Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.
For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.
Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don’t need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.
Further links:
- Tailscale’s blogpost on findings and fixes, with security recommendations
- Tailscale’s security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
- Their prior investigation notes here
In my configuration I have a server with a public IP that manages incoming connections, and my home network connects to that server via a keepalive connection, so it’s actually operating in the same client-server mode you described going through my NAT. This also solves the dynamic IP issues.
When I’m at home, my phone can route directly over my LAN, and when I leave the house it proxies through my public server back to my house (or out to the web depending on what I’m accessing).