The easiest route to a personal VPN on a VPS
For a personal VPN without managing individual WireGuard configuration files, a Tailscale exit node is a practical starting point. Install Tailscale on your VPS and everyday devices, approve the VPS as an exit node, and select it in the client app. The server becomes your internet gateway.
A tailnet is your private network of Tailscale devices. Ordinary tailnet connections let your laptop reach your server, but do not move normal web browsing onto the VPS. Exit-node selection adds that internet-routing step. Your websites then see the server’s public address, subject to any separate browser proxy or VPN configuration.
Choose Linux or Windows and prepare access
You need a VPS with internet connectivity, administrator access, and a Tailscale account. Choose a location near your normal connection for latency, then check the plan’s transfer allowance. VPN traffic consumes server bandwidth; a large disk alone does not improve VPN speed.
| VPS system | Setup path |
|---|---|
| Ubuntu or Debian | Use SSH and the Linux commands below. Keep your existing session open. |
| Windows Server 2016 or later | Use the Windows app, then enable unattended mode. |
| Windows desktop | The current client also supports Windows 10 or later; use an OS still receiving appropriate security updates. |
Keep provider-console access available before changing networking. Tailscale does not require exposing Remote Desktop to everyone: retain your existing restricted management access while testing, then use the private tailnet address for RDP where your policy permits.
Option A: install Tailscale on an Ubuntu or Debian VPS
Download the official installer, inspect it, and run it. Alternatively, use Tailscale’s distribution-specific package instructions. The sign-in command prints a URL: open it on your own computer and authenticate to the account you will use on your devices.
sudo apt update
sudo apt install curl ca-certificates less
curl -fsSL https://tailscale.com/install.sh -o /tmp/tailscale-install.sh
less /tmp/tailscale-install.sh
sh /tmp/tailscale-install.sh
sudo tailscale upEnable packet forwarding and advertise the gateway. On an already configured server, merge these settings with its existing sysctl configuration instead of creating conflicting values.
printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\n' | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-exit-nodeLinux runs Tailscale as a background service, so closing SSH does not disconnect it. Continue with approval below.
Option B: run an exit node on Windows Server
- Install the official Tailscale Windows client on the VPS and sign in.
- Open its tray menu and enable the option to run this machine as an exit node.
- Under Preferences, enable Run unattended and accept the prompt.
- Prevent sleep and finish the admin approval below.
Unattended mode keeps Windows connected after sign-out or reboot. Test that behavior before depending on the VPN. Windows exit nodes use userspace routing, with different performance characteristics from Linux; benchmark your workload instead of assuming identical throughput.
Approve the exit node and connect your devices
In Tailscale’s admin console, open Machines, find the VPS, and edit its exit-node settings. Allow it to act as an exit node and save. Older interfaces may place this under route settings. A customized access policy must also permit the intended users to reach autogroup:internet.
| Client device | Select your VPS |
|---|---|
| Windows | Tailscale tray menu → Use exit node → server name. |
| macOS | Tailscale menu bar → Exit Nodes → server name. |
| iPhone or iPad | Open Tailscale → Exit Node → server name. |
| Android | Open Tailscale → Exit Node → server name; confirm it appears on the home screen. |
Install and sign in on each client first. Select the exit node separately on every device. Choose None to stop using it. Enable local-network access only when you need devices such as printers on your current LAN.
Check public IP, DNS and IPv6 before relying on it
- Compare a public-IP lookup before and after connecting. The connected result should match the VPS’s outbound public address, not its private 100.x Tailscale address.
- Load several websites and run a DNS check. Clients normally use the exit node for DNS; custom tailnet nameservers need the Use with exit node option when you want them included.
- Test IPv6 separately. Tailscale’s private IPv6 connectivity does not prove the VPS has public IPv6. Public IPv6 browsing needs an exit node with working IPv6 internet access.
- Reboot the VPS when convenient, reconnect, and repeat the checks. Verify both outgoing browsing and returning page data work.
A personal VPN changes where your traffic exits. It does not make you anonymous to accounts you sign into, and the VPS operator still provides the internet connection. Continue using HTTPS.
Fix a missing exit node, slow VPN or lost connection
| Symptom | First check |
|---|---|
| Server absent from client list | Confirm the same tailnet, online status and admin approval. |
| Connected but no browsing | Check forwarding on Linux, internet access on the VPS, DNS and any custom access policy. |
| Slow downloads | Run tailscale status: a relayed connection may be slower than a direct connection. |
| Stops after Windows logout | Enable unattended mode and check sleep settings. |
| Previously worked, now unreachable | Check server health and device-key expiration in the admin console. |
Most networks need no manually opened inbound port. If traffic uses a relay, consult Tailscale’s firewall guidance; allowing its actual UDP listening port can help direct connectivity. Do not disable the firewall or expose RDP globally as a VPN fix.
Expired exit-node keys can leave routes installed but unusable to avoid silently leaking traffic. Plan reauthentication, or deliberately disable expiry for a secured, monitored server. Remove lost devices and keep both the OS and Tailscale updated.
Common questions
Can I use a Windows VPS as a Tailscale VPN server?
Yes. Tailscale supports Windows Server 2016 or later. Enable exit-node advertising, approve it, and turn on unattended mode so sign-out does not stop the connection.
Why has my public IP not changed after installing Tailscale?
A normal Tailscale connection only creates private device access. Select your approved VPS exit node on the client to route internet browsing through it.
Do I need to buy a domain name for this VPN?
No. You select the server within Tailscale. A separate public domain is not required for this setup.
Official documentation
Documentation reviewed October 18, 2026. Check the linked project documentation before installing or upgrading; commands below have not been run on your VPS.