What the Private Network (Tailscale) Is: Log In Once, Stay Online, Reach Your Own Devices

• Always on: once logged in, the device stays in the network through reboots, Wi‑Fi changes and Wi‑Fi-to-mobile handoffs; the connection restores itself. A traditional VPN needs a click to connect and a reconnect after every drop.
• The exit is optional: with no exit selected, public traffic uses the local network and only traffic to other private-network devices is encrypted; with a region’s exit selected, everything leaves from that region, the same as a VPN. Switching exit is one click in the menu — no new address, no new login.
• Devices reach each other: phone, laptop and home NAS on the same account each get a private address and can connect directly, with no port forwarding on the router and no public IP required.

• Several devices and a wish to configure once and stay online: log in on the phone and laptop once, then only occasionally change exit region.
• A NAS, PC or camera at home to reach from outside: log both ends into the private network and connect by device name or private address, as at home.
• Devices that must stay up for long periods: there is no session timeout.
• Not suited: one-off use, or a device already running a corporate VPN — two networking tools fight over DNS and routes; see the end.

1. Install the official Tailscale client. Windows, macOS, Linux and Android from the download area on this site’s private-network page; iPhone and iPad from the App Store (non-China Apple ID required).
2. If you have ever logged in to an official Tailscale account, log out first: tap the avatar → Log Out on a phone, or run tailscale logout on a computer. Without a clean logout the custom-server option in the next step does not appear.
3. Point the login at this site’s control server. Phone: on the logged-out screen tap “⋯” → Use custom server and enter the address shown on the private-network page. Windows / Linux: copy and run the tailscale up --login-server=… command from the page. macOS: Option-click the menu-bar icon → Debug → Custom Login Server → Add Account.
4. The browser opens this site’s login page; confirm with your site account. Back in the client you are already online.
5. Choose an exit region: Exit Node in the phone menu, the Exit Node submenu under the tray or menu-bar icon on a computer, or tailscale set --exit-node=<region> on the command line. Choose None to use no exit.

A device’s login validity follows your account expiry: when the account expires the device goes offline within minutes; after renewing, log in once more (on a computer, run the up command again) — no reinstall.

One account allows 5 devices online at once, sharing the same allowance as AnyConnect, sing-box and the other methods. Over the limit, the device unseen for longest is dropped, so a new phone does not require deleting the old one first.

A router counts as one device; the devices behind it do not.

Exit nodes are the same regional servers as the other methods, so speed depends on your path to that region and the time of day. The red/yellow/green lights on the region list apply, and the same light appears beside each exit name in the client.

Device-to-device traffic is WireGuard and peer-to-peer when a direct path can be established; otherwise it goes through a relay in the nearest region — slower, but it works.

Users inside China: blocked sites are reachable only with an overseas exit. If you need “Chinese sites direct, everything else through the exit”, the router option handles that split far more easily.

• Another VPN is running on the same device (a corporate AnyConnect, another mesh tool): they compete for DNS and routes; typical symptoms are region errors on Chinese video sites or a corporate intranet that will not open. Turn the other one off, or use the web proxy, which affects only the browser.
• Campus or office networks that throttle UDP: WireGuard runs on UDP and falls back to relays when throttled, with poor speed. Use AnyConnect over TLS instead.
• One-off use: installing the client and changing the login server takes more steps than scanning a sing-box QR code; for a single session AnyConnect or sing-box is faster.