# Tailscale 809 Hacker News commenters recommended Tailscale and 210 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months; owners who said how long report a median of 1 years (13 owners). It meets the Hacker Approved badge rule. **Verdict:** Recommended for reaching home servers and devices from anywhere without opening ports, thanks to WireGuard-based NAT traversal and easy setup; critics question trusting a third party and its ACL defaults. ## Why people recommend it - Remote access without opening ports (9 comments): "you're going to receive orders of magnitude less malicious traffic on a server accessible only over Tailscale compared to a server listening on the public Internet" ([source](https://news.ycombinator.com/item?id=49514228)) "Through Tailscale I’ve accessed my main Mac from both the opposite coast of the US and from the other side of the Pacific and it works great." ([source](https://news.ycombinator.com/item?id=48859809)) "Tailscale dramatically reduces this risk, because I can so easily configure it so my own devices can talk to my home server from anywhere" ([source](https://news.ycombinator.com/item?id=46581349)) - NAT traversal just works (4 comments): "It has excellent built-in NAT traversal (almost always peer to peer via hole punching etc., with relay nodes only when everything else fails)" ([source](https://news.ycombinator.com/item?id=46845382)) "there is a lot of convenience in the NAT traversal that you otherwise need router config and/or a publically routable server to achieve" ([source](https://news.ycombinator.com/item?id=46260788)) "It punches holes so I don't have to, even makes DNS work for my tailnet in a way I've never been able to get to work the way I want" ([source](https://news.ycombinator.com/item?id=46471017)) - Easier than managing raw WireGuard (4 comments): "I migrated my raw Wireguard setup to Tailscale because after a few months without any tinkering I simply forget details of my setup." ([source](https://news.ycombinator.com/item?id=49825302)) "For me, (1) and (2) in particular make it a huge value add over managing Wireguard setup, configs, and firewall rules manually." ([source](https://news.ycombinator.com/item?id=46581035)) "Most people set up something like Tailscale to accomplish something rather than create a project and ongoing maintenance burden" ([source](https://news.ycombinator.com/item?id=50022104)) - Handy extras like SSH, DNS (3 comments): "Tailscale has a bunch of nice features like Let's Encrypt integration, OAuth support, Tailscale SSH, etc. that make the experience quite nice overall" ([source](https://news.ycombinator.com/item?id=50015427)) "It punches holes so I don't have to, even makes DNS work for my tailnet in a way I've never been able to get to work the way I want" ([source](https://news.ycombinator.com/item?id=46471017)) "being able to install TailScale on your TV and then using your exit node in another country is a really nice convenience" ([source](https://news.ycombinator.com/item?id=48770695)) ## What people warn about - Broad default access, hard ACLs (4 comments): "trimming is a neat feature - thanks for that - thought the ACLs are often not there to begin with because configuring off the full node level access defaults of the vpn is difficult, at least at scale." ([source](https://news.ycombinator.com/item?id=50227541)) "Tailscale is responsible for designing a system whose convenient defaults allowed a stolen credential to have a very large blast radius." ([source](https://news.ycombinator.com/item?id=49129042)) "they seem to completely not support making ACL rules based on the identity of the device rather than a part of the address space" ([source](https://news.ycombinator.com/item?id=47873003)) - Trusting third-party infrastructure (4 comments): "they are adding a third party node that routes traffic for them (just to provide multiplexing), so in terms of security, it's an additional unnecessary man in the middle" ([source](https://news.ycombinator.com/item?id=49514010)) "some of their clients are closed source and proprietary, and thus totally controlled by them and the official distribution channels" ([source](https://news.ycombinator.com/item?id=47065206)) "Another concern I have is whether a compromise of Tailscale's own infra could let an attacker just add itself to my network." ([source](https://news.ycombinator.com/item?id=48919306)) - Feature bloat, overengineered (2 comments): "Tailscale or Headscale (the self-hosted version) are massively overengineered for something as basic as accessing your Linux ISOs from your phone." ([source](https://news.ycombinator.com/item?id=50024215)) "Tailscale is a security tool and yet the guys at Tailscale seem to be insistent on dumping everything INCLUDING the kitchen sink into it" ([source](https://news.ycombinator.com/item?id=49128346)) ## Alternatives hackers recommend - [Headscale](https://hackerapproved.com/p/headscale.md): 79 recommend - [ZeroTier](https://hackerapproved.com/p/zerotier.md): 19 recommend - [Tailscale Peer Relays](https://hackerapproved.com/p/tailscale-peer-relays.md): 15 recommend - [OpenZiti](https://hackerapproved.com/p/openziti.md): 10 recommend - [Tela](https://hackerapproved.com/p/tela.md): 10 recommend ## Where to get it - [Visit the official site](https://tailscale.com/) ## Cite as Hacker Approved, "Tailscale", https://hackerapproved.com/p/tailscale/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).