Skip to content

Tailscale on a VPS 2026 – Reach Your Server over VPN

Tailscale on an Ubuntu VPS: SSH without public 22, subnet router, exit node, vs WireGuard vs Cloudflare Tunnel, lock down admin UIs.

Root & VPS

Quick answer: Tailscale on the VPS = SSH, Portainer, NPM admin and Home Assistant via a 100.x VPN IP without publishing those ports.

  1. tailscale up on Ubuntu
  2. SSH to 100.x
  3. Close public 22 / bind admin UIs to the tailnet

WireGuard · Cloudflare Tunnel

VPS & root servers: Order VPS in Germany · NexoraHost · nexorahost.com (Maincubes FRA01 Frankfurt · Ryzen · NVMe · GDPR)

Frequently asked questions (FAQ)

What is Tailscale?
WireGuard mesh VPN. Devices get 100.x addresses. Reach the VPS without publishing 22/81/8123.
Tailscale or self-hosted WireGuard?
Tailscale: fast NAT traversal, ACL UI, control plane at Tailscale (or Headscale). WireGuard: you own everything, more work.
Or Cloudflare Tunnel?
Tunnel for public HTTP without open ports. Tailscale for SSH and internal UIs. Many use both.
Harden SSH with Tailscale?
tailscale up, ssh [email protected], then close public 22 in UFW.
Subnet / home LAN?
Advertise an exit node or subnet routes so the phone can reach HA/Pi-hole – or the VPS.

Keep reading

Popular and fresh – not just the oldest guides.

More

Explore NexoraHost