Tailscale made remote access feel effortless. I used it to reach my NAS, share files with family, and move backups from anywhere without port forwarding, firewall rules, or a public IP.
For months, it worked exactly as promised. My devices connected from anywhere, my services stayed private, and the setup required almost no maintenance. That’s why I didn’t think twice about configuring my entire home server on Tailscale.
Everything was great, until it suddenly wasn’t, and I learned that Tailscale isn’t always the right platform for every self-hosted service.
I thought Tailscale could solve all my self-hosting problems
The convenience made me stop questioning it
Once Tailscale solved remote access for me, I started treating every networking problem like another reason to use it. Streaming Jellyfin, sharing photos with family, hosting a private chatroom, querying my Kiwix server, and accessing all kinds of tools I hosted. Instead of asking if that service was better accessed with something else, I kept finding ways to fit it into my tailnet.
I first noticed the problem when I tried to access Home Assistant away from home. The Home Assistant companion app showed “Insecure connection blocked” and wouldn’t let me connect because my Home Assistant instance used HTTP rather than HTTPS. The app only permits unencrypted HTTP connections on my trusted home network, so I had to go back to my phone’s browser instead.
I then hosted a free and open-source Google Keep alternative for friends and family through Tailscale. The problem was that Tailscale’s free Personal plan supports up to six users, so each person had to download Tailscale and create an account to join. Since there were seven of us in total, I had to sign in on a family member’s device using my own account so they could access the network, which was obviously inconvenient.
Another problem came up when I tried streaming my movie collection through Jellyfin. The quality was poor, and it buffered frequently, even though my cellular connection was fast enough to stream 4K YouTube. I later found out that a fast connection does not always mean Tailscale can establish a direct peer-to-peer connection. When NAT traversal fails, Tailscale uses a DERP relay, causing added latency and overhead. In my case, that was enough to make Jellyfin buffer and noticeably reduce streaming quality.
I could still use Tailscale in all instances, and that’s the problem.
When Tailscale is the right choice for your home server
Use Tailscale for private access
After forcing Tailscale into every part of my home server, I learned the real question isn’t whether Tailscale works. It almost always does. The better question is whether the limitations and possible compromises are acceptable.
For me, Tailscale is still the right choice when I need secure access to self-hosted services that I host for personal use. I use it for TrueNAS, Odysseus, LM Studio, Ollama, and a few admin dashboards. This makes more sense since I’m the only person who needs access and I already have the app installed and configured.
Tailscale also makes sense for services that you want only a limited number of people to use. I share Project NOMAD, Memos, and PhotoPrism this way. As said, Tailscale lets you add up to six people to your tailnet on a free personal account, but you can add more accounts with a paid plan.
When you should use something other than Tailscale
Other access points that may be better for your home server
For maximum ease of sharing tools or projects I self-host on my machine, I now lean toward Cloudflare Tunnel instead of Tailscale. Instead of asking relatives to install an app and create an account, I can give them a normal web address instead. Cloudflare Tunnel creates an outbound connection from my server to Cloudflare, so I do not need to expose inbound ports or have a public IP address.
I also suggest skipping Tailscale for services that need to be publicly available. A public website, game server, or Plex/Jellyfin instance for friends outside my household may work better through a reverse proxy or Cloudflare Tunnel than inside a private mesh. Jellyfin itself lists reverse proxies and VPNs as common ways to provide external access, while warning that directly exposing ports to the internet is not recommended.
Plain WireGuard is another option I now consider for simple, personal connections. If I only need to reach one or two machines, manual WireGuard setup gives me direct control over peers, keys, and routing. It is less convenient than Tailscale, but it avoids relying on a hosted coordination service and can be a good fit for someone who enjoys managing the details.
You may also want more ownership over your networking setup. In that case, Headscale, a popular open-source implementation of the Tailscale control server, may be a good alternative. You will have to handle the operational burden that Tailscale’s hosted service normally manages, but you gain more control over your setup.
The right tool for each self-hosted service
Tailscale is still one of my favorite home-lab tools. It made remote access simple, secure, and almost maintenance-free, but that convenience made me overlook its limits. I kept forcing every service into my tailnet, even when a Cloudflare Tunnel, reverse proxy, or plain WireGuard made more sense.
The best setup is not the one with the fewest tools. It is the one that matches each service to the people using it. Keep Tailscale for private, personal access. Use other options when you need easier sharing, public availability, more control, or better performance. Once I stopped treating Tailscale as the answer to everything, my home server became easier to use and much less of a burden to the people I want on the network.