How do I install Tailscale on Proxmox?

Open the Proxmox host shell or your chosen Debian LXC or VM, run the official Tailscale Linux installer, then run sudo tailscale up and authenticate the device. Use the host only for host-level access; use an isolated guest when you need subnet routing.

Should Tailscale run on the Proxmox host or in an LXC?

Run it on the host when the only target is the Proxmox web UI or host shell. An unprivileged LXC is the better default for advertising LAN routes because it limits changes and routing privileges on the hypervisor. A VM gives the strongest isolation at a higher resource cost.

How can I access the Proxmox web interface remotely with Tailscale?

Sign the Proxmox host into the tailnet or reach it through an approved subnet router. From another signed-in device, open https:// followed by the host's Tailscale or LAN address and :8006. Keep port 8006 closed on the public router.

Can an unprivileged Proxmox LXC run Tailscale?

Yes. Expose /dev/net/tun to the container, start it, install Tailscale, and confirm the tailscaled service can create its interface. For subnet routing, also enable forwarding inside the container and approve the advertised route.

How do I use Proxmox as a Tailscale subnet router?

Create an unprivileged LXC or dedicated VM with a stable LAN address, enable IPv4 forwarding, install Tailscale, and advertise the exact LAN CIDR. Approve the route in the admin console and test it from a network that does not overlap your home subnet.

Why is Tailscale on my Proxmox VM or LXC not working?

Check tailscaled first, then confirm /dev/net/tun exists, outbound DNS and HTTPS work, and the node is authenticated. For subnet access, verify IP forwarding and route approval. For the web UI, include port 8006 and inspect every Proxmox firewall layer.

Does Tailscale need to be installed in every Proxmox guest?

No. Install it per guest when you want separate device identity and narrow policy. A single subnet router can expose selected LAN services without installing Tailscale everywhere, while a host install can provide only host-level access.

Is Tailscale the same as Proxmox?

No. Proxmox VE is a virtualization platform for VMs and containers. Tailscale is an encrypted identity-based network that connects devices and private subnets. Tailscale can provide remote access to a Proxmox host and its guests.

Guide

14 min readAug 06, 2026

Tailscale Proxmox Setup: Host, LXC or VM — Pick the Safe Path

Install Tailscale on Proxmox with the right isolation. Compare host, unprivileged LXC, and VM paths, then generate commands for remote UI or subnet access.

Quick answer

For Proxmox web UI access only, installing Tailscale on the host is the shortest path. For a Tailscale subnet router, use an unprivileged LXC or dedicated VM so routing stays isolated from the hypervisor. Do not expose port 8006 publicly; connect to the host's Tailscale IP or an approved private subnet route.

Build the safest setup See install paths

No public ports

Keep port 8006 off the internet

3 placements

Compare host, LXC, and VM

Ready commands

Generate a setup you can copy

Interactive setup planner

Tailscale Proxmox placement planner

Choose what you want to reach. The planner recommends the safer placement, builds commands, and highlights when your preferred location adds unnecessary risk.

Where were you planning to run Tailscale?

What needs remote access?

LAN subnet in CIDR notation

Used only when the plan advertises a subnet route.

Recommendation

Safer placement differs

Use an unprivileged LXC subnet router

The routing role stays outside the hypervisor while one approved route can reach Proxmox and other LAN services.

Review your Proxmox host choice

The selected goal is better matched to lxc container. You can still use the original placement, but keep its broader access and maintenance cost in mind.

Shell

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
printf 'net.ipv4.ip_forward = 1\n' | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-routes=192.168.1.0/24

Then: Approve the advertised route in the Tailscale admin console, then test one LAN address.

Architecture decision

Proxmox host vs LXC vs VM for Tailscale

Google’s results surface the same unresolved tradeoff repeatedly: convenience on the host versus isolation in a guest. The safest default is the narrowest placement that meets the access goal.

Placement	Isolation	What it reaches	Best for	Tradeoff
Proxmox host	Lowest	Host UI and host services	The shortest path to :8006	Adds software to the hypervisor
Unprivileged LXC	Good	Container plus approved LAN routes	Subnet router and shared access	Needs /dev/net/tun and forwarding
Dedicated VM	Strongest	VM plus approved LAN routes	Strict separation and easy rollback	Uses more RAM and storage

Install paths

How to install Tailscale on Proxmox

Use the host only for host-level access. For a Proxmox Tailscale subnet router, put routing in an unprivileged LXC or dedicated VM so the hypervisor stays focused on virtualization.

Path A: Proxmox host

Fastest route to the web UI and host shell.

1. Install: run the official Linux installer from the Proxmox shell.
2. Authenticate: run tailscale up and open its login URL.
3. Connect: visit the node’s 100.x address on port 8006.

Shell

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4

Path B: unprivileged LXC

Better isolation for subnet routing and shared access.

1. Create: use a small Debian LXC with a reserved LAN address.
2. Expose TUN: confirm /dev/net/tun exists inside the stopped-then-restarted container.
3. Advertise: enable forwarding, advertise the LAN CIDR, and approve it.

Shell

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
sudo tailscale set --advertise-routes=192.168.1.0/24

Approve routes; do not expose the Proxmox web port

Subnet routes become useful only after an administrator approves them. Keep TCP 8006 closed on the public router and grant access through tailnet identity instead.

Verify the Tailscale Proxmox connection

Test from a device outside the Proxmox LAN. A successful local test alone cannot prove remote routing works.

Node is online in tailscale status

tailscale ping returns a peer path

https://100.x.y.z:8006 loads

One approved LAN service responds

Tailscale Proxmox troubleshooting

Start with the layer that failed: daemon, TUN device, route approval, firewall, or name resolution.

Questions people ask

Tailscale Proxmox FAQ

Continue learning

Related remote-access guides

Tailscale without port forwarding

Choose private access, Serve, or Funnel without exposing the wrong service.

Read the guide

Build a Tailscale exit node

Route internet traffic through an approved home server or VPS.

Read the guide

Remote access without open ports

Compare safer ways to reach a private network from outside.

Read the guide

Check whether you are behind CGNAT

Confirm why inbound router rules cannot reach your network.

Read the guide

Official references

Confirm current platform details before changing a production hypervisor.

Tailscale Proxmox documentation Proxmox VE network documentation

Share this article

Tailscale Proxmox placement planner

Use an unprivileged LXC subnet router

Review your Proxmox host choice

Proxmox host vs LXC vs VM for Tailscale

How to install Tailscale on Proxmox

Path A: Proxmox host

Path B: unprivileged LXC

Approve routes; do not expose the Proxmox web port

Verify the Tailscale Proxmox connection

Tailscale Proxmox troubleshooting

The Proxmox node appears offline

An LXC says /dev/net/tun is missing

The advertised subnet cannot be reached

The Proxmox web UI on port 8006 does not open

The Tailscale IP works but the hostname does not

Tailscale Proxmox FAQ

How do I install Tailscale on Proxmox?

Should Tailscale run on the Proxmox host or in an LXC?

How can I access the Proxmox web interface remotely with Tailscale?

Can an unprivileged Proxmox LXC run Tailscale?

How do I use Proxmox as a Tailscale subnet router?

Why is Tailscale on my Proxmox VM or LXC not working?

Does Tailscale need to be installed in every Proxmox guest?

Is Tailscale the same as Proxmox?

Related remote-access guides

Tailscale without port forwarding

Build a Tailscale exit node

Remote access without open ports

Check whether you are behind CGNAT

Official references