Tailscale

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build this — and check the free tier first, because it covers most people entirely.

**NAT traversal that actually connects** is the product. Two machines behind different home routers establishing a direct connection, with a relay when they cannot, and coordination so it happens without any port forwarding, is genuinely difficult and it is the part everyone underestimates.

WHEN TO KEEP PAYING
- More devices or users than the free tier allows
- Access controls per user and per service, which is what a team needs

WHEN TO BUILD
- **Plain WireGuard**, if your server has a public address. Then there is no traversal problem: your devices connect to it directly, and the configuration is a dozen lines. That is the honest answer for the common case of a VPS plus a laptop and a phone
- **Headscale**, an open implementation of the coordination server, if you want the mesh behaviour on your own infrastructure. The clients stay the official ones, which is the sensible division

WHY THIS IS ONE OF THE BEST WEEKENDS AVAILABLE
Once your machines share a private network, nothing needs to be exposed publicly. The media server, the notes, the dashboards, the database — all reachable only from your own devices. That single change removes more risk than any amount of hardening, because a service nobody can reach is a service nobody can attack.

WHAT TO DO WITH IT
- Move every self-hosted service off the public internet and behind the network
- Keep only what genuinely must be public — a website, a webhook endpoint — and put those behind a reverse proxy with proper headers
- Use it for backups: a nightly copy to a machine at another location, over the private network, with no port open anywhere

AND THE THING PEOPLE FORGET
Key rotation and device removal. A laptop that was lost still has a key. Whatever you run, know how to revoke a device and do it once as a rehearsal.

THE ONE-LINE VERSION
Check the free tier. If you need your own, WireGuard covers a public server and Headscale covers the mesh — and either way, get your services off the public internet.