Tailscale on Ubuntu: Secure Remote Server Access Without Port Forwarding

Accessing an office server from another country is one of those problems that looks simple until you try it. You need a connection that survives hotel Wi-Fi, does not expose your infrastructure to the public internet, and does not collapse in the middle of a database migration. Tailscale solves this on Ubuntu with a zero-configuration mesh VPN built on WireGuard, and it needs no public IP, no port forwarding and no SSH key distribution.

This guide walks through connecting a local Ubuntu laptop to a remote Ubuntu server over a private mesh network, using Tailscale SSH for authentication.

Why traditional remote access falls short

The oldest approach is port forwarding: log into the office router, open port 22, and map it to the server's local address such as 172.16.16.50. It works, and it is a serious liability. The moment port 22 is reachable from the public internet, automated scanners and brute-force attempts start arriving within minutes. If you are hardening a machine that has to be exposed, our essential checklist for securing a Linux server covers the baseline.

Port forwarding also assumes you can find the server at all. If your ISP uses Carrier-Grade NAT (CGNAT) or hands out dynamic addresses, you end up depending on Dynamic DNS just to locate your own machine.

The trouble with legacy VPNs

Traditional corporate VPNs such as OpenVPN or IPsec avoid open ports by routing everything through a central gateway. Every packet from your laptop travels to that gateway before reaching the server. Over an intercontinental link this hub-and-spoke detour adds real latency, and the gateway itself needs ongoing maintenance.

Smaller teams often reached for LogMeIn Hamachi instead, which offered a zero-configuration virtual LAN. Its architecture has aged badly on Linux: the proprietary client hits memory allocation bugs against the glibc versions shipped in Ubuntu 20.04 and later, drops connections, and funnels traffic through centralised relays that throttle throughput. A dropped SSH session during a deployment is not an acceptable failure mode.

How WireGuard and Tailscale change the picture

WireGuard is a modern VPN protocol that runs inside the Linux kernel. It is small, fast, and built on current cryptography. On its own, though, it expects you to distribute keys and configure endpoints by hand, which becomes tedious across several machines.

Tailscale layers zero-configuration networking on top of WireGuard by separating the control plane, which handles authentication and key exchange, from the data plane carrying your encrypted traffic. Your devices form a peer-to-peer mesh, so a laptop overseas talks directly to a server in Jeddah over the shortest cryptographic path available.

The part that makes it practical is NAT traversal. Using STUN, TURN and a distributed set of DERP relays, Tailscale punches through most firewalls and NAT routers without a public IP or a single router change.

Installing Tailscale on Ubuntu

Tailscale ships an installation script that detects your Ubuntu release and configures the correct APT repository. Run it on both the laptop and the server:

curl -fsSL https://tailscale.com/install.sh | sh

This adds the repository and installs the tailscale CLI alongside the tailscaled daemon. The daemon runs continuously, so the machine rejoins the mesh automatically after a reboot.

Authenticating your laptop

Bind the local machine to your account:

sudo tailscale up

The terminal prints a one-time authentication URL. Open it in a browser and sign in with your identity provider, such as Google, Microsoft or GitHub. Your laptop then joins the private network, called a tailnet, and receives a stable address in the 100.64.0.0/10 range.

Authenticating a headless server with Tailscale SSH

The server has no desktop, so the flow differs slightly, and it is worth enabling Tailscale SSH at the same time. Tailscale SSH intercepts incoming SSH connections and authorises them against your Tailscale identity, which means no authorized_keys files to maintain and no key rotation to schedule. If you prefer to keep managing keys yourself, our guide to setting up SSH key authentication on Linux covers that route.

sudo tailscale up --ssh

The command pauses and prints a URL such as https://login.tailscale.com/a/75d8d99016089. Copy it into a browser on any machine, sign in with the same account, and the server detects the successful login and returns to the prompt.

Finding your tailnet addresses

Once both machines are on the mesh, their local addresses stop being useful. A server at 172.16.16.50 becomes unreachable the moment your laptop moves to a hotspot or hotel network. Use the server's Tailscale address instead:

tailscale ip -4

This returns an address such as 100.79.134.22. It persists for as long as the machine belongs to your account, no matter which physical network the server is plugged into.

Connecting and verifying the tunnel

To simulate the overseas case, disconnect the laptop from the office network and join a completely different one. Confirm the encrypted tunnel is up:

ping -c 4 100.79.134.22

A successful reply proves Tailscale has traversed the NAT on both ends and established a direct WireGuard connection. Now open a session using the server's normal Linux username:

ssh administrator@100.79.134.22

With Tailscale SSH enabled, the connection is authorised through your Tailscale identity. There is no password prompt and no key to copy: you land straight in the server's terminal, ready to deploy code or run migrations.

Features worth enabling next

Once the mesh exists, a few options make daily work noticeably easier.

MagicDNS registers each device's hostname automatically, so a server named nuzum is reachable as ssh administrator@nuzum instead of an address you have to memorise.

Exit nodes route your general internet traffic through the office server. Enable it with sudo tailscale up --advertise-exit-node on the server and toggle it on the laptop. On untrusted public Wi-Fi this keeps your browsing encrypted all the way back to the office.

Subnet routing bridges the mesh to your physical office network. Devices that cannot run Tailscale themselves, such as internal databases, printers or legacy hardware, become reachable from your laptop through the server acting as a router for the 172.16.x.x range.

Conclusion

Port forwarding and ageing tools like Hamachi are risks that are no longer worth carrying. A WireGuard-based mesh gives you a private network that stays completely off the public internet while remaining instantly reachable by you, whether you are down the street or on another continent. Once it is running, pair it with a proper monitoring setup such as Prometheus for Linux servers so you can see the state of your infrastructure from wherever you happen to be.

Abdullah Al-Azzani is a Senior Software Engineer, System Architect and IT Manager based in Jeddah, Saudi Arabia. With over 14 years of professional experience designing enterprise applications and SaaS platforms, he is the founder of the 7AZZANI platform, providing software services and cybersecurity solutions.