Tailscale Network Topology

Tailscale builds a private WireGuard mesh (a tailnet) where each device gets a stable address and name, reachable from anywhere without opening router ports — an ideal backbone for a home-lab fleet.

#Why it's the backbone

• No public SSH. Port 22 is never internet-exposed; reach hosts over the tailnet (SSH Hardening).
• Name-based access. ssh user@node-name works from any enrolled device.
• Jump hosts. Reach a restricted node by hopping through another.

tailscale status                 # see every device
ssh -J jump-host user@target     # hop through a jump box

#Serve vs public tunnel

Harden with ACLs. Tailscale ACLs restrict which devices can reach which services, so a compromised node can't roam freely. Pair with a host firewall.

Related: Home Lab Fleet Architecture · Tailscale Serve on 443 While Apache Stays on 80 · SSH Hardening