What the Private Network (Tailscale) Is

• Always on: once logged in, the device stays in the network through reboots, Wi‑Fi changes and Wi‑Fi-to-mobile handoffs; the connection restores itself. A traditional VPN needs a click to connect and a reconnect after every drop.
• The exit is optional: with no exit selected, public traffic uses the local network and only traffic to other private-network devices is encrypted; with a region’s exit selected, everything leaves from that region, the same as a VPN. Switching exit is one click in the menu — no new address, no new login.
• Devices reach each other: phone, laptop and home NAS on the same account each get a private address and can connect directly, with no port forwarding on the router and no public IP required.

• Several devices and a wish to configure once and stay online: log in on the phone and laptop once, then only occasionally change exit region.
• A NAS, PC or camera at home to reach from outside: log both ends into the private network and connect by device name or private address, as at home.
• Devices that must stay up for long periods: there is no session timeout.
• One-off use, or a device already running a corporate VPN: another method fits better; see the end.

Pick your system and follow the screenshots. The button on the right plays the video, and any screenshot enlarges when you click it.

• iPhone and iPad have no video: install the official Tailscale client from the App Store (non-China Apple ID required), tap “⋯” on the logged-out screen → Use custom server and enter the address shown on the private-network page; when the browser opens this site’s login page, confirm with your site account.
• If you have ever logged in to an official Tailscale account, log out first: tap the avatar → Log Out on a phone, or run tailscale logout on a computer. Without a clean logout the custom-server option does not appear.
• To use no exit, choose None under Exit Node.
• The exit can also be set on the command line: tailscale set --exit-node=<region>

A device’s login validity follows your account expiry: when the account expires the device goes offline within minutes; after renewing, log in once more (on a computer, run the up command again) — no reinstall.

One account allows 2, 4 or 8 devices online at once depending on the tier (Personal, Family, Enterprise), sharing the same allowance as AnyConnect, Hiddify and the other methods. If you need more devices online than your tier allows, temporarily upgrade your account type (remaining time converts at equal value) and switch back afterwards.

A router counts as one device; the devices behind it do not.

Exit nodes are the same regional servers as the other methods, so speed depends on your path to that region and the time of day. The red/yellow/green lights on the region list apply, and the same light appears beside each exit name in the client.

Device-to-device traffic is WireGuard and peer-to-peer when a direct path can be established; otherwise it goes through a relay in the nearest region automatically and keeps working.

Users inside China: blocked sites are reachable only with an overseas exit. If you need “Chinese sites direct, everything else through the exit”, the router option handles that split far more easily.

• Another VPN is running on the same device (a corporate AnyConnect, another mesh tool): they compete for DNS and routes; typical symptoms are region errors on Chinese video sites or a corporate intranet that will not open. Turn the other one off, or use the web proxy, which affects only the browser.
• Campus or office networks that throttle UDP: WireGuard runs on UDP; on these networks AnyConnect over TLS is faster.
• One-off use: for a single session AnyConnect or Hiddify is faster — scan a code or enter an address and you are connected; the private-network login is designed for staying online long term.