{"slug":"access-hetzner-servers-privately-using-tailscale","title":"Access Hetzner Servers privately using Tailscale","tags":["tailscale","access-control","setup"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Access Hetzner Servers privately using Tailscale\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nHetzner provides Linux virtual machines from several data centers in Europe.\r\nWe can use Tailscale to securely access these servers.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/install/cloud/hetzner\\#prerequisites)\r\n\r\nBefore you begin this guide, you'll need a Tailscale network set up and configured with at\r\nleast one existing device. Read our [getting started guide](https://tailscale.com/docs/how-to/quickstart)\r\nif you need help with this.\r\n\r\n## [Step 1: Set up the Tailscale client for the VM](https://tailscale.com/docs/install/cloud/hetzner\\#step-1-set-up-the-tailscale-client-for-the-vm)\r\n\r\nFirst, [create a Virtual Machine in the Hetzner Cloud Console](https://console.hetzner.cloud/).\r\n\r\nSSH to the system and install the Tailscale client:\r\n\r\n```shell\r\n# curl -fsSL https://tailscale.com/install.sh | sh\r\n# tailscale up\r\n```\r\n\r\nIn the next step we'll remove SSH access from the public IP address, so:\r\n\r\n1. Find the Tailscale IP address using [`tailscale ip`](https://tailscale.com/docs/reference/tailscale-cli#ip).\r\n2. Exit from the SSH session to the public IP address.\r\n3. Make a new SSH session to the Tailscale IP address.\r\n\r\n## [Step 2: Allow UDP port 41641](https://tailscale.com/docs/install/cloud/hetzner\\#step-2-allow-udp-port-41641)\r\n\r\nIf at least one side of a tunnel has \"easy NAT,\" where Tailscale can determine the UDP port\r\nnumber on the far side of the NAT device, then it will make\r\n[direct connections to minimize latency.](https://tailscale.com/blog/how-tailscale-works)\r\nWe ensure that Hetzner nodes can make direct connections by allowing UDP port 41641 to ingress\r\nthrough the firewall.\r\n\r\nIn the [Firewall tab of the Hetzner Cloud Console](https://console.hetzner.cloud/) select\r\nthe **Create Firewall** button. Delete the SSH and ICMP rules and add a rule allowing UDP\r\nport 41641.\r\n\r\n![Firewall rule for UDP port 41641](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fhetzner-firewall.faae59fd.jpg&w=3840&q=75)\r\n\r\nIf you want to allow direct connection _between_ Hetzner VMs, also add an outbound firewall rule\r\nallowing UDP port 3478.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Access Hetzner Servers privately using Tailscale</h1>\n<p>Last validated: Jan 5, 2026</p>\n<p>Hetzner provides Linux virtual machines from several data centers in Europe.\r\nWe can use Tailscale to securely access these servers.</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/hetzner#prerequisites\">Prerequisites</a></h2>\n<p>Before you begin this guide, you'll need a Tailscale network set up and configured with at\r\nleast one existing device. Read our <a href=\"https://tailscale.com/docs/how-to/quickstart\">getting started guide</a>\r\nif you need help with this.</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/hetzner#step-1-set-up-the-tailscale-client-for-the-vm\">Step 1: Set up the Tailscale client for the VM</a></h2>\n<p>First, <a href=\"https://console.hetzner.cloud/\">create a Virtual Machine in the Hetzner Cloud Console</a>.</p>\n<p>SSH to the system and install the Tailscale client:</p>\n<pre><code class=\"language-shell\"># curl -fsSL https://tailscale.com/install.sh | sh\r\n# tailscale up\n</code></pre>\n<p>In the next step we'll remove SSH access from the public IP address, so:</p>\n<ol>\n<li>Find the Tailscale IP address using <a href=\"https://tailscale.com/docs/reference/tailscale-cli#ip\"><code>tailscale ip</code></a>.</li>\n<li>Exit from the SSH session to the public IP address.</li>\n<li>Make a new SSH session to the Tailscale IP address.</li>\n</ol>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/hetzner#step-2-allow-udp-port-41641\">Step 2: Allow UDP port 41641</a></h2>\n<p>If at least one side of a tunnel has \"easy NAT,\" where Tailscale can determine the UDP port\r\nnumber on the far side of the NAT device, then it will make\r\n<a href=\"https://tailscale.com/blog/how-tailscale-works\">direct connections to minimize latency.</a>\r\nWe ensure that Hetzner nodes can make direct connections by allowing UDP port 41641 to ingress\r\nthrough the firewall.</p>\n<p>In the <a href=\"https://console.hetzner.cloud/\">Firewall tab of the Hetzner Cloud Console</a> select\r\nthe <strong>Create Firewall</strong> button. Delete the SSH and ICMP rules and add a rule allowing UDP\r\nport 41641.</p>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fhetzner-firewall.faae59fd.jpg&#x26;w=3840&#x26;q=75\" alt=\"Firewall rule for UDP port 41641\"></p>\n<p>If you want to allow direct connection <em>between</em> Hetzner VMs, also add an outbound firewall rule\r\nallowing UDP port 3478.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}