Tailscale
Puts every device on a private network that works from anywhere, without port forwarding.
Homebrew cask Mac App Store Direct download
What it does
Tailscale builds a mesh VPN on WireGuard. Each device gets a stable 100.x.y.z address inside your tailnet and connects directly to the others, punching through NAT where possible and relaying when not. Identity comes from an SSO login rather than shared keys, and access between devices is controlled by an ACL policy file.
For a homelab it removes the entire class of problem that is exposing services to the internet:
- no port forwarding, no dynamic DNS, no reverse proxy needed just for remote access,
- MagicDNS gives devices real names,
- a subnet router exposes a whole LAN segment to the tailnet,
- an exit node routes all your traffic through a chosen device,
- Tailscale SSH handles authentication and key management for you.
Notes
- The free tier covers personal use generously.
- Headscale is a self-hosted, open-source control-plane implementation if depending on Tailscale’s coordination server is unacceptable.
- The cask token is
tailscale-app; the oldertailscaleformula is the CLI-only build.
Alternative to
| Alternative | Type | Trade-off |
|---|---|---|
| Headscale | Open source | An open-source, self-hosted implementation of Tailscale’s control plane |
| NetBird and ZeroTier | Open source / Freemium | The closest direct competitors, both self-hostable |
| Nebula | Open source | Slack’s mesh VPN; more work to run, no coordination service to trust |
| Plain WireGuard | Open source | No NAT traversal, no key distribution, but nothing else to trust either |
| Cloudflare Tunnel | Freemium | For exposing a service rather than joining a network |
Install
brew install --cask tailscale-app