Put SSH Behind Tailscale and Close Port 22

Description and use

SSH moved behind Tailscale, port 22 closed; access only via private VPN address.

Problem

Exposing SSH on the public internet increases attack surface and scanning risk.

Outcome

SSH access is now confined to a private Tailscale network, eliminating exposure to public port 22 while maintaining secure key‑based authentication.

Workflow

• Install Tailscale on server and client and authenticate
• Verify server’s 100.x.x.x address and test SSH over it
• Disable key expiry for the server in Tailscale admin console
• Allow traffic on tailscale0 in UFW and remove OpenSSH rule
• Confirm UFW rules and that sshd still listens on 0.0.0.0:22
• Test new SSH session over Tailscale before closing old one
• Keep provider console as recovery path
• If misconfiguration occurs, re‑open public SSH first

Evidence

Verified end to end on a real Ubuntu 24.04.4 server: joined a tailnet, allowed tailscale0 in UFW, and removed the public port 22 rule.

Source

Disable key expiry on the server in the admin console, or Tailscale logs you out in 180 days and you cannot reauth remotely.

Source