Learn Tailscale - History, Background & Why You Need Tailscale

#Introduction

In episode 0 you set up your environment: Tailscale installed, an active account, and one node connected to the tailnet. Now let's step back for a moment and understand why Tailscale exists. Before diving into technical commands, it's important to know what problem it solves and why the old VPN approach felt so painful.

Episode 1 traces the evolution of modern VPNs: from IPsec and OpenVPN with their complex configuration, to WireGuard which is simple yet still manual, and then to Tailscale which adds an automation layer on top. We'll also cover Tailscale's founders, the problems it solves, and an honest comparison with ZeroTier, Nebula, Netmaker, and manual WireGuard.

With this historical context, you'll appreciate every feature we discuss in the coming episodes — and more importantly, you'll know when Tailscale is the right tool.

#The Evolution of Modern VPNs

#Traditional VPNs: IPsec and OpenVPN

Classic VPNs like IPsec and OpenVPN were designed to connect two networks or a single client to a single gateway. They're powerful, but their configuration is very complex: you need certificates, keys, long config files, and a deep understanding of routing. Adding one peer means editing configs, moving files to another device, and restarting services.

# IPsec / OpenVPN: certificate, key, and long config per peer
openvpn --config client.ovpn
 
# Tailscale: one command for the entire mesh
sudo tailscale up
tailscale status

Notice the difference in mental overhead. sudo tailscale up replaces dozens of lines of configuration — and that's the key turning point.

#The Birth of WireGuard

In 2016, Jason A. Donenfeld introduced WireGuard: a modern VPN protocol embedded in the Linux kernel, only about 4,000 lines of code, with modern cryptography and high performance. WireGuard removes certificates and replaces them with simple public/private keys.

However, WireGuard remains manual. If you have 10 devices, you have to write 10 config files, exchange public keys one by one, and manage connectivity when any device changes networks. This is exactly the point where automation becomes a necessity.

#Tailscale on Top of WireGuard

In 2019, Avery Pennarun and David Crawshaw founded Tailscale. Their idea was simple: use WireGuard as the battle-tested data plane, then build a managed control plane on top of it. The control plane that manages keys, authentication, and connection coordination is handled by the service, while data still flows peer-to-peer and stays encrypted end-to-end.

The Tailscale client itself is open source and written in Go. This combination is what makes Tailscale "zero-config" without sacrificing security.

#Problems Tailscale Solves

#Secure Overlay Network Without Firewall Configuration

The classic problem: you have a laptop, an office server, a home NAS, and cloud instances on AWS. Connecting all of them with a traditional VPN means configuring firewalls, opening ports, and maintaining gateways. Tailscale eliminates all of that by building an overlay network: a virtual network on top of the internet that is only visible to your devices.

#Connectivity Behind NAT and CGNAT

Many home networks and mobile providers use NAT or CGNAT, so devices don't have a public IP and can't receive inbound connections. Tailscale uses NAT traversal techniques to open direct connections between devices, and falls back to a DERP relay when a direct connection isn't possible. The result: devices can still reach each other without opening any public ports at all.

#Zero-Config for New Users

You don't need to understand tunnel details to start using it. Install, run tailscale up, log in, done. All the automation is handled by the control plane — this is exactly what sets Tailscale apart from manual WireGuard.

#Tailscale vs Traditional Approaches

#A Quick Comparison

• IPsec / OpenVPN: mature and versatile, but complex; one new peer means reconfiguration.
• Manual WireGuard: simple and fast, but no automation; great for point-to-point links.
• ZeroTier: an overlay network with a controller concept; encrypted data plane, in a similar niche as Tailscale.
• Nebula: a mesh VPN from Slack, fully self-hosted, a good fit for teams that want total control over infrastructure.
• Netmaker: self-hosted WireGuard management with automation, but you still manage the servers yourself.
• Tailscale: managed control plane, mature NAT traversal, a rich feature ecosystem (SSH, Serve, Funnel, Taildrop), and the fastest onboarding.

Manual <---------------------------------------------> Automated
WireGuard      OpenVPN/IPsec         Netmaker       Tailscale

#When Tailscale Fits Best

Tailscale shines when your need is connectivity between your own devices with fast setup and a rich ecosystem: server access, port sharing, file transfer, and large meshes across clouds. If you need full control over the control plane or work in an organization with strict data regulations, self-hosted alternatives like Nebula or Headscale (we cover these in episode 20) might be the better choice.

#Case Study: Bringing Five Devices Together

#A Real Scenario

Imagine a developer with a laptop, an office server, a home NAS, and two cloud instances. With manual WireGuard, connecting five devices means five config files and error-prone public key synchronization — and you still have to redo it whenever a device changes networks.

# Two commands on every device is enough
sudo tailscale up
tailscale status

The tailscale status command lists all nodes that have joined. The difference in effort compared to the manual approach is striking — and this is the main reason Tailscale was born.

#Lessons from the Case Study

• Control plane automation eliminates error-prone manual work.
• Data still flows peer-to-peer even though coordination is centralized.
• Adding a device no longer means rewriting global configuration.
• NAT and firewall problems dissolve without opening public ports.

#Summary

Tailscale's history is a story of simplification: WireGuard simplified cryptography, and Tailscale simplified key and connection management. The problems it solves — NAT, firewalls, and manual configuration — are problems almost everyone has hit when trying to connect multiple devices at once.

#Closing

Episode 1 laid the mental foundation: you now understand where Tailscale comes from, why it's built on WireGuard, what problems it solves, and where it sits among other solutions.

Key takeaways:

• Traditional VPNs are complex because they manage keys, certificates, and manual configuration.
• WireGuard simplified the protocol, but peer management is still manual.
• Tailscale adds a managed control plane on top of the WireGuard data plane.
• The main problems solved: NAT/CGNAT, firewalls, and zero-config.
• ZeroTier, Nebula, and Netmaker are alternatives with a control-versus-convenience trade-off.

In the next episode, episode 2, we'll break down the core concepts and key architecture of Tailscale — what a tailnet is, how the control plane works together with the WireGuard data plane, the NAT traversal mechanism, the role of DERP relays, and core components like tailscaled, MagicDNS, and node keys. See you in the next episode!