Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.
For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.
Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don’t need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.
Further links:
- Tailscale’s blogpost on findings and fixes, with security recommendations
- Tailscale’s security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
- Their prior investigation notes here
Just to clarify, this is only exploitable for people which already has access to your tailnet. So people you already gave access. External attackers can’t do anything. But keep your software updated as always.
This feels like it has validated my decision to just use plain wireguard and hardcode my client list. It’s really not too hard to set up, barely different that configuring authorized_keys or ssh.
Tailscale ssh isn’t enabled by default and I for one don’t see the need for it.
Your choice is valid, but you’ve chosen to be responsible for adding new clients everywhere and making sure they can all connect to each other, etc. you have simpler software but more manual work, which is a valid choice if you’re up for it.
Also, I’ve never been able to understand how something exposed to the entire internet (a WG server) is considered more secure than something that only connects peers privately to each other.
The attack surfaces are nothing alike.
Even if you limit access to WG with IP blocking there’s still no comparison to something you can’t access at all from outside.
I don’t see it as there being much of a distinction from the two when you say one is public and the other isn’t, i don’t really see it that way. Wireguard may be more obviously public, but they both technically are, right? Otherwise accessing a node just wouldn’t be possible.
If you don’t need something specific that tailscale offers, then wireguard offers probably better security.
Tailscale uses wireguard, but using wireguard itself is removing all of the extra code and services (their connection facilitation layer?) that go with using tailscale.
Tailscale probably isn’t an inconsiquential amount of code added, so it can be a threat, even if it adds additional security layers (identity?). There’s more code to exploit.
Plus, wireguard is so well used directly by so many businesses, orgs and people who NEED it to be secure, and it has so many more eyes going over it that it I can’t see any way that it would be less secure.
Edit: have never used tailscale cuz i dont need it, so maybe im completely wrong about something, dont think i am tho im confident
Wireguard may be more obviously public, but they both technically are, right? Otherwise accessing a node just wouldn’t be possible.
There is something exposed to the Internet in both cases, yes, but it works very differently.
With WG it’s a client-server pattern; the server exposes a port, waits for authorized clients to connect, and when a client connects successfully the server routes their connections into the private LAN with everything that entails.
With TS the public part is a supplier of control configurations and client pairing service. The pairing service needs to be contacted by two authorized clients in order to negotiate a connection between them. Once that’s done, it’s the clients that route each other’s connections into their respective LANs, the pairing server is not involved anymore.
In other words the TS public surface is not WG, it’s their (proprietary) client verification and matching service. The WG connections between clients happen later, privately.
To me, separating client authentication from routing and transport looks like a better design, because it’s multi-layered. You get the normal WG authentication and another layer on top.
If you don’t need something specific that tailscale offers, then wireguard offers probably better security.
“Security” is a relative term. It’s better to think in terms of attack surface, exposure, whether attacks are targeted or not etc. Which are all ongoing factors.
Both TS and WG are popular and being used by lots of people but it’s also important for them to be actively maintained, independently audited, maintain transparency etc.
In my configuration I have a server with a public IP that manages incoming connections, and my home network connects to that server via a keepalive connection, so it’s actually operating in the same client-server mode you described going through my NAT. This also solves the dynamic IP issues.
When I’m at home, my phone can route directly over my LAN, and when I leave the house it proxies through my public server back to my house (or out to the web depending on what I’m accessing).
That’s one of my TODOs on NixOS but I keep procrastinating on that. Today I finally set up adguard home locally on my PC and I want to make it available as a VPN(?) on my phone so I may finally get around to doing that soon-ish. I have zero clue how any of that works or how to set it up, however. Lol
This seems like a decent guide on how to set it up:
https://www.cyberciti.biz/faq/how-to-set-up-wireguard-firewall-rules-in-linux/
It’s very similar to the config I’ve got. The nat iptables stuff in step 1 is what enables wireguard to be used as a VPN exit node. (+ net.ipv4.ip_forward=1)
The only downside is that it’s not redundant. I wish it was, somehow.
Thanks for flagging this. Tailscale SSH is how I get into my Ubuntu Server boxes, so this one applies to me. The machines page in the admin console lists the client version for every node, which is the quickest way to spot the one box that didn’t take the update. Hosts that pull from Tailscale’s apt repo get it with normal updates, but anything installed another way, like a container image or a hand-installed binary on a cloud VM, can sit on an old version for a long time.
