Think of Tailscale as a private network cable that connects your laptop, phone and servers wherever they are. Used well, it lets you close Remote Desktop and SSH to the internet completely, so bots scanning for open ports find nothing, while you still connect in one click.

What Tailscale actually is

Tailscale is a mesh VPN built on WireGuard, a modern, fast encryption protocol. A traditional VPN sends all traffic through one central server. Tailscale instead creates direct, encrypted tunnels between your own devices, so your laptop talks straight to your server. It is usually faster, and there is no central box to maintain.

Every device you add gets a private address in the 100.x.y.z range that stays the same wherever the device is. You can also reach devices by name (for example windows-server) using Tailscale’s MagicDNS.

Why it matters for servers

1. No router or port-forwarding work

Normally, reaching RDP or SSH from outside means port forwarding, static IPs and firewall exceptions. Tailscale gets through NAT and firewalls on its own: install it, log in, and the devices can see each other.

2. Your server becomes invisible

If port 3389 (RDP) or 22 (SSH) is open to the internet, automated bots will find it and start guessing passwords within hours. With Tailscale you close those ports publicly. Anyone scanning your server’s IP sees nothing to attack; only devices on your private Tailscale network can connect.

3. Access from anywhere, even with a changing IP

Whitelisting your office IP breaks the day your ISP changes it. Tailscale addresses don’t change, so you can whitelist them in firewalls and databases and connect the same way from home, a hotel or your phone.

Part 1: Set up the Windows server (RDP host)

  1. Install Tailscale for Windows and log in with your identity provider (Google, Microsoft, GitHub and others).
  2. Turn on “Run unattended”: right-click the Tailscale tray icon → Preferences → Run unattended. This keeps Tailscale running after a reboot even when nobody is logged in. Skip it and you can lock yourself out after the next restart.
  3. Note the server’s Tailscale address: it’s shown at the top of the Tailscale menu (100.x.y.z).
  4. Disable key expiry for the server: in the Tailscale admin console, find the server → ⋯ → Disable key expiry. By default a device must re-authenticate every 180 days, which is fine for laptops but not for an unattended server.

Part 2: Lock RDP to Tailscale only

Before you start

Test that you can connect over Tailscale (Part 3) before closing public access, and keep your provider’s console or KVM access handy in case you need a way back in.

Restrict both Remote Desktop firewall rules to the Tailscale range 100.64.0.0/10:

  1. Open Windows Defender Firewall with Advanced Security → Inbound Rules.
  2. Open Remote Desktop – User Mode (TCP-In) → Scope tab → under Remote IP address choose These IP addresses → Add 100.64.0.0/10 → OK.
  3. Do the same for Remote Desktop – User Mode (UDP-In).

Or run this in an administrator PowerShell:

Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -RemoteAddress 100.64.0.0/10
Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (UDP-In)" -RemoteAddress 100.64.0.0/10

If your cloud provider also has a firewall or security group, remove the public rule for port 3389 there too.

Part 3: Connect from your laptop or phone

  1. Install Tailscale on your device and log in with the same account.
  2. Open your Remote Desktop app and use the server’s Tailscale address (100.x.y.z) or its MagicDNS name as the computer name.
  3. Sign in with your normal Windows credentials.

Bonus: do the same for SSH on a Linux server

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4                 # the server's 100.x.y.z address

# allow SSH only over Tailscale, then remove the public rule (UFW example)
sudo ufw allow in on tailscale0 to any port 22 proto tcp
sudo ufw delete allow 22/tcp

Connect with ssh [email protected]. The same warning applies: confirm the Tailscale connection works before you remove public SSH access, and keep console access available.

Managing it day to day

  • Access control: use Tailscale’s ACLs so only the right people reach each server, for example admins to RDP and developers to staging only.
  • Remove old devices from the admin console when a laptop is replaced or someone leaves.
  • Keep Tailscale updated on servers like any other package.
  • Keep strong passwords and MFA on Windows and SSH anyway. Tailscale hides the door; it doesn’t replace the lock.

Frequently asked questions

Tailscale has a free plan for personal use and small setups, and paid plans for teams. Check their current pricing, as plan limits change from time to time.

Yes. Tailscale removes public exposure, but good passwords, MFA and updates are still your second layer of defence.

Use your hosting provider’s web console or KVM to log in and fix it. That is why you should confirm console access before closing public ports.

For most small teams, yes: it is simpler to run and gives direct device-to-device connections.

Related services

Server Firewall Setup Server Hardening & Security Brute Force Protection Remote & On-site Support