How to Connect to Your VPS Through Tailscale

Tailscale connects your own PC and your VPS in a private network that only your own devices can join. Remote Desktop then goes through that private network. When that works, you lock Remote Desktop to Tailscale, so bots on the internet cannot reach it at all.

This guide is for a Windows VPS with Remote Desktop. For an Ubuntu VPS with SSH, see On an Ubuntu VPS.

Before You Start

• Make sure you can connect to the VPS with Remote Desktop the usual way. Keep that way until Tailscale works.
• Find your Remote Desktop port. In your QuantVPS dashboard, open Control Panel › Connection details. If the IP address ends in a colon and a number, for example 203.0.113.10:24817, that number is the port. No number means port 3389.
• Have an account to sign in to Tailscale with, such as Google, Microsoft or Apple.

Step 1: Install Tailscale on Your Own PC

1. On your own PC, go to tailscale.com/download, download Tailscale and install it. On a Mac, iPhone or Android phone, install the Tailscale app from the App Store or Google Play.
2. Open Tailscale and click Log in. Your browser opens.
3. Sign in. If Tailscale asks, create your tailnet. A tailnet is Tailscale's name for your private network.

Step 2: Install Tailscale on the VPS

1. Connect to the VPS with Remote Desktop the usual way.
2. On the VPS, open a browser, go to tailscale.com/download, download Tailscale for Windows and run the installer.
3. Find the Tailscale icon in the notification area at the bottom right of the taskbar. If you do not see it, click the up arrow there.
4. Right-click the Tailscale icon and click Log in.
5. Sign in with the same account as on your own PC.

Step 3: Keep Tailscale Running on the VPS

On Windows, Tailscale runs only while you are signed in, unless you change it. A VPS must stay on your tailnet after you disconnect and after a restart.

1. On the VPS, right-click the Tailscale icon.
2. Point to Preferences and click Run unattended.
3. Click Yes. A check mark appears next to Run unattended.

Then turn off key expiry for the VPS. By default, Tailscale asks each device to sign in again after 180 days. The VPS cannot do that by itself, so Tailscale on the VPS would stop.

1. On your own PC, open the Machines page of the Tailscale admin console.
2. Find the VPS. Click the menu at the end of its row and click Disable key expiry.
3. Optional: in the same menu, click Edit machine name and give the VPS a short name, such as trading-vps. This guide uses that name.

Tailscale advises turning off key expiry only on devices you trust. If you replace or cancel the VPS, remove it from the Machines page.

Step 4: Connect Remote Desktop Through Tailscale

1. On the Machines page, find the VPS's name and its Tailscale address. The address starts with 100, for example 100.101.102.103.
2. On your own PC, open Remote Desktop Connection (Windows) or Windows App (Mac).
3. As the computer, type the VPS's Tailscale name. If your port is not 3389, add a colon and the port: trading-vps:24817.
4. Sign in with the username and password from Connection details, as usual.

If the name does not connect, use the 100 address in its place: 100.101.102.103:24817. The name needs MagicDNS, which Tailscale turns on for new tailnets.

Disconnect and connect through Tailscale once more. When that works, go on to Step 5. Your usual RDP file still connects over the internet until you lock.

Step 5: Lock Remote Desktop to Tailscale

QuantVPS Detect+ locks Remote Desktop from your dashboard. After the lock, Remote Desktop answers only Tailscale's addresses.

1. Stay connected to the VPS through Tailscale.
2. Sign in to your QuantVPS dashboard. If you have more than one VPS, choose it in the Selected server menu at the top.
3. Click Detect+ in the sidebar. In the Detect+ menu, click Remote Desktop, then click Settings under it.
4. Find the Lock Remote Desktop to my addresses card.
5. Click Use my Tailscale network. It adds 100.64.0.0/10, the range that holds every Tailscale address, and names your VPS's Tailscale address. To allow only your own PC, tick its 100 address under Signed in most, last 30 days instead.
6. Click Lock. The card shows Locked, waiting for your sign-in.
7. Within 10 minutes, disconnect Remote Desktop and connect again through Tailscale. This sign-in shows your VPS that the lock lets you in.
8. The card shows Locked to your addresses.

If nobody signs in from an allowed address within 10 minutes, the VPS undoes the lock by itself. From now on, connect through Tailscale. Your usual RDP file and the VPS's public address do not connect while Remote Desktop is locked. Detect+ keeps watching your VPS from inside it. The card may also say that your address now is not on the list. That is expected: it means your internet address, and you connect through Tailscale.

If Lock is greyed out, the card says why, for example while Detect+ updates itself. The lock works on Windows VPSs.

Do Not Use an Exit Node on the VPS

An exit node sends all internet traffic of a device through another device. On the VPS, that sends your trading platform's orders and market data the long way, through the other device. On the VPS, keep Exit node set to None in the Tailscale menu. Detect+ shows a note when the VPS uses an exit node.

Detect+ may also say that Windows calls a network Private, with the Tailscale network in the list. Tailscale sets its own network to Private, and only your tailnet devices reach it. You do not need to change it for Tailscale.

If Tailscale Stops Working

• Your own PC is not connected. Open Tailscale on your PC. Check that it is connected and signed in to the same account as the VPS.
• The VPS shows as offline or expired on the Machines page. Tailscale on the VPS stopped. Usually Run unattended was off when the VPS restarted, or the key expired. Get back in (below) and fix it on the VPS.
• The 100 address connects, but the name does not. Turn on MagicDNS on the DNS page of the Tailscale admin console, or keep using the address.

To get back in while Remote Desktop is locked:

1. In your dashboard, open Detect+ › Remote Desktop › Settings.
2. In the Lock Remote Desktop to my addresses card, click Add my address. Detect+ saves it at once, and Remote Desktop answers your current internet address. Or click Unlock to let every address in again.
3. Wait about a minute. Then connect with your usual RDP file.
4. On the VPS, sign in to Tailscale again, turn on Run unattended, and turn off key expiry.
5. Back in the card, click the × on your internet address and click Save addresses. If you clicked Unlock, add 100.64.0.0/10 and click Lock again.

These buttons work even when nobody can connect to the VPS, because Detect+ on the VPS contacts us. If the card says Detect+ has not reported for over 15 minutes, use the console in your dashboard: see How to Access Your VPS Using Console (VNC). The console does not use Remote Desktop, so the lock does not block it. Sign in to Windows there and start Tailscale again.

On an Ubuntu VPS

An Ubuntu VPS uses SSH instead of Remote Desktop. Tailscale works the same way.

1. Connect to the VPS with SSH the usual way.
2. On the VPS, install Tailscale:

   curl -fsSL https://tailscale.com/install.sh | sh

3. Connect the VPS to your tailnet. Open the link it prints and sign in with the same account as on your own PC:

   sudo tailscale up

4. Turn off key expiry for the VPS on the Machines page, as in Step 3. On Ubuntu, Tailscale starts by itself after a restart. To check, run systemctl is-enabled tailscaled: it answers enabled.
5. On your own PC, connect with SSH to the VPS's Tailscale name. Use the username from Connection details:

   ssh root@trading-vps

Detect+ cannot lock SSH yet. To let SSH answer only Tailscale, use Ubuntu's firewall, ufw. Do this in an SSH session through Tailscale, and keep that session open:

sudo ufw allow in on tailscale0
sudo ufw default deny incoming
sudo ufw default allow outgoing

Before you turn ufw on, make sure no rule still lets SSH in from the internet. Run sudo ufw show added. It lists your rules, also while ufw is off. If a line has 22 or OpenSSH, delete that rule: type sudo ufw delete and the words after ufw on that line, for example sudo ufw delete allow OpenSSH or sudo ufw delete allow 22/tcp. Then turn ufw on:

sudo ufw enable

Then open a second SSH session through Tailscale. If it connects, you are done. If it does not, run sudo ufw disable in the first session.

Further Reading

Tailscale's own guides: Install Tailscale on Windows, Run unattended, Key expiry, MagicDNS, Exit nodes, Install Tailscale on Linux and Use UFW to lock down an Ubuntu server.

Related

• How to Secure Remote Desktop on Your VPS
• How to Connect to Your VPS Through WireGuard
• How to Change the Remote Desktop (RDP) Port on Your VPS

Need Assistance?

Our support team is available 24/7. If you have any questions or run into issues, open a support ticket from your QuantVPS dashboard and we'll get back to you as quickly as possible.