First of all I apologize for even asking this question as I feel like it’s a stupid question, but would like clarification/understanding at the most basic level of security Here it goes: so I installed Tailscale on all my devices (e.g. iPhone, iPad, Mac), and I keep ‘Exit Node’ set to ‘None’ on all devices. Say I stay at a hotel and use the hotel’s WiFi network … with Tailscale being installed and set to ‘Connected’ on iPhone/iPad and ‘Exit Node’ still set to ‘None’, is my traffic encrypted and no one on the hotel WiFi network can see my devices’s traffic, etc.? Is it safe? Am I really using a ‘VPN’ type connection here under this scenario and I’m good from a security standpoint? I do always see the ‘VPN’ icon shown on my iPhone/iPad devices upper right corner next to the WiFi symbol so it makes me feel ‘safe’ (any kind of false sense of security?).
If the answer is ‘no - not safe’, what do I need to change to be safe in using the hotel’s WiFi network with Tailscale installed? Does the ‘Exit Node’ setting maybe need to be set to a device such as my Mac back at home on my local network?
Again - I do apologize as I feel like I’m asking a very dumb question here. I appreciate kind responses! Thanks …
Tailscale is a VPN, but it’s not a privacy VPN. You can make it act like a privacy VPN through the use of Exit Nodes.
Say I stay at a hotel and use the hotel’s WiFi network … with Tailscale being installed and set to ‘Connected’ on iPhone/iPad and ‘Exit Node’ still set to ‘None’, is my traffic encrypted and no one on the hotel WiFi network can see my devices’s traffic, etc.? Is it safe? Am I really using a ‘VPN’ type connection here under this scenario and I’m good from a security standpoint?
Most connections these days are through HTTPS which is encrypted between you and the server you’re connecting to. But you could be susceptible to snooping or possible attacks. When I am on a cafe or hotel wifi, I always VPN back to a network I trust – my own – using an exit node sitting at my house. This acts like a more traditional VPN service – all data is encrypted between my phone and my exit node and uses my outbound internet connection to talk to everything.
The VPN icon on your phone shows up on your phone, because Tailscale is active, being used to talk to devices on your tailnet. In order to work properly, Tailscale installs a VPN profile on your device.
The best way to be secure is to use an exit node on a device that’s always on. An Apple TV or a server that might be running on a raspberry pi, or something else is what I would look at running it on.
Without an exit node being actively used, your traffic is split-tunnel and will only use the VPN when connecting to other devices on your tailnet (or subnet if you have routing enabled on your exit node). To encrypt all traffic from your iPhone/iPad, use an exit node. As you’ve suggested, enable an exit node on your home network and you should be all set.
If tailscale is running on the device and you interact with another tailscale client on your tailnet, that is all encrypted by tailscale over the hotel wireless. If someone was looking at your network traffic they would see tailscale traffic and nothing else
with Tailscale being installed and set to ‘Connected’ on iPhone/iPad and ‘Exit Node’ still set to ‘None’, is my traffic encrypted and no one on the hotel WiFi network can see my devices’s traffic, etc.?
If the exit node is off and you are going to websites you are going directly out to the internet that use https then your data is already encrypted between your client and the website. If someone was sniffing around or the hotel had monitoring in place they could is basic network data but if you were doing banking and whatnot they would not be able to see inside what you are doing compared to a website that was just using http. Very rarely do you come across http websites these days (they are out there but usually just some basic kind of websites)
There are some wireless attacks out there that try to do mitm but anything that is using HTTPS would give you a big warning sign letting you know something isnt right
If you want it so no one on the hotel wifi can potentially see what websites you are visiting then you will want to utilize the exit node. They will only see tailscale traffic coming from your client
There is no dumb questions, we all have to learn somehow. . In layman’s terms, Tailscale is an encrypted pipeline between two devices.
When you enable an exit node, and have the tailscale client enabled on your device, you are making a secure connection from your device location back into your home. All traffic from your remote connection will exit via your home internet connection. So a service like Netflix thinks your device is at home, even though you are halfway around the world.
So in general the answer is no. Tailscale operates a split vpn structure, so if you’re accessing another Tailscale node then that will be encrypted, but if you’re accessing something else then it won’t.
So if you’re in the hotel trying to access your Mac at home then yes, if you’re accessing Google then no.
If you want all your traffic encrypted then select an exit nose to use, and it will send all your traffic, encrypted, to the exit nose and the traffic will head to the internet from there.
Tailscale isn’t like Mullvad or Expressvpn, when the exit node is none it means that your internet traffic goes out like normal with no VPN. The only thing you get is if you try to access something else that is on your tailscale network then it will go over the Tailscale VPN to that device (i.e. remote desktop on home PC)
If you do want to encrypt all your traffic then you will need to set up an exit node (very easy these days with the tailscale app) and then tell the device your using (i.e. your phone) to use that exit node. Then all the traffic from your phone will go through that device you set up.
VPN stands for virtual private network. What this means in simple terms is you’re connecting whatever network you’re actively using to a network in a remote location, while maintaining privacy through encryption. VPNs are helpful in security, but they are not a security tool. They are networking tool so you can use a VPN to connect to your home network while at a hotel, and that traffic will be encrypted, but it does not mean that the hotel Wi-Fi is “safe”.
There are services like Mullvad and others that allow you to connect to their network and route all internet traffic through that private connection, utilizing a VPN to hide your online activity from a creepy hotel owner or an ISP.
In the case of Tailscale, unless you use an exit node, you are only routing your tail scale activity through a VPN. Tailscale traffic should not be accessible to the hotel or anyone else outside your tailnet, but the rest of your internet traffic remains unencrypted. If you use an exit note, then all your traffic should be encrypted between your device and the exit node (and hidden from the hotel), but what happens to your traffic after it leaves the exit node depends on your set up. If not encrypted in some way, then your isp or others could snoop after it leaves your tailnet via the exit node.
You’re thinking of those “Your IP addess is being tracked , you’re at risk” kind of hiding IP address vpn. Tailscale is not that. It provides a secure channel between your device you own or your configured Tailnet in a very easy no fuss manner.
Using an exit node simply mean that you route all traffic to your designated device. You could combine third party paid vpn into the mix if you’re into that. I did this for a while but currently reconsidering it. Does not hiding my IP really have that adverse effect?
I just found out you could add controlD IP as custom Tailscale DNS resolver from the github page, amazing because you could opt to block trackers with the free dns
By default, Tailscale does not send all your traffic anywhere, you can only access the other devices on tailscale.
If you want all your data to go through the VPN, you need to turn on exit node on a device that is always on (and turn off key expiry) - and connect to the exit node on the device you want to secure. Only then does it work like your Nords/PIAs/etc
exit node Off = you can access files on the other computers with tailscale installed. No internet performance loss.
exit node On = in addition, your internet traffic is routed through the selected computer with tailscale installed. Therefore, your computer thinks it is at the other computer’s location, traffic is encrypted in route, etc. There is some internet performance loss, as you have to route the traffic through the other computer first; so, its best to set up the exit node on a computer with a direct ethernet line to the router.
So I’ve found even when I have Tailscale running on my phone to an exit node running at my office. It’s still not routing all my traffic to my server. My phones WAN never changes.
Thank you very much for the detailed response - this makes sense. So I’ve been using it wrong this entire time That ‘VPN’ in upper right corner really did give me a false sense of security then. Going forward I will make sure that Exit Node is ON when I am out and about using public-type WiFi connections. Again - thank you!
Thanks - I wish there were two different kinds of ‘VPN’ symbols in upper right corner of device, with one maybe having an ‘*’ next to it if you don’t have an ‘Exit Node’ turned on because you’re really not using a VPN under that scenario (based on responses received to my question). I’m sure that’s not really possible to do, but would be a nice-to-have as a quick double-check that you are actually secure with your connection (i.e. I didn’t forget to set my ‘Exit Node’!).
Unrelated to tailscale bit You could think of it the reverse way too. It’s not just “hiding your ip” but obfuscating the traffic through your Internet provider too. Your provider without any VPN would be able to see which ip you’re hitting and what sites you have visited. Not that it matters much now and might not matter to you but I consider that too as a treasure trove of data once the providers think of monetizing it.
Thanks - I see what you’re saying about internet performance loss when Exit Node is ON. I did a speed test with it ON vs OFF and the difference was huge. So Exit Node = ON really only makes sense when you are on untrusted WiFi networks to avoid the performance hit.
Here it goes: so I installed Tailscale on all my devices (e.g. iPhone, iPad, Mac), and I keep ‘Exit Node’ set to ‘None’ on all devices. Say I stay at a hotel and use the hotel’s WiFi network … with Tailscale being installed and set to ‘Connected’ on iPhone/iPad and ‘Exit Node’ still set to ‘None’, is my traffic encrypted and no one on the hotel WiFi network can see my devices’s traffic, etc.? Is it safe? Am I really using a ‘VPN’ type connection here under this scenario and I’m good from a security standpoint? I do always see the ‘VPN’ icon shown on my iPhone/iPad devices upper right corner next to the WiFi symbol so it makes me feel ‘safe’ (any kind of false sense of security?).
. In layman’s terms, Tailscale is an encrypted pipeline between two devices.