Tailscale for Game Servers: Play With Friends Without Port Forwarding

Tailscale lets friends join your home game server as if they were on your LAN, with no port forwarding, even behind CGNAT. Install Tailscale on the server PC, have each friend install it and sign in to their own account, then share the server machine with them from the Tailscale admin console. Friends connect to the server's Tailscale address (a 100.x.y.z IP or its MagicDNS name) plus the game port. Every player has to run Tailscale, LAN discovery does not work, and Tailscale Funnel cannot carry game traffic.

How Tailscale helps a game server

Tailscale builds a private, encrypted network (a "tailnet") between your devices using WireGuard. Each device gets an address in the 100.64.0.0/10 range. Devices find each other through Tailscale's coordination servers and try to connect directly, punching through NAT. If a direct path is impossible, traffic goes through Tailscale's DERP relay servers instead.

For hosting that means:

• No port forwarding, no public IP needed.
• Works on most CGNAT connections (5G home internet, Starlink, many fiber ISPs).
• Your server is not exposed to the internet, only to people you share it with.

Step 1: install Tailscale on the server PC

1. Download Tailscale for Windows, macOS or Linux from tailscale.com.
2. On Linux, the one line installer is:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

3. Sign in. The server appears in the Machines list of the admin console with a 100.x.y.z address.
4. In the admin console, open the machine's menu and choose Disable key expiry so the server does not drop off the tailnet when its login key expires.

Step 2: share the server with friends

There are two ways to bring friends in. Sharing is usually the better one for gaming.

Option A: share the machine (recommended). Friends keep their own tailnet and only see your server.

1. In the admin console, open the server machine's menu and choose Share.
2. Send the invite link to each friend.
3. Each friend installs Tailscale, signs in with their own account and accepts the share.

Option B: invite them as users in your tailnet. They become members of your network and can, by default, reach every device on it, including your personal PC and phone. Only do this with access controls in place.

Free plan limits on users and devices change from time to time; check Tailscale's pricing page for the current numbers. Sharing a machine with friends who have their own accounts is the usual way to stay within the free tier.

Step 3: allow the game through the server's firewall

Windows may classify the Tailscale network adapter as a Public network, so an allow rule for Private networks only will not apply. Add an inbound rule for the game port covering all profiles. Steps and PowerShell commands are in Windows Firewall rules for a game server. You do not need any rule on your router.

Step 4: connect

Friends type the server's Tailscale address and port into the game's direct connect box:

100.101.102.103:2456

With MagicDNS on, they can use the machine name instead, such as gamebox:25565. Shared machines show up with a full name ending in .ts.net.

Things that trip people up

LAN server lists stay empty. Tailscale does not carry broadcast or multicast traffic, so games that find LAN servers by broadcasting (Minecraft's "Open to LAN" list, some older games) will not see the server. Direct connect by IP works. If your game only supports LAN discovery, ZeroTier handles broadcast traffic and may suit it better.

Connection is slow or laggy. The connection may be going through a DERP relay instead of directly. Run:

tailscale status
tailscale ping 100.x.y.z

If it says via DERP, the connection is relayed. Relays work but add latency, especially if the nearest relay is far away. Strict firewalls and some CGNAT setups force this. On your own router, enabling UPnP or NAT-PMP can help Tailscale find a direct path.

Steam server browser does not show it. Steam lists servers by their public address and query port, which a Tailscale only server does not advertise usefully. Use direct connect.

A friend joins but others cannot. Each player needs Tailscale running and the share accepted. "Connected yesterday, not today" often means their Tailscale app was signed out or not running.

Tailscale Funnel. Funnel exposes a service to the public internet, but only over TCP with TLS, on ports 443, 8443 and 10000. That does not suit game servers, most of which use UDP on their own ports. Use normal sharing instead.

Security

Sharing one machine means friends can reach that machine's open ports, not the rest of your network. Keep the game's password or allow list on anyway. If you invited friends as users, set up access control rules in the admin console so they can only reach the server and the game ports.

Tailscale vs playit.gg vs port forwarding

• Tailscale: private, encrypted, no exposure to the internet, but every player installs an app and signs in. Best for a fixed group of friends.
• playit.gg: friends install nothing, works for public servers, adds a relay hop.
• Port forwarding: direct and fast, needs a public IP and router access, exposes your home IP.

For a full comparison including Hamachi and Radmin, see Hamachi alternatives for game servers.

No app for anyone

Tailscale is excellent for a small fixed group, but each new friend means another install and invite, and the server still runs on your PC. A GamezServers server has a public address anyone can join with the game alone, plus a panel, console and one click backups. Your group can split the bill so each person pays their share. See game server for friends.

FAQ

Is Tailscale free for gaming with friends?

Tailscale has a free Personal plan. Sharing your server machine with friends who use their own free accounts covers most small groups. Check Tailscale's pricing page for current limits.

Does Tailscale add lag?

Not much on a direct connection. If the connection falls back to a DERP relay, latency goes up depending on how far the relay is.

Can I use Tailscale for a Minecraft server?

Yes. Friends add the server using its 100.x.y.z address or MagicDNS name. "Open to LAN" discovery does not show up, but direct connect works.

Do my friends need a Tailscale account?

Yes. Each player installs Tailscale and signs in, then accepts your share invite.