When I was a beginner in this field, I used an old_ssh_keys folder. Every time I set up a new Proxmox container, a test VPN, or a Raspberry Pi, I'd generate a key, copy it over, and inevitably lose track of which key went to which machine. When I was outside home and my server went down or had other errors and I needed to fix something on my server, I'd realize the private key was sitting on my desktop PC. So in this situation, we needed a solution. As a solution to this, I set up 'port-forwarding 22' on my router, which resulted in my logs getting filled up.
Tailscale has completely changed how we handle remote access, moving us away from opening router ports and wrestling with VPN configs. But their best trick is Tailscale SSH. This setup requires no open server ports, no managing of SSH keys, and no exporting of port 22 to the wild west of the internet.
In this guide, we'll walk through how to set it up and tweak the access rules.
Why bother with Tailscale SSH?
If you manage a homelab or cloud instances, you know that SSH keys are a pain. Generating them, copying them around, and tracking them can sometimes become complicated. Tailscale SSH fixes this by tying your SSH access directly to your Tailscale login.
- Tailscale handles the authentication in this setup. You don't need .pem files or id_rsa.pub. If you can log into Tailscale, you can log into your server.
- You don't need to expose port 22 on your firewall, so it is secure with no open ports.
- Using Tailscale rules, you can say exactly who can log into which machine and what user account they get to use.
- You can force yourself to re-authenticate in a browser before logging into sensitive boxes.
The Zero-Trust Test Lab
First, we're going to spin up a free AWS server, enable Tailscale SSH, and then completely block the internet from talking to it.
Spin up the server
First, log into your AWS Console and go to EC2 > Launch Instance. Name this instance something like tailscale-test. Pick Ubuntu Server 24.04 LTS or 26.04 LTS and a free-tier t2.micro or t3.micro size. Create a new Key Pair (e.g., tailscale-key.pem) and download it. We only need this key one time. In Network Settings, make sure Allow SSH traffic from Anywhere is checked. Launch it and copy its new Public IPv4 address.
[Note: This portion is only for beginners who are learning how Tailscale works.]
Install and enable
Open your PC or laptop's terminal, use the below command to fix the permissions on the key file you downloaded, and SSH into the new server. (Note: Replace AWS_PUBLIC_IP with the actual IP address you copied from the AWS console).
chmod 400 tailscale-key.pem ssh -i tailscale-key.pem ubuntu@AWS_PUBLIC_IP
Once you are logged into the AWS machine, run the below command to install Tailscale.
curl -fsSL https://tailscale.com/install.sh | sh
Now, configure your server to accept SSH connections coming through your Tailscale network.
sudo tailscale up --ssh
It will give you a URL. Copy it, paste it into your browser, and log in to add the server to your network.
Make sure you also have Tailscale installed on your local laptop. If it is not installed, install it first.
Update your Tailscale rules
By default, Tailscale won't let anyone SSH in. You have to explicitly allow it in your admin console.
Go to the Access Controls page in your Tailscale dashboard. Scroll down until you find the "ssh" section in the code editor. In this block, replace the SSH block.
"ssh": [
{
"action": "accept",
"src": ["autogroup:admin"],
"dst": ["autogroup:self"],
"users": ["ubuntu"]
}
]
Then Save.
The magic trick
Type exit in your terminal to drop your current SSH connection to the AWS server. Then go to your Tailscale dashboard and find the Tailscale IP of your new AWS machine (it starts with 100.). SSH into the server using that new IP.
ssh [email protected]
You can connect without needing a .pem key and without needing a password.
Now to prove it's secure:
Go back to your AWS Console, find the Security Group attached to your instance, and delete the inbound rule for Port 22 (SSH).
If you try connecting using the public AWS IP, it will sit there and time out. The server is completely dead to the internet, but if you use the Tailscale IP, your connection will be live.
The finer details
Tailscale SSH is easy to set up, but it has a few neat features hiding under the hood.
Check Mode
If you want to be serious about your server security, you can change the action in your Tailscale rules from accept to check.
"ssh": [
{
"action": "check",
"src": ["autogroup:admin"],
"dst": ["autogroup:self"],
"users": ["ubuntu"]
}
]
Copying files (SCP/SFTP)
Tailscale SSH works perfectly with scp and sftp. You can copy files from your server to your laptop and from your laptop to your server over different internet connections.
scp local-file.txt [email protected]:/path/to/destination/
Conclusion
Tailscale SSH is a massive quality-of-life upgrade. I no longer need that old_ssh_keys folder. I never have to panic about whether I accidentally left port 22 open on my router for the world to see. Using Tailscale, you can easily connect to your server even if you are outside of your home. You don't need to worry about SSH.
