I'm setting up Nextcloud on Ubuntu running on my HP 27-a010 desktop, and it currently works only from inside my home network. I'm considering installing Tailscale so I can reach it from outside using the Tailscale address, without enabling Funnel or setting up port forwarding. Would this expose my home Wi-Fi or create a backdoor into the rest of my network?
3 Answers
If Tailscale is installed directly on the computer hosting Nextcloud or Jellyfin, remote access should be limited to that computer and the services you choose to run there. No port forwarding is needed. Just remember that any service you make reachable through Tailscale is still remotely accessible, so secure the applications with strong passwords, updates, and HTTPS where appropriate. A subnet router or an overly permissive configuration would expose more of your network.
By default, Tailscale only makes the devices that have the Tailscale client installed and are approved for your tailnet reachable. It does not automatically expose your entire home network. You would need to deliberately configure a subnet router or similar feature to access other devices on your LAN.
Tailscale is essentially a VPN built on WireGuard, so its security depends heavily on your account and configuration. Use strong authentication, enable device approval, keep the clients updated, protect your identity-provider account, and use access-control rules to limit which devices and services can communicate. Devices outside your tailnet cannot normally use the connection to reach your protected devices.
So the important distinction is whether Tailscale is installed only on the Ubuntu machine, or whether that machine is configured to route traffic to the rest of the LAN.