructure. Your private keys never leave the device.

Your collection of devices forms a tailnet. Every tailnet has a shared ACL policy and optional MagicDNS, both managed from the Tailscale admin console at login.tailscale.com/admin.

Prerequisites

• A Linux host with a kernel ≥ 5.6 (for native WireGuard support; older kernels fall back to a userspace implementation automatically)
• A free Tailscale account — the personal plan covers up to 100 devices
• sudo or root access on the machine

Step 1: Install Tailscale

Tailscale maintains its own repositories for all major distributions. The quickest path is the official install script, which detects your distro and adds the correct repo:

curl -fsSL https://tailscale.com/install.sh | sh

If you prefer to add the repository manually, use the steps below for your distro.

Debian / Ubuntu

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg \
  | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list \
  | sudo tee /etc/apt/sources.list.d/tailscale.list

sudo apt update && sudo apt install -y tailscale

Replace noble with your Ubuntu codename (jammy, focal) or use debian/bookworm for Debian 12. Check pkgs.tailscale.com/stable for the exact URL for your release.

Fedora / RHEL / Rocky

sudo dnf config-manager --add-repo \
  https://pkgs.tailscale.com/stable/fedora/tailscale.repo

sudo dnf install -y tailscale

Arch Linux

sudo pacman -S tailscale

Step 2: Enable and Start the Daemon

Tailscale runs as a systemd service. Enable it at boot and start it now:

sudo systemctl enable --now tailscaled

Verify it is running:

systemctl status tailscaled

You should see Active: active (running). The daemon listens on a Unix socket at /var/run/tailscale/tailscaled.sock.

Step 3: Authenticate the Device

Bring up Tailscale and authenticate in one command:

sudo tailscale up

The CLI prints a URL like https://login.tailscale.com/a/xxxxxxxxxx. Open it in a browser, log in with your identity provider, and authorize the device. On a headless server you can copy the URL to any browser — it does not have to be on the same machine.

Authenticating with an Auth Key (headless / automated)

For servers you provision automatically, generate a reusable or one-time auth key in the admin console under Settings → Keys, then pass it directly:

sudo tailscale up --authkey=tskey-auth-xxxxxxxxxxxxxxxx

Add --ssh to enable Tailscale SSH (see Step 5) and --advertise-tags=tag:server to apply ACL tags at join time.

Step 4: Verify Connectivity

Check your device's Tailscale IP and connection status:

tailscale status

Output lists every device in your tailnet with its 100.x.x.x address and online state. Your local IP is also shown by:

tailscale ip -4

Ping another device by its Tailscale IP or MagicDNS name to confirm the tunnel is working:

ping 100.x.x.x
# or, with MagicDNS enabled:
ping hostname.tail1234.ts.net

Step 5: Enable MagicDNS

MagicDNS gives every device a stable DNS name inside your tailnet without running your own DNS server. Enable it in the admin console: DNS → Enable MagicDNS. Each device becomes reachable at <hostname>.<tailnet-name>.ts.net.

On the Linux client, Tailscale writes a nameserver configuration. With systemd-resolved (the default on Ubuntu 20.04+ and Fedora), Tailscale configures it automatically. Confirm:

resolvectl status tailscale0

You should see the Tailscale nameserver (100.100.100.100) listed for the tailscale0 interface. If DNS is not resolving, force Tailscale to accept the DNS config:

sudo tailscale up --accept-dns=true

Step 6: Configure ACLs

By default, all devices in a personal tailnet can reach each other on all ports. For teams or tighter security, define an ACL policy in the admin console under Access Controls. Policies are written in HuJSON (JSON with comments).

A minimal policy that allows all traffic between tagged servers and your personal devices, but blocks server-to-device traffic, looks like this:

# This is HuJSON — paste it in the admin console, not the shell.
{
  "tagOwners": {
    "tag:server": ["autogroup:admin"],
  },
  "acls": [
    // Admins reach everything
    { "action": "accept", "src": ["autogroup:admin"], "dst": ["*:*"] },
    // Personal devices reach tagged servers on SSH and HTTPS only
    { "action": "accept", "src": ["autogroup:member"],
      "dst": ["tag:server:22,443"] },
  ],
}

After saving, Tailscale distributes the policy to all devices within seconds — no restart needed. Apply tags to a device either during tailscale up --advertise-tags=tag:server or from the admin console machine list.

Step 7: Enable Tailscale SSH (Optional)

Tailscale can authenticate SSH sessions using your identity provider, removing the need to manage SSH keys. Enable it on the server:

sudo tailscale up --ssh

Then in your ACL policy, add an SSH rule:

"ssh": [
  {
    "action": "accept",
    "src":    ["autogroup:admin"],
    "dst":    ["tag:server"],
    "users":  ["autogroup:nonroot", "root"],
  },
],

Connect from another Tailscale device with a normal SSH client — no keys, no passwords, just your tailnet identity:

ssh [email protected]

Verification Checklist

• tailscale status shows all expected devices with green (online) state
• ping <peer-tailscale-ip> succeeds from both sides
• MagicDNS resolves hostname.tail1234.ts.net to the correct 100.x.x.x address
• ACL-blocked traffic is rejected (test with nc -zv <ip> <port>)

Troubleshooting

tailscaled fails to start

Check the journal for errors:

journalctl -u tailscaled -n 50 --no-pager

A common cause on RHEL/Rocky is SELinux. Check for AVC denials with ausearch -m avc -ts recent and apply the appropriate boolean or policy module.

Devices show as offline despite the daemon running

Tailscale needs outbound HTTPS (443) to the coordination server. If your host firewall drops outbound traffic by default, allow it:

# With nftables / firewalld — allow outbound HTTPS
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

MagicDNS not resolving

If your system uses NetworkManager managing /etc/resolv.conf directly (common on some desktop installs), Tailscale may not be able to inject its nameserver. Switch to systemd-resolved or run sudo tailscale up --accept-dns=true and check whether Tailscale has write access to the DNS config.

High latency between peers

Run the built-in path diagnostics:

tailscale ping --until-direct 100.x.x.x

If it never goes direct, a firewall or CGNAT between the peers is blocking UDP. Tailscale will fall back to its DERP relay network automatically, but you can open UDP 41641 outbound (and ideally inbound) to restore direct connections.