The problem
You installed Tailscale, signed in on the laptop and the home box, and watched a 100.x address appear in the admin console. You pinged once. It worked. Then… nothing. The mesh just sits there like a VPN you bought for a trip you never took.
That’s the common stall. People treat Tailscale as “remote SSH, but fancier WireGuard,” then bounce when the how-to ends. Fair. Ping is not a lifestyle.
The interesting part starts after the mesh exists. Exit nodes that make hotel Wi-Fi feel like home. HTTPS for apps that only listen on localhost. A subnet route so the printer still exists when you’re three time zones away. SSH that doesn’t need another key ceremony. File drops between your own devices. Sharing one machine with a friend without inviting them onto the whole LAN.
If you still need the install path, start with our how-to for reaching a home server. For the feature ladder (MagicDNS, Serve, routes, ACLs), see the Tailscale deep dive. This piece is the recipes: what to turn on when, and what to leave alone.
How we picked these
Every recipe here:
- Solves a real weekly pain (travel egress, private HTTPS, IoT access, SSH friction, file handoff)
- Works on a personal or household Tailscale setup without needing SSO theater
- Has a clear “don’t do this by accident” caveat
- Points at official docs when CLI flags move (Serve/Funnel syntax has already bitten people)
We skipped enterprise posture checklists, MDM rollout, and “GitOps your ACL JSON for a three-person family.” Useful for teams. Not why most readers searching Tailscale are here.
Also skipped re-teaching MagicDNS and the first tailscale up. If you’re not on the same account across devices yet, fix that first. Same tailnet or nothing talks.
1. Use home as your travel VPN
Best for: Hotel Wi-Fi, coffee shops, “I need my home IP for a bank or geo-locked service” Fixes: Phone or laptop egress that should look like it left from your house Watch out: Everything on that device now exits through your home uplink. Your bandwidth, your ISP terms, your blame if something misbehaves.
An exit node is different from “I can SSH to the NAS.” Regular Tailscale access reaches your machines. An exit node routes all (or selected) internet traffic from a client through a chosen node first.
On an always-on home machine (or a small VPS you trust):
sudo tailscale up --advertise-exit-nodeApprove the exit node in the admin console, then on the travel device pick that node as the exit. Phone clients have a toggle; desktops expose it in the menu or via tailscale set --exit-node=….
Use it when you want home-shaped egress. Skip it when you only need Immich or Vaultwarden: plain tailnet access is enough and cheaper on battery and bandwidth. If you want a commercial privacy VPN instead of home egress, Tailscale has also partnered with providers like Mullvad for exit nodes; check current pricing and availability on Tailscale’s site rather than assuming it’s free forever.
Docs: exit nodes (follow their current CLI names if yours differs).
2. Give localhost apps real HTTPS on the tailnet
Best for: Vaultwarden, Grafana, a half-finished web UI, anything that hates plain HTTP on phones
Fixes: “It only listens on 127.0.0.1:3000 and my phone hates that”
Watch out: Serve is tailnet-only. Funnel is the public cousin. Don’t confuse them when you’re half-awake.
Tailscale Serve proxies a local port (or path) to your MagicDNS hostname with HTTPS certificates Tailscale manages. Enable HTTPS for the tailnet if the CLI prompts you; Serve needs it.
Modern clients make the happy path almost boring:
tailscale serve 3000You get a https://your-machine.tailnet-name.ts.net URL that only other devices on your tailnet can hit. Bind the app to localhost. Let Serve be the front door. Phone password managers and browser warnings stop being a side quest.
Serve can also forward Tailscale identity headers to the backend (Tailscale-User-Login and friends). Handy if you want Grafana or a custom app to trust the mesh identity instead of inventing another login. Keep that backend on localhost so nobody on the LAN can spoof those headers by hitting the port directly.
If you already followed the Vaultwarden VPS guide with a public domain, you don’t need Serve. If the vault should never face the open internet, Serve plus MagicDNS is the cleaner story.
CLI flags moved around in past client versions. When in doubt: tailscale serve --help on the box you’re configuring, not a blog comment from 2023.
3. Reach printers and IoT without Tailscale on every device
Best for: Printers, cameras, smart plugs, a NAS that won’t run the client cleanly
Fixes: “I can reach the server, but the rest of the LAN might as well be on Mars”
Watch out: Advertising 192.168.1.0/24 without ACLs means every approved tailnet device can poke that whole subnet. Approve routes deliberately.
A subnet router is a Tailscale node that advertises a LAN prefix. Other tailnet devices learn how to reach those private IPs through that node. You install Tailscale once on a stable box (Pi, mini PC, the homelab host), not on every IoT brick.
sudo tailscale up --advertise-routes=192.168.1.0/24Swap in your LAN CIDR. Then approve the route in the admin console. From a phone on cellular you should be able to hit http://192.168.1.50 (or whatever the printer is) as if you were on the couch.
Pair this with tags and ACLs when the household isn’t just you. Phones might need the printer and Home Assistant. They probably don’t need every random IoT management port. The deep dive covers the ACL sketch; the point here is: subnet routing is how Tailscale eats the “dumb device” problem without pretending every gadget can run a WireGuard client.
Don’t advertise routes you don’t understand. Overlapping home/office 192.168.1.0/24 spaces are a classic footgun; Tailscale has 4via6 tricks for collisions, but the happier fix is not inventing two identical LANs if you can help it.
4. SSH without babysitting keys
Best for: Jumping between laptops, a VPS, and the homelab without another authorized_keys ritual
Fixes: Key sprawl, “which key did I put on the Pi,” and SSH open to the world “just for a minute”
Watch out: Tailscale SSH is still SSH with power. ACLs decide who can open a shell. Default-open mesh plus root login is how you invent an incident.
Tailscale SSH lets the control plane broker SSH using your Tailscale identity. You enable it on the server side, keep port 22 off the public internet, and reach the box only over the tailnet. There’s also a browser SSH console in the admin UI for designated nodes when you’re stuck on a locked-down machine.
This is the move when:
- You’re tired of copying ed25519 pubs onto every new VM
- You want “Alice can SSH to tagged servers” expressed in policy, not tribal knowledge
- You already trust Tailscale’s identity for the rest of the mesh
Keep classic key-based SSH as a break-glass path on critical boxes if that matches how you sleep at night. Just don’t leave sshd listening on 0.0.0.0 and call the Tailscale story “private.” Bind carefully. Prefer tailnet-only reachability.
If your agent or automation box also sits on the tailnet, remember the homelab agent sandbox checklist: mesh access is power. Scope tags so a curious container isn’t one hop from the NAS admin panel.
5. Send files between your own devices
Best for: “AirDrop, but the other laptop is Windows and I’m on a weird guest network” Fixes: Emailing yourself zips, uploading to a cloud drive you don’t want involved, USB sticks you forgot Watch out: Both ends need Tailscale online. This is not a backup system and not a shared family drive.
Taildrop pushes a file from one of your devices to another over the tailnet. It’s the boring superpower people forget exists: Share menu (or tailscale file on Linux), pick a device you own, send. Peer-to-peer when the path allows it, encrypted like the rest of the mesh.
It’s still labeled alpha. Opt in under admin Settings → General → Send Files (or whatever Tailscale calls that toggle this month). Personal devices you own only; tagged nodes and other users’ machines are out of scope. Platform quirks exist (macOS needs the Tailscale Sharing extension enabled).
Use it for:
- A config file or screenshot that shouldn’t go through Slack
- A quick handoff from phone to desktop without cloud sync delay
- Moving something sensitive off a machine you’re about to wipe
Don’t use it as your photo library or project sync. That’s Syncthing, Nextcloud, or Immich territory. Taildrop is a throw, not a shelf.
If transfers fail, check that both devices are actually connected (not just installed), that you’re signed into the same tailnet, and that the OS client you’re on still exposes Taildrop in the UI. Feature surfaces differ a bit between platforms.
6. Share one machine with a friend
Best for: Pairing on a homelab app, letting a contractor hit a staging box, family access to one service host Fixes: “I don’t want to add them to the whole household tailnet” Watch out: Sharing is still beta-ish in Tailscale’s docs. Prefer sharing a plain app host, not your only jump box. Don’t confuse sharing a node out with inviting someone into your tailnet (invites can see a lot more, including subnet routes).
Tailscale node sharing lets you invite another Tailscale user (on their own tailnet) to a specific device. They don’t get your printer, your NAS, or your laptop by default. Shared nodes are quarantined: they accept inbound connections from the recipient but don’t start outbound ones into the recipient’s mesh. Subnet routes on the shared machine do not get advertised into their tailnet.
This is the adult alternative to:
- Temporarily opening a port on the router
- Shipping a WireGuard config over Signal and hoping you revoke it later
- Creating a second “guest” account that somehow still sees everything
Combine sharing with Serve when the thing they need is a web UI. Combine with Tailscale SSH when they need a shell. Skip inviting them into the full household tailnet unless you actually want them on the LAN story.
Revoke when the project ends. Shared access that outlives the reason for it is how friendly favors become permanent attack surface.
7. Demo something publicly without opening the router
Best for: “Show this localhost app to a teammate for twenty minutes,” webhook smoke tests, temporary HTTPS demos Fixes: Port forwarding on a consumer router, “just put it on a $5 VPS for the meeting” Watch out: Funnel puts a service on the public internet via Tailscale’s relays. That is the opposite of the usual Tailscale pitch. Use it on purpose, not because Serve and Funnel share adjacent docs.
Serve stays private to the tailnet. Funnel is the “yes, strangers with the URL can hit this” switch. Same family of CLI, completely different threat model.
Sensible Funnel uses:
- A short-lived demo of a web app bound to localhost
- Proving a webhook receiver works before you buy real infra
- Sharing a read-only page without punching
443on the home gateway
Bad Funnel uses:
- Your password vault
- Admin UIs with weak or default logins
- Anything you forgot was still running after the meeting
Turn it off when the demo ends. Prefer Serve for household and personal access. Prefer a real reverse proxy and domain when you’re hosting something for the long haul. Funnel is a spotlight, not a foundation.
Same port can’t be Serve-private and Funnel-public at once in the way people often hope. The most recent config wins. Read the status output before you paste a URL into a group chat.
Which recipe when
| You need… | Reach for… | Skip if… |
|---|---|---|
| Hotel egress that looks like home | Exit node | You only need one private app |
| HTTPS URL for a localhost app | Serve | The app is already on a proper public domain |
| Printer / camera / dumb LAN gear | Subnet router | Every device can run Tailscale itself |
| Shell access without key chaos | Tailscale SSH | You refuse any identity outside classic keys |
| Quick file handoff | Taildrop | You need ongoing sync or backups |
| One box for an outsider | Node sharing | They need broad LAN access (rethink the design) |
| Temporary public demo | Funnel | The service should stay private forever |
Default order for a new homelab: MagicDNS → Serve on one app you use weekly → ACLs before you invite family → subnet routes only when a dumb device forces it → exit node when travel actually hurts → Funnel almost never.
Bandwidth and device limits depend on plan. Personal use is usually fine on the free tier; check tailscale.com/pricing rather than trusting a screenshot from last year.
Bottom line
Tailscale stops being “that WireGuard wrapper” the day you use it for a job that used to mean port forwarding, a commercial VPN, or a USB stick. Exit node for travel. Serve for private HTTPS. Subnet router for the junk that can’t join the mesh. SSH and sharing for humans. Taildrop for one-off files. Funnel only when you mean public.
Install once if you haven’t: reach your home server with Tailscale. Then pick one recipe above and make it boring. Boring mesh access is the whole product.
