Skip to main content

​
Tailscale Runbook

​
Overview

Tailscale creates a secure private network (VPN) between your devices. Think of it as making all your devices appear to be on the same local network, no matter where they are in the world.

​
Initial Setup

​
On Your Arch Linux PC

  1. Install Tailscale:
sudo pacman -S tailscale
  1. Enable and start the service:
sudo systemctl enable --now tailscaled
  1. Connect to Tailscale:
sudo tailscale up
  1. Authenticate:
    • This will give you a URL to visit in a browser
    • Sign up/login with your Google, Microsoft, or GitHub account
    • Authorize the device
  2. Check your Tailscale IP: 
tailscale ip -4
  • You’ll get an IP like 100.x.x.x - this is your Tailscale IP
  • Write this down or remember it
  1. Set a machine name (optional but recommended):
sudo tailscale up --hostname=arch-desktop

​
On Your Remote Machine (laptop, work computer, etc.)

Linux/Mac: Windows:
  • Download the Tailscale Windows client
  • Install and sign in with the same account
Android/iOS:
  • Install the Tailscale app from app store
  • Sign in with the same account

​
Daily Operations

​
Connecting to Your Arch PC via SSH

From any Tailscale-connected device: 
ssh your-username@100.x.x.x
Or using the hostname: 
ssh your-username@arch-desktop
First time connecting:
  • You’ll see a fingerprint warning - type yes
  • Enter your Arch PC password

​
Checking Connection Status

See all connected devices: 
tailscale status
Check if Tailscale is running: 
sudo systemctl status tailscaled
See your current Tailscale IPs: 
tailscale ip

​
Starting/Stopping Tailscale

Disconnect (but keep service running): 
sudo tailscale down
Reconnect: 
sudo tailscale up
Stop the service entirely: 
sudo systemctl stop tailscaled
Start the service: 
sudo systemctl start tailscaled

​
Useful Commands

​
Ping Test

Check if your Arch PC is reachable: 
tailscale ping arch-desktop

​
List All Devices

tailscale status

​
Check Tailscale Logs

If something isn’t working: 
sudo journalctl -u tailscaled -f

​
Remove a Device

From the web admin panel: https://login.tailscale.com/admin/machines

​
Configuration Tips

​
Setting Up SSH Keys (Passwordless Login)

On your remote machine, generate a key if you don’t have one: 
ssh-keygen -t ed25519
Copy your public key to your Arch PC: 
ssh-copy-id your-username@arch-desktop
Now you can SSH without entering a password. MagicDNS lets you use hostnames instead of IPs.
  1. Go to https://login.tailscale.com/admin/dns
  2. Enable MagicDNS
  3. Now you can use: ssh user@arch-desktop instead of ssh user@100.x.x.x

​
Subnet Routing (Advanced)

If you want to access other devices on your home network through Tailscale: On your Arch PC: 
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale up --advertise-routes=192.168.1.0/24
(Replace 192.168.1.0/24 with your actual home network range) Then approve the subnet route in the Tailscale admin console.

​
Troubleshooting

​
Can’t Connect to Arch PC

  1. Check Tailscale is running on Arch PC:
sudo systemctl status tailscaled
  1. Check firewall isn’t blocking:
sudo systemctl status firewalld
If firewalld is active, allow Tailscale: 
sudo firewall-cmd --permanent --add-interface=tailscale0
sudo firewall-cmd --reload
  1. Verify both devices show up:
tailscale status
Both machines should appear in the list.
  1. Try pinging:
tailscale ping arch-desktop

​
“Connection Refused” When SSHing

  • SSH service might not be running on Arch:
sudo systemctl status sshd
sudo systemctl start sshd

​
Tailscale Won’t Start

  • Check logs:
sudo journalctl -u tailscaled -n 50
  • Try restarting:
sudo systemctl restart tailscaled
sudo tailscale up

​
Security Notes

  • Tailscale uses WireGuard encryption - it’s very secure
  • Your traffic does NOT go through Tailscale’s servers (except for NAT traversal coordination)
  • Each device needs to authenticate with your account
  • You can revoke device access anytime from the admin console
  • Enable 2FA on your Tailscale account for extra security

​
Web Admin Console

Access at: https://login.tailscale.com/admin/machines Here you can:
  • See all connected devices
  • Remove/disable devices
  • Set up ACLs (access control)
  • Configure DNS settings
  • View connection logs

​
Common Workflows

​
Accessing Files from Remote

Using SCP: 
scp arch-desktop:/path/to/file.txt ~/Downloads/
Using SFTP: 
sftp your-username@arch-desktop
Mounting via SSHFS: 
sudo pacman -S sshfs  # on Arch
mkdir ~/remote-arch
sshfs your-username@arch-desktop:/home/your-username ~/remote-arch

​
Running GUI Apps Remotely

ssh -X your-username@arch-desktop
firefox  # will open on your local display

​
Quick Reference

TaskCommand
Connect to Tailscalesudo tailscale up
Disconnectsudo tailscale down
Check statustailscale status
Get your IPtailscale ip
SSH to Arch PCssh user@arch-desktop
Test connectivitytailscale ping arch-desktop
View logssudo journalctl -u tailscaled -f

​
Notes

  • Tailscale IPs are in the 100.64.0.0/10 range
  • Free tier allows up to 3 users and 100 devices
  • Tailscale works through most firewalls and NATs
  • No need to configure port forwarding on your router
  • Works on mobile data, public WiFi, anywhere with internet