Site icon CentLinux

How to install Tailscale on Linux

Alaric Bird
Share on Social Media

Learn how to install Tailscale on Linux with this complete step-by-step guide. Discover installation methods, configurations, security tips, and advanced usage in one detailed tutorial. Perfect for beginners and pros alike! #centlinux #linux #tailscale

Introduction to Tailscale

What is Tailscale?

Tailscale is a modern VPN alternative built on top of WireGuard, one of the fastest and most secure VPN protocols today. But here’s where Tailscale shines—it simplifies the setup of private, peer-to-peer networks. Think of it like creating your own secure LAN over the internet. Whether you’re at home, in a café, or on the go, Tailscale allows your devices to communicate as if they were right next to each other.

Instead of complex configurations and headaches, Tailscale makes it almost plug-and-play. It uses your existing identity provider—like Google or Microsoft—to handle authentication, which removes the hassle of managing keys or passwords. Once set up, you get a mesh VPN with encrypted connections between all devices. This means no more worrying about NAT traversal or fiddling with firewalls—Tailscale handles it all under the hood.

From remote access to private services, managing servers, or even just syncing files securely, Tailscale is an excellent tool for developers, system admins, or even casual Linux enthusiasts who value privacy and simplicity.

How to install Tailscale on Linux

Why Use Tailscale on Linux?

Linux users often prioritize security, control, and efficiency—and Tailscale checks all those boxes. It’s lightweight, easy to install, and integrates perfectly with system-level services. Plus, it supports both CLI and GUI options, giving advanced users the flexibility they crave.

You can use Tailscale to:

And since it’s built on WireGuard, you get top-notch encryption without draining your system resources. No surprise that Tailscale is becoming a go-to tool for anyone serious about remote access and network management.

Prerequisites for Installing Tailscale

System Requirements

Before diving into the installation, let’s quickly check what you’ll need:

Tailscale supports most modern Linux distributions, and it doesn’t demand much in terms of resources. Even a low-powered Raspberry Pi can run it smoothly. But you should ensure your system is up to date before installation to avoid dependency issues.

Recommended Training: VPN Tunneling Protocols on MikroTik with LABS from Maher Haddad

Preparing Your Linux Environment

Here are a few steps to get your Linux environment ready:

Update your system packages:

For Debian-based systems: 

sudo apt update && sudo apt upgrade -y

For Red Hat-based systems: 

sudo dnf update -y

Install essential tools (if missing): 

sudo apt install curl gnupg -y

Check system architecture:

Tailscale works on x86_64, ARM, and ARM64 architectures. To confirm yours: 

uname -m

Disable conflicting VPNs:

If you’re already using another VPN or have complex firewall rules, it’s wise to review or temporarily disable them to avoid conflicts with Tailscale.

Once all this is set, you’re good to proceed with the installation. Let’s explore the various methods you can use, tailored to different distributions.

Installation Methods

Installing Tailscale via Official Package Repository

This is the most stable and recommended way. Tailscale maintains official repos for major distributions, making it easier to get updates automatically.

For example, on Debian or Ubuntu:

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
sudo apt update
sudo apt install tailscale

For Fedora or CentOS:

sudo dnf config-manager --add-repo https://pkgs.tailscale.com/stable/fedora/tailscale.repo
sudo dnf install tailscale

It’s reliable, secure, and future-proof since updates are handled through your package manager.

Installing Tailscale Using Curl Script

Want a quick one-liner to get going?

curl -fsSL https://tailscale.com/install.sh | sh

This method is perfect for automation or when you’re experimenting on a test VM. It works across distributions by detecting your OS and installing the right packages. But remember—it’s a script from the internet, so always read it before running.

Installing Tailscale from Source Code (Advanced)

If you’re adventurous or want to contribute to the project, building from source is an option.

Install Go and Git:

For Debian/Ubuntu-based systems:

sudo apt update
sudo apt install -y golang-go git

For Red Hat-based systems (CentOS, Fedora, RHEL):

sudo dnf install -y golang git

For Arch Linux and derivatives:

sudo pacman -S go git

Let me know your distro if you need a tailored command!

Clone the repo: 

git clone https://github.com/tailscale/tailscale.git 
cd tailscale 
go run ./cmd/tailscaled & go run ./cmd/tailscale up

This method gives you the bleeding-edge version, but it’s not recommended for beginners.

Step-by-Step Guide to Installing Tailscale

Method 1: Debian-Based Systems (Ubuntu, Debian)

If you’re running Ubuntu, Debian, or any of their derivatives like Pop!_OS or Linux Mint, installing Tailscale is straightforward using the official package repository. Here’s the full breakdown:

Add the Tailscale repository’s GPG key: 

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null

Add the repository to your sources list: 

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list

Update your package list: 

sudo apt update

Install Tailscale: 

sudo apt install tailscale

After installation, you’ll be able to control Tailscale with simple terminal commands. If you’re unsure which Ubuntu version you’re on, use lsb_release -a to find out and replace focal with your codename like bionic, jammy, etc., in the URLs above.

This method ensures you’re getting secure, signed packages directly from Tailscale’s maintainers. That means you’ll also receive updates whenever you run apt upgrade, which is ideal for long-term support systems and production servers.

Method 2: Red Hat-Based Systems (CentOS, Fedora, RHEL)

On Red Hat-based distros, the steps are slightly different, but still very easy. Here’s what to do:

Add the Tailscale repo: 

sudo dnf config-manager --add-repo https://pkgs.tailscale.com/stable/fedora/tailscale.repo

Install Tailscale: 

sudo dnf install tailscale

Enable and start the service: 

sudo systemctl enable --now tailscaled

You’ll now be ready to authenticate with your Tailscale account and bring up your private network. RHEL users may need to enable the EPEL repository if they’re missing certain dependencies.

For users on older CentOS versions (like CentOS 7), using the curl script may be a faster route since dependencies and repos can be tricky to manage manually.

Method 3: Arch Linux and Derivatives

Arch fans usually love bleeding-edge software, and Tailscale doesn’t disappoint here either. You can install it directly from the community repository:

sudo pacman -S tailscale

After installation:

sudo systemctl enable --now tailscaled

If you’re on Manjaro or EndeavourOS, it’s the same process. Arch users can also choose to build the latest development version from the AUR (tailscale-git) if they want to stay on the cutting edge. Just be cautious with updates from the AUR—they can break from time to time.

Starting and Enabling Tailscale

Using Systemd to Manage Tailscale Service

Once installed, you’ll want to make sure the Tailscale service is running and will automatically start on boot. Most systems use systemd, so here’s what to do:

Start the Tailscale daemon: 

sudo systemctl start tailscaled

Enable it to run at boot: 

sudo systemctl enable tailscaled

Check status: 

systemctl status tailscaled

This daemon is the core component—it handles encrypted tunnels, authentication, and everything else in the background. If this isn’t running, your Tailscale commands won’t do much.

The beauty of using systemd is its reliability. It handles restart policies, logging, and all the low-level stuff for you, so once it’s enabled, you can mostly forget it’s even there.

Authenticating and Connecting to the Tailscale Network

Now comes the magic part: bringing your machine into your secure mesh network.

Run this command:

sudo tailscale up

This will open a URL in your default browser asking you to authenticate with your preferred provider (Google, GitHub, Microsoft, etc.). Once authenticated, your machine will be linked to your Tailscale network.

You’ll get an IP like 100.x.y.z assigned to your device—this is your unique Tailscale address. From here on out, you can:

And yes, it works across different networks and firewalls. Whether you’re at a coffee shop or behind corporate NAT, Tailscale just works.

Verifying the Installation

Checking the Status of Tailscale

Once you’ve installed and connected Tailscale, it’s time to make sure everything is running smoothly. Here’s how you can verify the installation and connection on your Linux machine.

1. Check the status of the Tailscale service: 

sudo systemctl status tailscaled

If everything’s good, you’ll see output indicating the service is active and running. This is crucial because the daemon (tailscaled) manages all connections and background processes.

2. Confirm you’re connected to the Tailscale network: 

tailscale status

This command shows a list of all your connected devices, their assigned Tailscale IPs, and their current state. You’ll see which ones are directly connected and which are relayed. Direct connections are better for speed, but relays are great for punching through firewalls.

3. Ping another Tailscale-connected device: 

ping 100.x.x.x

Replace 100.x.x.x with the Tailscale IP of another device on your network. If the ping goes through, congratulations—your Tailscale VPN is working perfectly.

Troubleshooting Common Installation Issues

Things don’t always go smoothly, especially when it comes to networking. Here are a few common hiccups and how to solve them:

Tailscale is known for being very reliable, but if something does go wrong, the logs are your best friend. And their documentation and community forum are great for more edge cases.

Using Tailscale on Linux

Accessing Devices via Tailscale

Once your devices are connected, you can access them as if they’re on the same local network—even if they’re thousands of miles apart. This is the heart of what makes Tailscale so useful.

Common use cases:

For example:

ssh user@100.100.100.1

That’s it. No port forwarding. No firewall adjustments. No public IP needed. If you’ve ever struggled with traditional VPNs, this feels like magic.

Bonus Tip: You can also use hostnames if you’ve named your devices in the Tailscale admin panel. Just run:

tailscale ping hostname

Sending Files Securely over Tailscale Network

Tailscale isn’t just about connections—it can help with secure file transfers too. You can set up SCP or rsync over your encrypted tunnel without worrying about MITM attacks or leaky ports.

Example using scp:

scp myfile.txt user@100.x.x.x:/home/user/

Or sync folders:

rsync -avz ./myfolder user@100.x.x.x:/home/user/

Because it’s all encrypted with WireGuard, there’s no need for additional encryption layers. It’s as if you’re on the same LAN.

This makes Tailscale a brilliant alternative to cloud file-sharing services for sensitive data. It’s completely peer-to-peer and lightning-fast on local networks.

Advanced Configurations

Using Tailscale with Exit Nodes

Want all your internet traffic to route through a trusted machine—like your home server? That’s where exit nodes come in.

An exit node acts as a full VPN gateway. All your traffic, not just Tailscale connections, is routed through that node.

1. Enable exit node on a machine:

sudo tailscale up --advertise-exit-node

2. Use it from another device: 

sudo tailscale up --exit-node=100.x.x.x

You can now securely browse from a coffee shop while routing traffic through your home connection. This is perfect for using public Wi-Fi safely or accessing region-locked content.

Enabling Subnet Routing

If you want devices outside of your Tailscale network (like a printer or old NAS) to be reachable, you can use subnet routing.

1. Advertise a subnet: 

sudo tailscale up --advertise-routes=192.168.1.0/24

2. Enable it in the Tailscale admin panel.

This effectively lets your Linux box act like a gateway. Other Tailscale-connected devices will be able to access anything on that local subnet.

Great for homelab setups, especially if you’re running mixed environments with IoT devices, printers, or older hardware.

Security and Privacy Considerations

How Tailscale Keeps Your Data Secure

Security is where Tailscale truly shines. Built on the foundation of WireGuard, Tailscale leverages state-of-the-art cryptography, ensuring your connections are not just fast but also secure. Let’s break it down:

This makes Tailscale ideal for remote teams, home labs, and enterprises alike. You get VPN-level protection with the simplicity of logging in.

Limiting Access with ACLs

Access Control Lists (ACLs) let you define who can connect to what in your network. Think of them as digital security guards deciding who gets in and where they can go.

Here’s an example ACL setup:

{
  "ACLs": [
    {
      "Action": "accept",
      "Users": ["group:devops"],
      "Ports": ["100.x.x.x:22", "100.y.y.y:80"]
    }
  ],
  "Groups": {
    "devops": ["alice@example.com", "bob@example.com"]
  }
}

In this example:

These rules can be managed from the Tailscale admin panel or using their API if you’re integrating it into a larger automation system. And since everything is version-controlled, rolling back changes is simple.

ACLs also support tags, so you can group machines by function (e.g., tag:production) and assign access accordingly. This is powerful for managing growing networks without losing control.

Uninstalling Tailscale

Removing Tailscale from the System

Sometimes you just need to clean house. Maybe you’re switching devices or migrating to a different VPN. Uninstalling Tailscale is just as easy as installing it.

For Debian/Ubuntu:

sudo apt remove tailscale

For Fedora/CentOS:

sudo dnf remove tailscale

For Arch Linux:

sudo pacman -R tailscale

After removing the package, the binary and related service files will be gone, but configuration data might still be hanging around.

Cleaning Up Configuration Files

To completely purge all traces of Tailscale, including keys and device authorization data:

sudo rm -rf /var/lib/tailscale
sudo rm -rf /etc/default/tailscaled

You can also remove it from your Tailscale network via the admin console by de-authorizing the device. This ensures the machine is fully revoked and cannot reconnect unless approved again.

A clean uninstall is useful for troubleshooting, resetting a machine, or rotating devices in and out of your network securely.

Frequently Asked Questions (FAQs)

Can I use Tailscale with a dynamic IP address?

Absolutely. Tailscale doesn’t care about your public IP—whether static or dynamic. It assigns a stable Tailscale IP to each device, and everything runs over that encrypted virtual network.

Is Tailscale free to use for personal projects?

Yes! Tailscale offers a generous free tier for personal use. You get up to 100 devices, access control lists, exit nodes, and subnet routing—all without paying a dime.

What ports does Tailscale use?

Tailscale uses:

Does Tailscale work behind a NAT?

Yes, and that’s one of its biggest advantages. Tailscale uses NAT traversal techniques (like STUN) to establish direct connections. If that fails, it falls back to encrypted relays, ensuring it always connects.

How do I update Tailscale on Linux?

If you installed via package manager:

sudo apt update && sudo apt upgrade tailscale

Or use:

sudo dnf upgrade tailscale

If you used the install script, just run it again—it will update automatically.

Conclusion

Tailscale is one of those rare tools that’s powerful, secure, and dead simple to use—all at the same time. Whether you’re a sysadmin juggling cloud servers or just a privacy-conscious tinkerer wanting to access your Raspberry Pi from anywhere, Tailscale has your back.

From installing it with a single command to building advanced mesh networks with ACLs and exit nodes, it’s incredibly flexible. And thanks to its foundation on WireGuard, you’re getting military-grade encryption and top-tier performance with minimal overhead.

If you’ve ever struggled with traditional VPNs, port forwarding, or complex network setups, Tailscale is your breath of fresh air. Once you try it, there’s no going back.

Optimize your cloud infrastructure and secure your servers with my AWS and Linux administration services. Let’s ensure your systems run smoothly. Connect with me on Fiverr now!

Exit mobile version