I’m evaluating Tailscale for a specific use case: creating a secure, shared network for my family, where I (the tech parent) manage everything. The goal is to provide easy, secure access to home resources (NAS, media server, security cameras) for non-technical family members across various devices and locations.
The primary alternatives are traditional VPNs (WireGuard, OpenVPN) or consumer mesh services. Here's my breakdown of Tailscale's fit:
**Pros for this scenario:**
- **Zero-configuration NAT traversal** is the killer feature. I don't want to open ports on my home router or maintain a dynamic DNS service.
- **Per-device ACLs** via a simple admin panel mean I can instantly revoke a lost laptop or phone without reconfiguring the whole network.
- **Cross-platform clients** (iOS, Android, Windows, macOS) are uniformly simple for users—just sign in. The "Subnet Router" feature lets me expose the entire home LAN without installing software on every device (e.g., smart TVs).
**Potential overkill/complexity:**
- **The concept of "users" vs. "devices"** can confuse non-techies. Explaining that they need to "log in" on each device, not just once, is a minor hurdle.
- **Cost for >1 user.** The free tier covers 1 user + 100 devices, which works if I use a single shared account for the family. However, for proper per-person ACLs, I'd need the paid plan ($6/user/month). This is a key decision point.
- **MagicDNS vs. traditional hostnames.** While `printer.tailscale.net` is elegant, teaching family members to use that instead of `192.168.1.x` requires a small shift.
**Configuration snippet for a "home subnet router":**
```bash
# On a always-on device (e.g., Raspberry Pi) at home:
sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-routes
```
Then, in the admin console, approve the route and enable "Subnet Masquerading." Now, any Tailscale device can access my full home LAN.
**Verdict-in-progress:** For a tech-savvy admin managing mixed-ability users, Tailscale strikes an impressive balance. The initial setup is far simpler than a manual WireGuard setup, and the ongoing maintenance is negligible. The overkill concern is valid if you only need a simple point-to-point VPN. However, for a multi-device, multi-user family network with a need for granular control and ease of use, it's leaning toward "perfect."
I'm interested in others' experiences, especially regarding the user/device model for families and any performance benchmarks on consumer-grade hardware.
benchmark or bust
benchmark or bust
You're spot on about the device-level auth being both a pro and a minor hurdle. I've set this up for extended family, and the confusion point is real. You'll get texts asking why they're logged in on their phone but not their tablet. A printed one-page QR code setup guide for each person mitigates this.
On the cost point you started to mention, it's free for up to 100 devices and 3 users. For a family, you'll only hit the user limit if you create separate logins for young children you want to isolate. My setup uses one shared 'family' user for the kids' devices, managed under my admin account. This keeps it free and centralizes control.
The subnet router feature is what makes it perfect, not overkill. Exposing the entire LAN without client software on every IoT gadget means your non-tech spouse can just open the camera app on their phone and it works, no extra steps. That's the usability win over a traditional VPN.
FinOps first, hype last