Tailscale: WireGuard P2P VPN ใช้งานง่าย - เชื่อมทุกเครื่องเหมือน LAN เดียวกัน
Tailscale สร้าง Zero-Config VPN ด้วย WireGuard รองรับ Win/Linux/Mac/iOS/Android Identity-based access Subnet router เน็ตต่ำ ฟรี 100 devices
Tailscale vs Traditional VPN
| Feature | Tailscale | OpenVPN/WireGuard |
|---|---|---|
| Setup | 1 คลิก | Port forward + Certs |
| NAT Traversal | Auto | Manual |
| Access Control | User-based | IP-based |
| Mobile | Seamless | Disconnects |
| Price | Free 100 devices | Self-hosted |
Core Architecture
Internet → Tailscale Coordination Server → WireGuard P2P
↓
DERP relays (if direct blocked)
Quick Setup (2 mins)
# Linux
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up# Windows/Mac: Download → Login → Done
# iOS/Android: App Store → Login
ACL Policies (JSON)
{
"acls": [
{"action": "accept", "src": ["user:[email protected]"], "dst": ["*:80", "*:443"]},
{"action": "accept", "src": ["tag:server"], "dst": ["*:*"]}
],
"tagOwners": {
"tag:server": ["user:[email protected]"]
}
}
Production Use Cases
🏠 Home Lab: Mac → Home Server (SSH/RDP)
💻 Remote Dev: Laptop → Office K8s
👥 Team VPN: 50 devs → Internal tools
🌐 Headless: Pi → Monitoring dashboard
🛠️ IoT: Phone → Raspberry Pi sensors
Subnet Router Magic
Office Router (no Tailscale):
192.168.1.0/24 → Tailscale Linux box → Your laptopSSH 192.168.1.100 from anywhere
RDP 192.168.1.50 from iPhone
Pricing Tiers
| Plan | Devices | ACL | Features |
|---|---|---|---|
| Personal | 100 | Basic | Free |
| Pro | 500 | Advanced | $6/user/mo |
| Enterprise | Unlimited | SSO+Audit | Custom |
Security Model
✅ WireGuard end-to-end encryption
✅ Noise protocol handshake
✅ Short-lived keys (24h)
✅ Identity-first (OAuth/OIDC)
✅ Device approval workflow
✅ Audit logs (Enterprise)
MagicDNS
tailnet.ts.net → 100.64.x.x (CGNAT)
phone.tail123.ts.net → iPhone
server.tail123.ts.net → Ubuntu
db.tail123.ts.net → PostgreSQL
Advanced Features
🔒 ACL: User/group/tag-based
🌐 Exit Node: Route all traffic
🔄 SSH: Built-in (no keys)
📱 Mobile: Always-on VPN
⚙️ Exit Node: PiVPN replacement
Migration from Competitors
ZeroTier → Tailscale: 10 mins
OpenVPN → Tailscale: Kill server
WireGuard → Tailscale: Remove configs
Hysteria → Tailscale: NAT works
ngrok → Tailscale: TCP/UDP + SSH