Tailscale SSH vs Opening Port 22: The Fail2ban Ritual You Can Delete

Port 22 on the WAN is a hobby that looks like operations. You add fail2ban. You change the port to 2222. You disable passwords. You still get scanned. You still maintain a ritual. Tailscale SSH (or just SSH bound to the tailnet, port closed on WAN) deletes the ritual. The scanners cannot see a socket you did not publish. That is the whole article, and people still open 22 because they once needed a jump from a hotel that would not install an app. If the open question is still Tailscale versus a commercial VPN, start with the real trade-offs of the mesh; this piece is only about SSH.

I have kept fail2ban jails like trophies. Then I closed the port and the trophies stopped growing. I did not become less careful. I became less proud of a log full of strangers.

What Tailscale SSH is and is not

Tailscale SSH can replace sshd’s auth with Tailscale identity and ACLs: who can root to which tag, for how long. That is a policy product. You can also ignore Tailscale SSH the feature and just run normal sshd listening on the tailnet IP, WAN 22 closed. Both beat a published port. The branded feature is nicer for check-ins and short-lived root. The boring bind is enough for a household.

Neither one is “SSH is obsolete.” You still need keys or identity. You still patch sshd. You still do not permit root password. You just stop inviting the internet to the exam. Root login over the mesh with a hardware key is still a grown-up design. Root login over the WAN with a password you banned in 2014 and a jail you tuned in 2019 is a museum. Close the museum.

The fail2ban ritual

fail2ban is a correct tool for a socket you had to publish. Mail servers, maybe a git forge you insisted on exposing. For SSH to your NAS, it is a consolation prize. The jail fills. You feel busy. The busy is not security. The busy is evidence you are famous to bots.

Nonstandard ports are folklore. They cut noise, not a targeted scan of your whole range. If you like quiet logs, close the port. If you like folklore, keep 2222 and enjoy the stories.

What the scan log was actually teaching you

A busy fail2ban jail feels like evidence of a hard life. It is evidence of a public socket. The same NAS on a tailnet gets none of that mail. You did not become invisible to a state actor. You became uninteresting to a botnet that walks IPv4. That is the threat most homelabs were actually writing jails for. If your threat is targeted, you already needed more than fail2ban: keys, updates, maybe a jump, maybe not running sshd as the only door. Publishing 22 does not help the targeted case. It only feeds the untargeted one.

I used to screenshot jail graphs for friends. It was a personality. The personality went away when the port closed. I miss it the way I miss a sport I was not good at. The NAS did not miss it.

When you still need inbound SSH

A device that cannot run Tailscale: some routers, some weird appliances. A recovery path when the tailnet is down. I keep a console, a keyboard, or a second overlay. I do not keep 22/WAN as the recovery path unless I enjoy being scanned during an outage. A serial adapter in a drawer has never emailed me a brute-force report.

CI that can only dial a public IP is a reason to use a runner on the tailnet or a proper tunnel you meant to run, not a permanent 22. “The SaaS cannot install Tailscale” is common. “Therefore my house SSH is public” is a leap. Jump through a small VPS you control if you must. That VPS is the published socket. The house is not.

ACLs beat ~/.ssh/authorized_keys sprawl — sometimes

Tailscale SSH ACLs centralize who can enter tagged machines. That is better than twelve authorized_keys you forgot. It is worse if the control plane is your only story and you cannot get in when Tailscale is sad. Keep an emergency key on the console. Do not keep it on port 22/WAN “just in case.” The case is a keyboard.

Tag servers. Do not give every phone a path to root on the NAS. The mesh makes it easy to be lazy in the other direction: every node can reach 22 on every node. ACLs are the fail2ban you actually wanted — deny by identity, not by ban after the fact.

Hotel Wi-Fi is not a reason to publish 22

The story is always the same. A network that breaks Tailscale. A phone that cannot install the app. A contractor with a locked laptop. Those are real. The answer is a second path you chose: a small VPS jump, a console, a travel router that already has the mesh, a phone hotspot that does work. The answer is not a permanent hole you leave open 365 days for a week of travel. I have opened a temporary hole and forgotten it. Forgetting is the product of “temporary.” Close it on a calendar, or do not open it.

CGNAT already closed 22 for a lot of apartments. People then fight the ISP to get a port so they can be scanned. That fight is optional. The mesh does not need the ISP’s inbound permission. That is why the mesh exists for households.

sshd still exists

ListenAddress on the tailnet. PasswordAuthentication no. A allowlist of users. Updates. None of that goes away. Tailscale is not a reason to run a five-year-old OpenSSH. It is a reason to stop publishing it. I still read OpenSSH release notes. I do not read fail2ban hits. That swap of attention is the security upgrade. Attention is finite. Spend it on patches, not on a jail that proves you are reachable.

Windows, phones, and the “I just need PuTTY”

Tailscale has clients. PuTTY can still aim at a 100.x address. The aunt who only knows a hostname and port 22 is a training problem or a jump host you operate, not a reason to publish the NAS. I have written a one-page note: install Tailscale, log in with this invite, SSH to this name. That note replaced a port-forward wiki that included fail2ban screenshots. The new note is shorter. The old wiki was a monument to a bad default.

Phone SSH apps work on the tailnet the same as on a LAN. If the phone is not on the tailnet, it should not be SSHing into the NAS from a cafe anyway. That sentence used to be controversial. It is not, once you have been scanned.

File copy is the other excuse: “I scp from anywhere.” Use the mesh, or use a sync tool you meant to run, or use a jump. scp to a public 22 is how a leaked key becomes a leaked disk. Keys leak. Assume they will. A leaked key plus no public socket is a smaller fire than a leaked key plus a famous port.

Migrating without a weekend of lockout

Confirm Tailscale on the admin laptop and on the server. SSH to the tailnet IP while 22/WAN is still open. Confirm a second laptop. Then close the WAN rule. Do not close first and discover the server was not on the tailnet. I have done that. The keyboard in the drawer is why it was funny later.

Leave sshd running. Change ListenAddress or the firewall input chain, not the package. You will want local SSH on the LAN if the mesh dies and you are standing in the house. LAN 22 plus WAN closed is a sane split. WAN 22 plus pride is the old split.

The close

Open 22 if you enjoy fail2ban as a personality. Close it if you enjoy quiet logs and a mesh you already run. Tailscale SSH or sshd-on-tailnet is the same idea: identity inside a private network. The ritual you can delete is the one that pretended a public socket was inevitable. It was a habit. Habits can close.

If you keep one public socket this year, do not let it be SSH to the box that holds the backups. Keep a VPS jump if a vendor cannot speak Tailscale. Keep a console. Keep keys rotated. Delete the jail graphs from the homepage of your brain. They were never a resume line. They were a port. The port can go. The work you actually wanted — getting a shell on your own metal — still works. It just stopped being a community event for every scanner in the routing table.