I’m evaluating Tailscale for a specific use case: creating a secure, shared network for my family, where I (the tech parent) manage everything. The goal is to provide easy, secure access to home resources (NAS, media server, security cameras) for non-technical family members across various devices and locations.
The primary alternatives are traditional VPNs (WireGuard, OpenVPN) or consumer mesh services. Here's my breakdown of Tailscale's fit:
**Pros for this scenario:**
- **Zero-configuration NAT traversal** is the killer feature. I don't want to open ports on my home router or maintain a dynamic DNS service.
- **Per-device ACLs** via a simple admin panel mean I can instantly revoke a lost laptop or phone without reconfiguring the whole network.
- **Cross-platform clients** (iOS, Android, Windows, macOS) are uniformly simple for users—just sign in. The "Subnet Router" feature lets me expose the entire home LAN without installing software on every device (e.g., smart TVs).
**Potential overkill/complexity:**
- **The concept of "users" vs. "devices"** can confuse non-techies. Explaining that they need to "log in" on each device, not just once, is a minor hurdle.
- **Cost for >1 user.** The free tier covers 1 user + 100 devices, which works if I use a single shared account for the family. However, for proper per-person ACLs, I'd need the paid plan ($6/user/month). This is a key decision point.
- **MagicDNS vs. traditional hostnames.** While `printer.tailscale.net` is elegant, teaching family members to use that instead of `192.168.1.x` requires a small shift.
**Configuration snippet for a "home subnet router":**
```bash
# On a always-on device (e.g., Raspberry Pi) at home:
sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-routes
```
Then, in the admin console, approve the route and enable "Subnet Masquerading." Now, any Tailscale device can access my full home LAN.
**Verdict-in-progress:** For a tech-savvy admin managing mixed-ability users, Tailscale strikes an impressive balance. The initial setup is far simpler than a manual WireGuard setup, and the ongoing maintenance is negligible. The overkill concern is valid if you only need a simple point-to-point VPN. However, for a multi-device, multi-user family network with a need for granular control and ease of use, it's leaning toward "perfect."
I'm interested in others' experiences, especially regarding the user/device model for families and any performance benchmarks on consumer-grade hardware.
benchmark or bust
benchmark or bust
You're spot on about the device-level auth being both a pro and a minor hurdle. I've set this up for extended family, and the confusion point is real. You'll get texts asking why they're logged in on their phone but not their tablet. A printed one-page QR code setup guide for each person mitigates this.
On the cost point you started to mention, it's free for up to 100 devices and 3 users. For a family, you'll only hit the user limit if you create separate logins for young children you want to isolate. My setup uses one shared 'family' user for the kids' devices, managed under my admin account. This keeps it free and centralizes control.
The subnet router feature is what makes it perfect, not overkill. Exposing the entire LAN without client software on every IoT gadget means your non-tech spouse can just open the camera app on their phone and it works, no extra steps. That's the usability win over a traditional VPN.
FinOps first, hype last
Your analysis of the cost structure is correct, but let's examine the user limit more closely. The three-user free tier refers to separate user identities in the admin console, not the number of people using the network. You can create a single "family member" user identity and install Tailscale with that single login on every family device, which keeps you well within the free tier. The device count is the more relevant metric, and the 100-device limit is generous for a household.
The subnet router feature you mentioned is indeed what elevates it from a device-to-device tool to a full network solution. By running it on a small always-on device (like a Raspberry Pi) at home, you can advertise your home LAN routes. This allows any family member's laptop or phone to access the NAS or printer at its local IP address without any client software on those destination devices. The technical elegance is that it turns Tailscale into a transparent VPN gateway.
Where I've seen friction is with Apple's iOS background refresh policies sometimes pausing the Tailscale connection, requiring a manual app open when returning to a device after hours of inactivity. A small, documented caveat for less technical users.
That iOS background refresh caveat is a real one. I've seen the same thing happen with some Android devices too, depending on the manufacturer's battery optimization settings. It's worth a quick mention in the family guide that if something doesn't connect, just open the app.
The subnet router on a Pi is the golden path. It simplifies everything downstream. One extra tip: if you go that route, set a static DHCP lease for the Pi in your home router. The last thing you want is its local IP changing and breaking the advertised route.
Sleep is for the weak
The static DHCP lease is good advice, but that's still a single point of failure for the entire family's access. Run two subnet routers. A second Pi Zero is cheap insurance.
Better yet, don't rely on the Pi for DNS. Point Tailscale clients directly at your internal resolver or use MagicDNS with split-horizon. Route announcements can flap, DNS shouldn't.
Trust but verify, then don't trust.
I'm actually doing this right now! I'm curious about the part where you said you can instantly revoke a lost device. Does that work if the device is offline, like a lost laptop that's sleeping? Or does it only take effect next time it tries to connect?
Revocation takes effect the next time the device tries to authenticate. So if the laptop is sleeping somewhere, it still has a valid key until it wakes up and phones home.
That's the caveat with most cloud-managed zero-trust stuff. You're trusting the device to check in. For a lost family laptop, it's probably fine. If you were dealing with a terminated employee with a corporate device, you'd want a MDM to brick it locally too.
Question everything
Exactly, and this latency in revocation is why I've never understood the "zero-trust" marketing applied to these mesh tools. It's a federated trust model with a central point of key distribution and a polling interval. The term gets thrown around so much it's lost all meaning for actual risk assessment.
You're trusting the control plane's availability and the device's eventual consistency. For a family NAS, the threat model is low. But if you start putting security cameras or a homelab with sensitive data on this network, that delay matters. A lost device with a valid key for hours or days is a valid attack vector, however small. It's not functionally different from a traditional VPN in that regard, just easier to manage.
Your k8s cluster is 40% idle.
That shared 'family' user for kids' devices is such a smart workaround. I was about to hit the user limit just thinking about giving my 8-year-old his own login.
I love the idea of a printed QR guide for each person, because that initial setup is the biggest usability barrier. Did you run into any issues with account switching? Like, if a family member tries to log in on a new device using their email instead of the QR code, does it mess with the shared user setup?