How To Set Up Tailscale for a Private Mesh VPN on Ubuntu

A mesh VPN connects every device you own — servers, laptops, phones, a home LAN gateway — into one private network, reachable by a stable private address no matter where each device physically sits. Tailscale builds this on top of WireGuard, the fast, modern, kernel-level VPN protocol. If you've worked through a manual WireGuard setup before, you know the tedious part: generating a keypair per device, writing a peer block for every other device in every config file, and updating all of them again each time you add or remove a machine. Tailscale keeps WireGuard's tunnel and encryption but takes over the parts that don't scale by hand — key exchange, NAT traversal, and peer discovery — through its own coordination service. You install an agent, log in, and every device that joins reaches every other device directly, encrypted, with no manual peer configuration. This tutorial covers that lower-effort path: installing Tailscale, joining machines to a private network (a "tailnet"), verifying direct connectivity, and the two features you'll reach for next — exposing a whole subnet, and restricting which devices can talk to which.

Step 1 — Install Tailscale on Each Machine

Tailscale ships its own official install script and apt repository setup, and the exact command differs by Ubuntu release and changes over time as they update it. Rather than copying a command from a tutorial that may be stale, get it straight from the source:

# 1. On each machine, open https://tailscale.com/download in a browser
#    (or fetch it from the CLI with curl/wget if there's no browser on
#    the box) and select Ubuntu / Linux.
# 2. Copy the install command shown on that page and run it with sudo.
#    Use whatever the page currently shows — it's the authoritative,
#    current-for-your-release command, not something to reconstruct
#    from memory.

Repeat this on every machine you want on the mesh — a VPS, your desktop, a Raspberry Pi at home, whatever. Nothing here is Ubuntu-specific to Tailscale itself; the same install-and-join flow works on macOS, Windows, iOS, Android, and other Linux distributions, which is part of the point of a coordination-service-based mesh.

Step 2 — Authenticate and Join the Tailnet

sudo tailscale up

On a machine with a browser, this opens a login page. On a headless server, it prints a URL to the terminal instead — copy it into a browser on any device (your laptop, your phone) and log in there. Tailscale supports several identity providers for this login — Google, Microsoft, GitHub, or plain email — pick whichever one you want the tailnet tied to; there's no single required provider. The first machine you authenticate creates your tailnet (effectively your private network's identity); run the same command on every other machine and sign in with the same account to add it to that same tailnet.