Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteInstall Tailscale through your VPS provider’s emergency SSH or web console, authenticate the server into your tailnet, and keep that console session open until a second device can reach the VPS over its 100.x address or MagicDNS name. The basic setup is curl -fsSL https://tailscale.com/install.sh | sh followed by sudo tailscale up. From there, you can leave the VPS as an ordinary tailnet member, enable Tailscale SSH, advertise a private subnet, or operate it as an exit node.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers each role, the forwarding and policy steps they require, verification, recovery paths, and security decisions that matter when the VPS hosts a game server or another private service.
As an Amazon Associate I earn from qualifying purchases.
What Tailscale changes on a Linux VPS
Tailscale adds the VPS to your tailnet and gives it a stable address in the 100.x range, plus an optional MagicDNS name. Tailnet members can then connect over an encrypted overlay instead of exposing every private service to the public internet. The VPS still has its provider-assigned public address, so this is not an automatic replacement for the provider firewall or for every public-facing application.
There are four distinct operating patterns:
- Ordinary tailnet member: the VPS receives connections from approved tailnet devices. It does not forward unrelated traffic.
- Tailscale SSH host: the VPS accepts SSH through the tailnet, with authentication and authorization controlled by tailnet policy and node keys.
- Subnet router: the VPS forwards traffic to machines on a private network that do not run Tailscale.
- Exit node: the VPS forwards a client’s non-Tailscale internet traffic, making the VPS the client’s apparent public egress point.
Choose the narrowest role that solves the problem. A game server running on the VPS normally needs only ordinary membership, and possibly Tailscale SSH for administration. Subnet routing and exit-node mode add forwarding, policy, and monitoring responsibilities.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Prepare the VPS before installing
Keep a recovery path open
Use the cloud provider’s initial SSH account or browser console for the first installation. Do not close that session or remove public SSH access until another enrolled device has successfully reached the VPS through Tailscale. If you make a policy or firewall mistake, the provider console is the way to repair it.
Confirm operating-system support and privileges
The Linux install script supports Ubuntu and Debian-family systems, RHEL, CentOS and Fedora derivatives, Raspberry Pi OS, Amazon Linux, openSUSE and SUSE, Oracle Linux, and VMware Photon OS. You need a user that can run commands with sudo, outbound internet access for package retrieval, and a running kernel with the networking features required by the role you select.
Record the network details you will protect
- Write down the VPS’s provider firewall rules and the ports that must remain publicly reachable.
- For a subnet router, identify the exact private CIDR ranges the VPS can route to, such as
192.168.50.0/24. Do not advertise a broad network simply because it is convenient. - For an exit node, decide whether clients should also retain access to their local LAN. Local-LAN access is disabled by default when an exit node is selected.
- For a game service, distinguish player-facing ports from administrative ports. A public game port may remain public while SSH and dashboards stay tailnet-only.
Install Tailscale on the VPS
Supported distributions: the installation script
From the provider’s emergency SSH or console session, run:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale upThe first command installs the package and service for the detected distribution. The second starts the device authentication flow. It prints a URL; open that URL in a browser, sign in to the tailnet, and approve the VPS. The command returns after the device is authenticated.
Piping a downloaded script to a shell is convenient but not appropriate for every change-control environment. Review the script and pin a package repository or package version when your organization requires a separately audited installation process.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Manual package installation
Manual package installation is available when you do not want to pipe a script directly to a shell. Use the package instructions for the VPS distribution, install the Tailscale package and service, then run sudo tailscale up and complete the same browser authentication. The exact package manager and repository steps vary by distribution, so keep the commands matched to the operating-system release.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Static binaries for other distributions
For distributions outside the script’s supported set, use a Tailscale static binary. Start tailscaled with a persistent state-file location, then run:
sudo tailscale upThe state file must survive a reboot; otherwise the VPS can appear as a new device or lose its node identity. Run the daemon under your system’s service manager and verify that it starts automatically before relying on the VPS for remote access.
Authenticate and verify the new tailnet member
Complete the browser login
- Run
sudo tailscale upon the VPS. - Copy the URL printed by the command into a browser that can sign in to the intended tailnet.
- Authenticate and approve the device if your tailnet requires administrator approval.
- In the admin console, open the Machines page and confirm that the VPS appears with the expected hostname and current key state.
Check local state
On the VPS, run:
tailscale statusUse the output to confirm that the daemon is connected, peers are visible, and the VPS has a Tailscale address. The address normally falls in the 100.x range. If MagicDNS is enabled for the tailnet, note the assigned DNS name as well.
Test from an enrolled client
- From another authorized tailnet device, connect to the VPS’s 100.x address or MagicDNS name.
- Test the specific service, not just reachability. For SSH, use the intended non-root administrative account. For a game server, connect with a client using the server’s tailnet address and game port.
- Confirm that the tailnet access policy permits the connection and that the service is listening on the expected interface and port.
Do not remove the provider’s emergency path until these tests work after a reboot. A successful login proves that the overlay is reachable; it does not prove that every application firewall, bind address, or policy rule is correct.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Use Tailscale SSH instead of exposing SSH broadly
Enable the built-in SSH service
After ordinary tailnet connectivity works, enable Tailscale SSH on the VPS:
sudo tailscale set --sshTailscale SSH uses tailnet policy for authentication and authorization and uses Tailscale node keys for the connection. It can provide tailnet-only administration while you transition away from allowing port 22 from the entire internet.
Roll out safely
- Create or verify a non-root administrative account on the VPS.
- Define the required grants or ACL rules for the administrators who should reach that account.
- From a second tailnet device, connect to the VPS’s MagicDNS name or 100.x address and confirm that the expected account is accepted.
- Only after this test succeeds, narrow the provider firewall’s SSH rule or remove broad public access to port 22.
- Keep the provider console available as a recovery path.
Tailscale SSH is documented for Linux devices and all plans. It does not grant access to users who are not allowed by your tailnet policy, so a working overlay alone is not sufficient.
Make the VPS a subnet router
Use subnet-router mode when tailnet devices must reach systems that cannot run Tailscale themselves, such as a private database, a console on a home LAN, or a separate game-management machine. The VPS must be able to route to that network, and the network must have a return path for the overlay traffic.
Enable packet forwarding
Enable IPv4 and, if you will route IPv6, IPv6 forwarding on the VPS. A typical Linux configuration is:
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
sudo tee /etc/sysctl.d/99-tailscale-forwarding.conf <<'EOF'
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
EOF
sudo sysctl --systemCheck the resulting values before advertising routes. Distribution firewalls may also need forwarding rules; enabling the kernel switches alone does not override a deny rule in your firewall.
Advertise only the required CIDRs
Replace the example network with the exact destination range reachable through the VPS:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo tailscale up --advertise-routes=192.168.50.0/24If the VPS is already configured with other options, include those options again when running tailscale up; command-line settings can replace the existing configuration. Advertise multiple ranges only when each one is intentional and documented.
Approve routes and write policy
- Open the tailnet admin console’s Machines page and locate the VPS.
- Approve the advertised route or routes.
- Add access rules granting only the required users, groups, or tagged devices access to those destinations.
- On a client device, verify that the route is installed and test a real service on the private network.
Linux normally uses kernel forwarding mode for subnet routing. If a destination has overlapping address space, a missing return route, or a firewall that blocks forwarding, the route can appear approved while connections still fail. Resolve the network path before advertising a larger range.
Use the VPS as an exit node
An exit node is different from a subnet router: it carries a client’s ordinary internet traffic through the VPS. Websites and services will generally see the VPS’s public egress address rather than the client’s local address. This increases bandwidth use and makes the VPS’s provider, region, and firewall policy part of the client’s browsing and application path.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Prepare forwarding and advertise the capability
Enable IPv4 and IPv6 forwarding as shown in the subnet-router section, then advertise the exit-node capability:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo tailscale up --advertise-exit-nodeApprove the VPS as an exit node in the admin console. Grant the intended users or devices access through tailnet policy; policies that use autogroup:internet are the documented way to express internet access where required.
Select the exit node on each client
Advertising an exit node does not force every tailnet device to use it. Each client must explicitly select the VPS as its exit node in the Tailscale client. After selection, verify the client’s public egress address from that client and test the applications that matter.
Local-LAN access is disabled by default while an exit node is selected. If a client must continue reaching printers, consoles, or other devices on its local network, enable the client option --exit-node-allow-lan-access and verify that the resulting split behavior is acceptable.
Account for capacity and exposure
- Do not assume a universal throughput or latency figure. Performance depends on the VPS provider, region, kernel, path, encryption workload, and concurrent users.
- Monitor CPU, memory, transfer volume, and provider bandwidth quotas while the exit node is in use.
- Use policy to limit who can select the node, and retire or revoke it promptly if the VPS is compromised.
Compare the four VPS roles
| Role | Does the VPS forward other traffic? | Is public SSH required? | Authentication pattern | Advertised scope |
|---|---|---|---|---|
| Ordinary tailnet member | No; it receives connections to its own services. | Not for tailnet access. Keep the provider path during bootstrap and recovery. | Interactive browser login, or a narrowly scoped automation credential. | The VPS’s own Tailscale identity and services. |
| Tailscale SSH host | No; it provides SSH over the overlay. | Can be removed or restricted after a successful tailnet SSH test. | Tailnet policy plus Tailscale node keys; test a non-root account. | SSH access to accounts explicitly allowed by grants or ACLs. |
| Subnet router | Yes; it forwards traffic to advertised private CIDRs. | No for routed services, once recovery access is proven. | Tailnet device identity and policy; automation still needs a scoped credential. | Only the approved CIDR ranges, such as 192.168.50.0/24. |
| Exit node | Yes; it forwards selected clients’ non-Tailscale internet traffic. | No for client traffic, after recovery testing. | Client selection plus policy access, commonly including autogroup:internet. |
Internet egress through the VPS; local-LAN access remains off by default. |
Firewall and hardening checklist
- Constrain the provider firewall: leave only bootstrap access and genuinely public application ports open. Private administration should move behind the tailnet after verification.
- Do not treat Tailscale as an application firewall: keep host-level firewall rules and game-server permissions aligned with the tailnet policy.
- Use least privilege for automation: for unattended enrollment, use a narrowly scoped auth key or supported workload-identity flow. Keep credentials out of shell history, unit files visible to untrusted users, and logs.
- Protect the state: ensure the Tailscale state file is readable only by the service and is included in your recovery plan.
- Update regularly: keep both the operating system and Tailscale package current, and document who can change routes, exit-node status, and SSH grants.
- Limit advertised networks: every additional CIDR expands the consequence of a policy error. Advertise the smallest set that serves the application.
- Separate game traffic from administration: expose a player port publicly only when needed; use tailnet addresses for dashboards, RCON, deployment, and SSH.
Reauthentication, device retirement, and compromise response
Tailscale devices periodically require reauthentication. To force a new login on the VPS, run:
sudo tailscale up --force-reauthDisabling key expiry reduces interruption for a trusted, tightly controlled device but lowers security. Reserve that choice for systems with strong physical, console, and account controls rather than using it as a default convenience.
When a VPS is retired, rebuilt, transferred, or suspected of compromise, revoke its keys promptly in the admin console and remove its advertised routes or exit-node authorization. Then rotate any unrelated credentials that may have been present on the host. Re-enroll the replacement VPS as a new device and repeat the verification process.
Troubleshoot by symptom
The install command cannot reach the service
- Use the provider console to confirm DNS resolution and outbound HTTPS.
- Check that the package installation completed and that the Tailscale service is running.
- Run
tailscale statusand repeatsudo tailscale upto obtain a fresh authentication URL.
The VPS appears in the admin console but clients cannot connect
- Confirm both devices are in the intended tailnet and that policy allows the destination port.
- Use the VPS’s 100.x address or MagicDNS name rather than its public address.
- Check that the application is listening on the expected interface and that the VPS host firewall permits the connection.
- Keep the provider console available while correcting rules; do not lock yourself out by changing every access path at once.
Tailscale SSH is denied
- Verify that
sudo tailscale set --sshwas run on the VPS. - Check the grants or ACLs for the user, source device, destination device, and requested Linux account.
- Test with the non-root administrative account specified in policy before attempting privileged escalation.
A subnet route is approved but the private host is unreachable
- Confirm IPv4 or IPv6 forwarding is enabled and persisted across reboot.
- Check firewall forwarding rules on the VPS and the private network’s return route.
- Look for overlapping CIDRs on the client. Advertise a more specific, intentionally chosen range only when the network design supports it.
The exit node is selected but the public address does not change
- Confirm the VPS is approved as an exit node and the client has policy access, including the required
autogroup:internetgrant. - Verify that the client actually selected the VPS, rather than merely having it available in the list.
- Check forwarding and provider firewall rules on the VPS, then recheck the public egress address from the client.
- If local devices stop responding, remember that local-LAN access is off by default and enable
--exit-node-allow-lan-accessonly when needed.
Operational checklist
- Keep provider SSH or console access open.
- Install Tailscale using the supported script, a manually managed package, or a persistent static-binary service.
- Run
sudo tailscale up, authenticate, and confirm the device on the admin console’s Machines page. - Test a real service from a second enrolled device using the VPS’s 100.x address or MagicDNS name.
- Enable Tailscale SSH only after ordinary connectivity works, and test a non-root account.
- If routing is required, enable forwarding, advertise only exact CIDRs, approve them, and apply least-privilege access rules.
- If internet egress is required, advertise and approve an exit node, grant policy access, select it on each client, and verify the public address.
- Restrict provider firewall exposure, protect automation credentials, update the host, and document recovery.
- Revoke keys and route permissions when the VPS is retired or compromised.
Performance and availability expectations
Official procedures describe how to install, authenticate, route, and authorize Tailscale, but they do not establish one universal setup-success rate, throughput benchmark, or latency number for every Linux VPS. Measure the provider, region, kernel, network path, and workload you actually use. For a game server, test player connections and administrative operations separately; an acceptable ping to the VPS does not guarantee sufficient performance for an exit-node workload or for traffic routed to another private network.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
