{
  "id": 4623496,
  "title": "Put SSH Behind Tailscale and Close Port 22",
  "url": "https://urgent.news/2026/08/31/put-ssh-behind-tailscale-and-close-port-22",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-31T10:11:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/shubham_sharma_94/put-ssh-behind-tailscale-and-close-port-22-1a52"
  },
  "original_language": "en",
  "account": "After hardening your Virtual Private Server (VPS), consider the next logical step: shift SSH traffic away from the public internet and onto a private network. Instead of relying on a strong key to withstand continuous scanning, place SSH on a secure private network that remains unseen by the outside world. Close port 22, as it is no longer needed.\n\nThis article is a continuation of the guide on setting up your own VPS. Ensure you complete the essential steps first, such as creating a non-root user, utilizing SSH keys, and configuring a firewall (UFW).\n\nKey takeaways:\n- Tailscale provides your server with a private address accessible solely by your devices.\n- Disable key expiry on the server in the admin console, as it will log you out after 180 days and prevent remote access.\n- Before closing port 22, test a new connection over Tailscale to ensure everything functions correctly.\n- Verify that you have a recovery path ready, such as keeping your provider's browser console handy as an escape hatch.\n\nUnderstanding what \"behind Tailscale\" means:\nTailscale creates a private mesh network (tailnet) using WireGuard. Every device you add to the Tailscale network is assigned a stable 100.x address, which is reachable only by other devices in the tailnet and not by the open internet. By connecting your server and laptop to the same tailnet, you can SSH to the server using its private address. Once confirmed, you can close the public port 22.\n\nTwo ways to run SSH over the tailnet:\n1. Plain OpenSSH over Tailscale: Continue using the standard OpenSSH and reach it via the private address. Your existing keys and hardening measures remain effective.\n2. Tailscale SSH: Tailscale's daemon listens on port 22 of the tailnet address and authenticates using your Tailscale identity and access rules. Choose based on your preference for leaning on one provider versus maintaining your existing SSH setup.\n\nThe firewall configuration steps are as follows:\n1. Install Tailscale and connect your server by following the provided install script for various distributions.\n2. Sign in to the server using the generated URL and join your tailnet.\n3. Repeat the installation on your laptop and sign in with the same account.\n4. Check the server's private address using `tailscale ip -4`.\n5. From your laptop, attempt a plain SSH connection using the private address.\n6. Enable the tailscale0 interface in UFW and remove the public port 22 rule to restrict access to the Tailscale network only.\n7. Test the connection by attempting a new SSH connection over Tailscale before disabling the old port 22 rule.\n\nAfter confirming the tailnet connection, close the original SSH terminal. If you encounter any issues, you can still access the server using the provider's console or by reopening port 22.\n\nTwo safety nets in case of failure:\n1. Provider console: Hostinger and most hosts offer a browser-based terminal in their control panel, allowing you to access the server directly, bypassing SSH.\n2. Reversing the order of changes: If you remove Tailscale from the server, re-enable public SSH access first (sudo ufw allow OpenSSH) to maintain a path back into the server.",
  "summary": "Once a VPS is hardened the usual way, keys only, firewalled, patched, there is a bigger move you can make: stop exposing SSH to the public internet at all. Instead of trusting that a strong key holds up against constant scanning, you put SSH on a private network the rest of the world cannot even see, and close port 22 to everyone else. This is my favorite upgrade for a small server in 2026, and…",
  "key_points": [
    "Shift SSH traffic to private network via Tailscale",
    "Close port 22 as it's no longer needed",
    "Test new connection over Tailscale before disabling port 22"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}