The use case I can see is streaming from my personal Plex server from anywhere outside my home, but maybe I'm not thinking big enough.
- Access my services/servers at home from anywhere in the world. Friendly mobile apps as well that allow the same.
- In cloud environments (for work and fun), don't even bother provisioning public IPs and having to deal with those firewall rules, just use Tailscale
- https://tailscale.com/blog/tailscale-auth-nginx/ describes how you can integrate nginx proxying with Tailscale auth to both leverage SSO and the authenticated endpoint
- I have a bootmod3 WiFi adapter plugged into my street/track car with a combo 5G/Linux unit in the car connected to my Tailscale that streams continuous telemetry about the car whenever its turned on. I could in theory re-flash the ECU via this.
- Using https://tailscale.com/kb/ondemand-access/ alongside node/subnet grouping to create a very neat first step towards auditing access to sensitive production services/environments.
- I use server-based dev environments to keep my portable laptop as clean as possible with no source code on it. VS Code remote + Coder server are fantastic over Tailscale.
+ others. Tailscale I think solves the problem of node-to-node-to-subnet connectivity at a convenient and flexible layer.
Do you have a writeup or more details you can share around this? This sounds interesting.
Can you elaborate? What do your parents need tailscale for? I mean my parents have internet purely by the telco dropping a router at their place and it just works, what is my family missing?
Would their lives fall apart without it? No. But it makes my life as the family SRE much easier.
Other cool things I could do if I dropped a raspberry-pi w/ tailscale onto their network:
- Need another public IP to test something? Route my laptop through their network for awhile.
- share files with them or backup some of their devices to a fileserver I control.
- send print jobs to their printer, I don't keep a printer but they do because.. and I shit you not, they hate doing crosswords on their ipads, they print the damn things out every morning and work them on paper.
- Put it on their phones and have them route their requests through one of my exit nodes.
That IP is usable regardless of how that device and your device actually reach the internet. Further, no one device acts as a “server” and needs a stable public IP thanks to NAT traversal and the DERP fallback path. Keys are handled automatically with an option to not trust Tailscale infra in doing that (Tailscale lock) and I just need to auth devices with my Google Workspace/Gsuite SSO.
and so much more
I also run some internal services over Tailscale, a lot of my personal projects have tsnet embedded into them so that my Prometheus machine can scrape and monitor them. My husband also uses one of those services daily to monitor some information that I publish there.
I also run the development instance of my blog over Tailscale and use Funnel to share it with people to review my writing before it goes live.
At work we use it a lot to let people poke around with changes to development instances of websites (like https://tailscale.dev) without having to push them to the cloud and wait for preview deploys. It is _stupidly convenient_.
Turns out you can do a lot of things with networks when you don't have firewalls making everything complicated.
My hypervisors are also subnet routers so my VMs can connect to eachother like they're on the same network. All the fun of static routing without any of the "fun" of static routing!
There is so much more you can use it for though: - https://tailscale.dev/blog/funnel-101 - https://tailscale.com/blog/tsnet-virtual-private-services/ - https://tailscale.com/kb/1137/minecraft/
The cloud's the limit!
1) When traveling, you can use one of your home computers as an "exit node" so you can watch Netflix, etc. abroad very easily. Much more reliable than using VPNs which can be blocked.
2) Accessing your internal network from wherever you are for Plex, Homebridge, IP cameras, or whatever.
Personally: - I have a few raspberry Pis and PCs around the house. This lets me SSH into them for maintenance/etc. It’s also good for projects and stuff to use their DNS. Eg I can use “http://nas/photos” to get to my photo library instead of an IP address. No TLD is kinda cool (it’s just a net search group afaik so reproducible without them) but very memorable for the family. I’ve also gone as far as to embed their library in a go project I made - it means the same IP address and host name regardless of where the binary is running which is cool. This also means the binary knows who is who when accessing the website it hosts. The ease of doing this makes me feel like projects like OpenZiti bay be the future of zero trust and networking - embed the security into the code via a library and get all the global routing you need for free.
Work: I work at a tiny company (5 of us). We do IOT stuff, and we have a lab with a bunch of equipment, mostly controlled by Raspberry Pis or similar. We’re small so we work in a private room in a coworking space. We use tailscale to manage the RPIs and keep consistent IP addresses when we don’t have control over the overall network. We also run some internal stuff in AWS over tailscale (eg our staging servers etc). It’s hands down the easiest option to onboard people too. It lets us access equipment from home if needed, and it’s super lightweight compared to other VPNs I’ve used.
I have my first year Pi running Diet Pi with Adguard Home and was just happy that I found a use for such an old machine that I was considering throwing.
The speed test in Diet Pi said that the latest Pis can complete them in a few seconds versus the minutes it took mine to setup, so figured it would be useless but had been working flawlessly as a dns at home and blocking all ads on all devices.
Adding Tailscale took it to the next level and now all my devices have ad blocking on LTE, public wifi, friends houses, everywhere.
When travelling internationally, I use the exit node functionality to optionally switch on and off sending all my traffic back home to either work around geo-blocks for my home streaming services or as a pseudo-vpn replacement for particularly dodgy networks.
After I install the tailscale client on the server and do some very simple configuration on the tailscale web app to identify the new node I know I'll be able to access it no matter of any firewalls the node may be behind!
The most specific use aside from "it's my network, wherever" I've got is setting it up with NextDNS for adblocking no matter where I am in the world and regardless of what network I'm on https://tailscale.com/kb/1218/nextdns/
It took minutes to set up - dead easy.
And I use it for screen sharing my mac computers over the internet while traveling.
We use Tailscale at $dayjob and the fact that we can ensure that marketing machines can’t access any engineering resources is the big win. And it “just works” through NAT.