How to use Tailscale without installing the app

What you’ll get

Private, secure access to your home server or VPS from a device where you can’t or won’t install the Tailscale client app (like a locked-down work laptop, a library computer, or a friend’s iPad). You’ll learn how to launch a secure SSH terminal directly inside your web browser using Tailscale’s WebAssembly-powered console, and how to safely expose web apps to the public internet using Tailscale Funnel.

Time: 15 minutes. Skill level: Intermediate (requires basic terminal comfort and admin access to your tailnet).

Before you start

Before you try to connect without the app, make sure you have:

• A target machine (Linux or macOS) already running Tailscale and connected to your tailnet. If you haven’t set up Tailscale yet, start with our basic Tailscale how-to.
• A Tailscale account with admin privileges to modify Access Control Lists (ACLs) and settings.
• A modern web browser on the accessing device. No command-line tools or apps are needed on this side.

Steps

1. Enable Tailscale SSH on your server

To connect to a machine via the browser, it must have Tailscale SSH enabled. This intercepts SSH traffic coming over the tailnet and handles authentication via your Tailscale identity instead of SSH keys.

Run this command on your server to enable it:

sudo tailscale up --ssh

If Tailscale is already running and you just want to toggle SSH on:

sudo tailscale set --ssh

This routes SSH traffic for the device from the Tailscale network to an SSH server run by Tailscale, instead of your standard SSH server (which continues to listen on port 22 for non-tailnet traffic).

2. Configure Access Control Lists (ACLs)

Tailscale SSH requires explicit permission in your tailnet ACL policy. By default, even if you are the owner, Tailscale SSH might not be permitted until you define who can connect to what.

Go to the Admin Console → Access Control and add an ssh block. Here is a standard configuration that allows admins to SSH into tagged servers:

"ssh": [
  {
    "action": "accept",
    "src": ["autogroup:admin"],
    "dst": ["tag:server"],
    "users": ["root", "your-username"]
  }
]

Make sure your target machine is tagged appropriately (e.g., tag:server). Save the policy.

3. Connect via the Tailscale SSH Console

Now, let’s actually connect from the client device without installing anything.

1. Open a web browser on the client device and log into the Tailscale Admin Console.
2. Find your target machine in the list.
3. Click the three dots on the far right of the node, or hover over the node, and select SSH to machine (or SSH).
4. Enter the username you want to log in as (e.g., root or your user).
5. Re-authenticate your Tailscale identity when prompted for an extra layer of security.
6. A terminal window pops open in your browser, running a live SSH session.

Under the hood, this is running a complete WireGuard node inside your browser using WebAssembly (Wasm). The browser generates a temporary, ephemeral WireGuard key in memory, registers itself as a temporary node on your tailnet, and establishes an end-to-end encrypted connection to your server via Tailscale’s DERP relays. When you close the tab, the ephemeral node is destroyed, and the WireGuard key vanishes from memory. Tailscale’s servers never see your decrypted traffic.

4. Expose web apps with Tailscale Funnel

What if you want to access a web interface (like Home Assistant, Vaultwarden, or a simple dashboard) instead of a terminal?

You can’t run a full Wasm-based browser proxy for arbitrary HTTP traffic easily. That’s where Tailscale Funnel comes in. Funnel lets you expose a local port to the public internet through a unique, encrypted URL (https://your-node.your-tailnet.ts.net).

To set up Funnel:

1. Enable Funnel in your tailnet policy file. In Admin Console → Access Control, ensure the funnel node attribute is set, or add this to your policy:

"nodeAttrs": [
  {
    "target": ["tag:server"],
    "attr": ["funnel"]
  }
]

2. Enable HTTPS certificates in the Tailscale admin console (DNS tab) so Tailscale can provision Let’s Encrypt certificates for your tailnet.
3. Run the funnel command on your server to expose the service (e.g., port 8080):

sudo tailscale funnel 8080

This exposes port 8080 to the public internet at https://your-node.your-tailnet.ts.net. You can now bookmark that URL and access your app from any device on Earth without installing Tailscale.

Common mistakes

• Thinking Funnel is a private mesh. Funnel is public. Anyone who guesses or finds your URL can access your service. This is not a private mesh. You need a strong authentication layer (like Authelia, Authentik, or built-in app login) on top of the service.
• Forgetting that the browser node is ephemeral. The moment you close the tab, that node is destroyed.
• Not setting up application-level auth on Funnel apps. Exposing a raw, unauthenticated web service to the internet is a terrible discovery to make mid-breach.

Tooling that helps

• Tailscale Admin Console for managing ephemeral nodes and ACLs.
• Authelia or Authentik for adding an authentication layer to Funnel-exposed apps.
• Our Tailscale deep dive for advanced configurations like subnet routes and ACLs: read Deep dive: Tailscale beyond the install.

Wrap-up

Using Tailscale without the app is incredibly convenient, but it comes with honest limits. You cannot just access any arbitrary tailnet resource (like a private database, a SMB share, or a non-HTTP service) without a client app unless you set up a public-facing gateway. A browser bookmark cannot magically join the WireGuard mesh without running the Wasm client, which Tailscale SSH Console does, but only for SSH, and it requires authenticating to the admin console first.

If you want a full mesh where your device can talk to any port on any node, you must install the Tailscale client app. But if you just need to check on a Docker container or run a quick update from a locked-down work machine, the web SSH console is a massive win. If a $5 server replaces a subscription, that’s a good afternoon.