{"slug":"access-oracle-cloud-vms-privately-using-tailscale","title":"Access Oracle Cloud VMs privately using Tailscale","tags":["tailscale","access-control","setup"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Access Oracle Cloud VMs privately using Tailscale\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nOracle Cloud provides Linux virtual machines, notably featuring the ARM CPU architecture.\r\nWe can use Tailscale to securely access Oracle virtual machines.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/install/cloud/oracle-cloud\\#prerequisites)\r\n\r\nBefore you begin this guide, you'll need a Tailscale network set up and configured with at\r\nleast one existing device. Read our [getting started guide](https://tailscale.com/docs/how-to/quickstart)\r\nif you need help with this.\r\n\r\n## [Step 1: Set up the Tailscale client for the VM](https://tailscale.com/docs/install/cloud/oracle-cloud\\#step-1-set-up-the-tailscale-client-for-the-vm)\r\n\r\nFirst, [create a Virtual Machine in the OCN Console](https://cloud.oracle.com/compute/instances/create).\r\n\r\nSSH to the system and follow the steps to\r\n[install Tailscale on Oracle Linux](https://tailscale.com/docs/install/linux).\r\n\r\n## [Step 2: Allow UDP port 41641](https://tailscale.com/docs/install/cloud/oracle-cloud\\#step-2-allow-udp-port-41641)\r\n\r\nIf at least one side of a tunnel has \"easy NAT,\" where Tailscale can determine the UDP port\r\nnumber on the far side of the NAT device, then it will make\r\n[direct connections to minimize latency.](https://tailscale.com/blog/how-tailscale-works)\r\nWe ensure that OCN nodes can make direct connections by allowing UDP port 41641 to ingress\r\nthrough the firewall.\r\n\r\nIn the [Networking tab](https://cloud.oracle.com/networking/vcns) select **Virtual Cloud Networks**\r\nselect the specific VCN the VM has been created on.\r\n\r\n![Virtual Cloud Networks list](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Focn-virtual-networks.3e00ae29.jpg&w=3840&q=75)\r\n\r\nSelect **Security Lists** in the left hand column, and the security list in use (probably\r\na Default).\r\n\r\n![Security lists](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Focn-security-lists.cbdef29c.jpg&w=1920&q=75)\r\n\r\nAdd a Stateless ingress rule for 0.0.0.0/0 UDP port 41641.\r\n\r\n![Adding an Ingress Rule](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Focn-ingress-rule.c4c62704.jpg&w=3840&q=75)\r\n\r\n## [Step 3: Advertise routes from the VM](https://tailscale.com/docs/install/cloud/oracle-cloud\\#step-3-advertise-routes-from-the-vm)\r\n\r\nFor the benefit of the _other_ nodes in the tailnet we'll set up\r\n[split DNS](https://tailscale.com/docs/reference/dns-in-tailscale#tailscale-dns-settings) to allow\r\nuse of the same DNS names as are used inside of Oracle Cloud. The DNS server provided by Oracle\r\nis 169.254.169.254, and supports hostnames of the form `instance.subnet01234567.vcn01234567.oraclevcn.com`.\r\n\r\nWe'll have our VM advertise routes for both the subnet it sits on as well as the Oracle DNS\r\nserver. For example, if the subnet address range is 10.0.0.0/24, the command would be:\r\n\r\n```shell\r\ntailscale set --advertise-routes=10.0.0.0/24,169.254.169.254/32 --accept-dns=false\r\n```\r\n\r\nFor Oracle Cloud VMs it is generally best to let Oracle handle the DNS configuration,\r\nnot have Tailscale override it, so we added `--accept-dns=false`.\r\n\r\n## [Step 4: Add Oracle DNS for your tailnet](https://tailscale.com/docs/install/cloud/oracle-cloud\\#step-4-add-oracle-dns-for-your-tailnet)\r\n\r\nIn the [DNS](https://login.tailscale.com/admin/dns) page of the admin console we add a nameserver\r\nrestricted to the `oraclevcn.com` domain, pointing to the Oracle DNS server which we\r\nmade available through our VM.\r\n\r\n![Adding a Split DNS resolver for oraclevcn.com](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Focn-nameserver.d9120af0.jpg&w=3840&q=75)\r\n\r\nNow the same hostnames which work between nodes running within Oracle Cloud will also be available\r\nto all nodes on our tailnet.\r\n\r\n## [Step 5: Remove public SSH access](https://tailscale.com/docs/install/cloud/oracle-cloud\\#step-5-remove-public-ssh-access)\r\n\r\nAs we can now SSH to the system over the private Tailscale network, there is no reason to leave\r\nthe SSH port open on a public IP address. In the Network > Security List the SSH rule can be\r\nremoved.\r\n\r\n![Disable public SSH port.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Focn-remove-ssh.8e01a96c.png&w=3840&q=75)\r\n\r\n## [Troubleshooting](https://tailscale.com/docs/install/cloud/oracle-cloud\\#troubleshooting)\r\n\r\nFor troubleshooting information, refer to [Troubleshoot Linux cloud devices](https://tailscale.com/docs/reference/troubleshooting/cloud/oracle-cloud).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Access Oracle Cloud VMs privately using Tailscale

\n

Last validated: Jan 5, 2026

\n

Oracle Cloud provides Linux virtual machines, notably featuring the ARM CPU architecture.\r\nWe can use Tailscale to securely access Oracle virtual machines.

\n

Prerequisites

\n

Before you begin this guide, you'll need a Tailscale network set up and configured with at\r\nleast one existing device. Read our getting started guide\r\nif you need help with this.

\n

Step 1: Set up the Tailscale client for the VM

\n

First, create a Virtual Machine in the OCN Console.

\n

SSH to the system and follow the steps to\r\ninstall Tailscale on Oracle Linux.

\n

Step 2: Allow UDP port 41641

\n

If at least one side of a tunnel has \"easy NAT,\" where Tailscale can determine the UDP port\r\nnumber on the far side of the NAT device, then it will make\r\ndirect connections to minimize latency.\r\nWe ensure that OCN nodes can make direct connections by allowing UDP port 41641 to ingress\r\nthrough the firewall.

\n

In the Networking tab select Virtual Cloud Networks\r\nselect the specific VCN the VM has been created on.

\n

\"Virtual

\n

Select Security Lists in the left hand column, and the security list in use (probably\r\na Default).

\n

\"Security

\n

Add a Stateless ingress rule for 0.0.0.0/0 UDP port 41641.

\n

\"Adding

\n

Step 3: Advertise routes from the VM

\n

For the benefit of the other nodes in the tailnet we'll set up\r\nsplit DNS to allow\r\nuse of the same DNS names as are used inside of Oracle Cloud. The DNS server provided by Oracle\r\nis 169.254.169.254, and supports hostnames of the form instance.subnet01234567.vcn01234567.oraclevcn.com.

\n

We'll have our VM advertise routes for both the subnet it sits on as well as the Oracle DNS\r\nserver. For example, if the subnet address range is 10.0.0.0/24, the command would be:

\n
tailscale set --advertise-routes=10.0.0.0/24,169.254.169.254/32 --accept-dns=false\n
\n

For Oracle Cloud VMs it is generally best to let Oracle handle the DNS configuration,\r\nnot have Tailscale override it, so we added --accept-dns=false.

\n

Step 4: Add Oracle DNS for your tailnet

\n

In the DNS page of the admin console we add a nameserver\r\nrestricted to the oraclevcn.com domain, pointing to the Oracle DNS server which we\r\nmade available through our VM.

\n

\"Adding

\n

Now the same hostnames which work between nodes running within Oracle Cloud will also be available\r\nto all nodes on our tailnet.

\n

Step 5: Remove public SSH access

\n

As we can now SSH to the system over the private Tailscale network, there is no reason to leave\r\nthe SSH port open on a public IP address. In the Network > Security List the SSH rule can be\r\nremoved.

\n

\"Disable

\n

Troubleshooting

\n

For troubleshooting information, refer to Troubleshoot Linux cloud devices.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}