{"id":2478,"date":"2026-08-05T11:12:06","date_gmt":"2026-08-05T11:12:06","guid":{"rendered":"https:\/\/sepno.net\/?p=2478"},"modified":"2026-08-05T12:01:49","modified_gmt":"2026-08-05T12:01:49","slug":"tailscale-vpn-docker-swarm-secure-remote-access-en","status":"publish","type":"post","link":"https:\/\/sepno.net\/?p=2478","title":{"rendered":"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs"},"content":{"rendered":"<style>\nbody.single-post .content.blog-wrapper.post-style-1{padding-top:30px!important}body.single-post .blog-wrapper .entry-title{margin-bottom:8px!important}body.single-post .blog-wrapper .wp-post-image{margin-top:24px!important;margin-bottom:18px!important;max-height:520px;object-fit:cover}body.single-post article.hentry>.spc-20{height:0!important}\n.sepno-article{--muted:#94a3b8;--panel:#0f1d35;--panel2:#132746;--line:#274264;--cyan:#22d3ee;--blue:#60a5fa;--violet:#a78bfa;max-width:960px;margin:0 auto;color:#dbeafe;font-family:inherit;line-height:1.8;background:#071225;border-radius:28px;overflow:hidden;box-shadow:0 30px 80px rgba(2,8,23,.22)}.sepno-article *{box-sizing:border-box}.sepno-article a{color:#67e8f9}.sepno-article h2,.sepno-article h3{color:#fff;line-height:1.35}.sepno-article h2{font-size:clamp(1.55rem,3vw,2.2rem);margin:0 0 18px}.sepno-article h3{font-size:1.15rem;margin:0 0 8px}.sepno-article p{margin:0 0 18px;color:#cbd5e1}.sepno-hero{padding:clamp(22px,4vw,42px);background:radial-gradient(circle at 15% 10%,rgba(34,211,238,.18),transparent 34%),radial-gradient(circle at 90% 35%,rgba(167,139,250,.14),transparent 34%),#071225}.sepno-eyebrow{display:inline-flex;padding:7px 14px;border:1px solid rgba(103,232,249,.28);border-radius:999px;color:#67e8f9;font-size:.82rem;font-weight:800;letter-spacing:.05em}.sepno-lead{font-size:clamp(1.05rem,2vw,1.32rem)!important;color:#e2e8f0!important;max-width:800px;margin:18px 0 22px!important}.sepno-hero img{width:100%;display:block;border-radius:22px;border:1px solid rgba(148,163,184,.2);box-shadow:0 24px 65px rgba(0,0,0,.38)}.sepno-meta{display:flex;flex-wrap:wrap;gap:10px;margin:18px 0}.sepno-pill{padding:7px 12px;border-radius:10px;background:rgba(15,29,53,.82);border:1px solid var(--line);color:#bae6fd;font-size:.82rem}.sepno-body{padding:clamp(22px,4vw,42px)}.sepno-summary{padding:22px;border:1px solid rgba(34,211,238,.32);background:linear-gradient(135deg,rgba(34,211,238,.1),rgba(96,165,250,.05));border-radius:20px;margin-bottom:30px}.sepno-summary strong{color:#67e8f9}.sepno-section{padding:28px 0;border-top:1px solid rgba(39,66,100,.75)}.sepno-section:first-of-type{border-top:0}.sepno-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:16px;margin:20px 0}.sepno-card{padding:20px;background:linear-gradient(145deg,var(--panel),var(--panel2));border:1px solid var(--line);border-radius:18px}.sepno-card b{display:block;color:#fff;margin-bottom:5px}.sepno-card span{color:var(--muted);font-size:.9rem}.sepno-number{display:grid;place-items:center;width:34px;height:34px;border-radius:10px;background:linear-gradient(135deg,var(--cyan),var(--blue));color:#061224;font-weight:900;margin-bottom:12px}.sepno-code{direction:ltr;text-align:left;white-space:pre-wrap;padding:20px 22px;margin:18px 0;background:#020817;color:#a5f3fc;border:1px solid #1e3a5f;border-radius:16px;overflow:auto;font:500 .92rem\/1.8 ui-monospace,SFMono-Regular,Menlo,monospace}.sepno-note{padding:20px 22px;border-left:4px solid var(--violet);background:rgba(167,139,250,.08);border-radius:14px;margin:20px 0;color:#ddd6fe}.sepno-warning{padding:20px 22px;border-left:4px solid #f59e0b;background:rgba(245,158,11,.08);border-radius:14px;margin:20px 0;color:#fde68a}.sepno-table-wrap{overflow:auto;border:1px solid var(--line);border-radius:18px;margin:20px 0}.sepno-table{width:100%;border-collapse:collapse;min-width:620px}.sepno-table th,.sepno-table td{padding:14px 16px;border-bottom:1px solid var(--line);text-align:left}.sepno-table th{background:#10223e;color:#67e8f9}.sepno-table td{color:#cbd5e1}.sepno-table tr:last-child td{border-bottom:0}.sepno-checks{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:12px;padding:0;margin:20px 0;list-style:none}.sepno-checks li{position:relative;padding:14px 16px 14px 46px;background:var(--panel);border:1px solid var(--line);border-radius:14px;color:#cbd5e1}.sepno-checks li:before{content:'\u2713';position:absolute;left:15px;top:13px;color:#5eead4;font-weight:900}.sepno-faq details{background:var(--panel);border:1px solid var(--line);border-radius:14px;margin:10px 0;padding:0 18px}.sepno-faq summary{cursor:pointer;color:#fff;font-weight:800;padding:17px 0}.sepno-faq details p{padding-bottom:16px}.sepno-outro{padding:24px;border-radius:22px;background:linear-gradient(135deg,rgba(34,211,238,.16),rgba(167,139,250,.14));border:1px solid rgba(103,232,249,.25)}@media(max-width:760px){.sepno-grid,.sepno-checks{grid-template-columns:1fr}.sepno-article{border-radius:18px}.sepno-hero,.sepno-body{padding:24px}.sepno-table th,.sepno-table td{padding:11px}}\n<\/style>\n<article class=\"sepno-article\" dir=\"ltr\">\n<header class=\"sepno-hero\">\n    <span class=\"sepno-eyebrow\">REAL DEVOPS EXPERIENCE \u00b7 PRACTICAL GUIDE<\/span><\/p>\n<p class=\"sepno-lead\">Three Linux servers, three different networks, and one Docker Swarm\u2014without public IP addresses, router port forwarding, or internet-facing management ports.<\/p>\n<div class=\"sepno-meta\"><span class=\"sepno-pill\">Tailscale VPN<\/span><span class=\"sepno-pill\">Docker Swarm<\/span><span class=\"sepno-pill\">WireGuard<\/span><span class=\"sepno-pill\">Zero Trust<\/span><\/div>\n<\/header>\n<div class=\"sepno-body\">\n<div class=\"sepno-summary\"><strong>The short version:<\/strong> Tailscale did not replace security engineering. It removed the network friction. Each node received a stable private address, discovered the other nodes, and carried Swarm traffic through an encrypted mesh.<\/div>\n<section class=\"sepno-section\">\n<h2>Docker was ready. The network was not.<\/h2>\n<p>My lab had a Linux Mint manager, a Rocky Linux worker behind NAT, and a Debian worker on a separate network. Docker was running everywhere, but a Swarm cannot form without dependable node-to-node connectivity.<\/p>\n<div class=\"sepno-grid\">\n<div class=\"sepno-card\"><span class=\"sepno-number\">1<\/span><b>Manager<\/b><span>Linux Mint on the local network<\/span><\/div>\n<div class=\"sepno-card\"><span class=\"sepno-number\">2<\/span><b>Worker<\/b><span>Rocky Linux behind NAT<\/span><\/div>\n<div class=\"sepno-card\"><span class=\"sepno-number\">3<\/span><b>Worker<\/b><span>Debian on another network<\/span><\/div>\n<\/p><\/div>\n<p>Swarm needs TCP\/2377 for cluster management, TCP and UDP\/7946 for node discovery, and UDP\/4789 for the overlay network. Exposing these ports\u2014especially VXLAN\u2014to the public internet was not an acceptable design.<\/p>\n<div class=\"sepno-warning\"><strong>The goal:<\/strong> make the nodes behave like members of one private LAN while keeping management services invisible to the public internet.<\/div>\n<\/section>\n<section class=\"sepno-section\">\n<h2>What Tailscale actually changes<\/h2>\n<p>Tailscale creates a private tailnet on top of WireGuard. Every device receives its own identity and private address. When possible, traffic takes a direct peer-to-peer path; Tailscale coordinates keys, NAT traversal, DNS, device discovery, routes, and access policy.<\/p>\n<div class=\"sepno-grid\">\n<div class=\"sepno-card\"><b>Control plane<\/b><span>Coordinates identity, keys, routes, and policies.<\/span><\/div>\n<div class=\"sepno-card\"><b>Data plane<\/b><span>Carries real traffic through encrypted WireGuard tunnels.<\/span><\/div>\n<div class=\"sepno-card\"><b>Relay fallback<\/b><span>DERP or peer relay is used only when direct connectivity fails.<\/span><\/div>\n<\/p><\/div>\n<pre class=\"sepno-code\">Laptop \u2500\u2500\u2500\u2500\u2500 WireGuard encrypted tunnel \u2500\u2500\u2500\u2500\u2500 Server\n        direct when possible \u00b7 relay when necessary<\/pre>\n<p>A relayed connection remains end-to-end encrypted. The practical trade-off is latency and throughput, not confidentiality.<\/p>\n<\/section>\n<section class=\"sepno-section\">\n<h2>Building the Swarm on Tailscale addresses<\/h2>\n<p>After installing Tailscale on all three systems, I verified connectivity with <code>tailscale status<\/code> and <code>tailscale ping<\/code>. Then I told Docker to advertise the manager&#8217;s Tailscale address.<\/p>\n<h3>1. Initialize the manager<\/h3>\n<pre class=\"sepno-code\">docker swarm init \\\n  --advertise-addr &lt;TAILSCALE_MANAGER_IP&gt;<\/pre>\n<h3>2. Join each worker<\/h3>\n<pre class=\"sepno-code\">docker swarm join \\\n  --token &lt;WORKER_TOKEN&gt; \\\n  &lt;TAILSCALE_MANAGER_IP&gt;:2377<\/pre>\n<h3>3. Verify the path and the cluster<\/h3>\n<pre class=\"sepno-code\">tailscale ping swarm-manager-mint\ndocker node ls<\/pre>\n<div class=\"sepno-note\">A <strong>direct<\/strong> result means the peers established a direct path. A <strong>relay<\/strong> result means DERP is carrying the encrypted packets and performance may be lower.<\/div>\n<\/section>\n<section class=\"sepno-section\">\n<h2>What changed in day-to-day operation<\/h2>\n<ul class=\"sepno-checks\">\n<li>No router port forwarding<\/li>\n<li>No static public IP dependency<\/li>\n<li>SSH reachable only privately<\/li>\n<li>MagicDNS instead of memorized IPs<\/li>\n<li>Three networks behaving like one LAN<\/li>\n<li>Access limited by tags and policy<\/li>\n<\/ul>\n<p>For server access I could keep ordinary OpenSSH and use Tailscale addresses, or enable Tailscale SSH for identity-aware authorization.<\/p>\n<pre class=\"sepno-code\">sudo tailscale set --ssh\nssh sepehr@swarm-manager-mint<\/pre>\n<\/section>\n<section class=\"sepno-section\">\n<h2>Tailscale versus a traditional VPN<\/h2>\n<div class=\"sepno-table-wrap\">\n<table class=\"sepno-table\">\n<thead>\n<tr>\n<th>Concern<\/th>\n<th>Traditional VPN<\/th>\n<th>Tailscale<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Topology<\/td>\n<td>Usually a central gateway<\/td>\n<td>Mesh; direct where possible<\/td>\n<\/tr>\n<tr>\n<td>NAT traversal<\/td>\n<td>More manual configuration<\/td>\n<td>Automatic on many networks<\/td>\n<\/tr>\n<tr>\n<td>Key management<\/td>\n<td>Manual or server-centered<\/td>\n<td>Identity and device based<\/td>\n<\/tr>\n<tr>\n<td>Internal DNS<\/td>\n<td>Separate configuration<\/td>\n<td>MagicDNS<\/td>\n<\/tr>\n<tr>\n<td>Access control<\/td>\n<td>Primarily network based<\/td>\n<td>User, device, tag, and policy based<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>A traditional VPN is still the right choice when full gateway and routing control is the priority. For homelabs, small teams, and distributed infrastructure, Tailscale usually has a much smaller operational footprint.<\/p>\n<\/section>\n<section class=\"sepno-section\">\n<h2>Security still requires deliberate policy<\/h2>\n<p>Installing Tailscale does not automatically create a Zero Trust environment. The useful part is the ability to make identity-aware, least-privilege rules\u2014and then maintain them.<\/p>\n<ul class=\"sepno-checks\">\n<li>Review the default policy<\/li>\n<li>Tag servers by role<\/li>\n<li>Restrict SSH to management devices<\/li>\n<li>Enable MFA at the identity provider<\/li>\n<li>Remove retired devices<\/li>\n<li>Keep the operating-system firewall<\/li>\n<\/ul>\n<div class=\"sepno-warning\">For Swarm, allow only the required ports between <code>tag:swarm-manager<\/code> and <code>tag:swarm-worker<\/code>. A private tailnet should never become an unrestricted flat network.<\/div>\n<\/section>\n<section class=\"sepno-section\">\n<h2>Where subnet routers fit<\/h2>\n<p>Printers, NAS devices, routers, and legacy systems may not support a Tailscale client. A Tailscale node can advertise their local subnet instead:<\/p>\n<pre class=\"sepno-code\">sudo tailscale set \\\n  --advertise-routes=192.168.56.0\/24<\/pre>\n<p>After the route is approved, only tailnet identities allowed by policy can reach those resources.<\/p>\n<\/section>\n<section class=\"sepno-section sepno-faq\">\n<h2>Frequently asked questions<\/h2>\n<details>\n<summary>Does Tailscale require a public IP?<\/summary>\n<p>Usually not. It attempts NAT traversal first and falls back to an encrypted relay when a direct path is unavailable.<\/p>\n<\/details>\n<details>\n<summary>Does traffic always pass through Tailscale servers?<\/summary>\n<p>No. Direct connections move traffic peer to peer. DERP is used only when direct connectivity cannot be established.<\/p>\n<\/details>\n<details>\n<summary>Is Tailscale suitable for Docker Swarm?<\/summary>\n<p>It is highly useful for labs and distributed nodes, provided Swarm ports and access policies are designed carefully.<\/p>\n<\/details>\n<details>\n<summary>How is Tailscale different from WireGuard?<\/summary>\n<p>WireGuard is the tunneling protocol. Tailscale adds identity, key management, mesh coordination, NAT traversal, DNS, and access policy.<\/p>\n<\/details>\n<\/section>\n<section class=\"sepno-section\">\n<div class=\"sepno-outro\">\n<h2>Final takeaway<\/h2>\n<p>The real value of Tailscale was not \u201canother VPN.\u201d It removed network friction. Three nodes in three environments became a private, manageable Swarm without public management ports or hand-maintained tunnels\u2014leaving me free to work on the infrastructure instead of the routers around it.<\/p>\n<\/div>\n<\/section><\/div>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>A practical guide to connecting Docker Swarm nodes across different networks with Tailscale\u2014without public IPs, router port forwarding, or exposed management ports.<\/p>\n","protected":false},"author":1,"featured_media":2480,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2478","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Tailscale VPN: Secure Docker Swarm Networking Without Public IPs - Sepno Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sepno.net\/?p=2478\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs - Sepno Network\" \/>\n<meta property=\"og:description\" content=\"A practical guide to connecting Docker Swarm nodes across different networks with Tailscale\u2014without public IPs, router port forwarding, or exposed management ports.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sepno.net\/?p=2478\" \/>\n<meta property=\"og:site_name\" content=\"Sepno Network\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-05T11:12:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-05T12:01:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sepno.net\/wp-content\/uploads\/2026\/08\/tailscale-docker-swarm-secure-mesh-web.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/sepno.net\\\/#\\\/schema\\\/person\\\/5edc6550ac1b27272ff9164e461a8461\"},\"headline\":\"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs\",\"datePublished\":\"2026-08-05T11:12:06+00:00\",\"dateModified\":\"2026-08-05T12:01:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478\"},\"wordCount\":741,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sepno.net\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/tailscale-docker-swarm-secure-mesh-web.jpg\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/sepno.net\\\/?p=2478#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478\",\"url\":\"https:\\\/\\\/sepno.net\\\/?p=2478\",\"name\":\"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs - Sepno Network\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sepno.net\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/tailscale-docker-swarm-secure-mesh-web.jpg\",\"datePublished\":\"2026-08-05T11:12:06+00:00\",\"dateModified\":\"2026-08-05T12:01:49+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/#\\\/schema\\\/person\\\/5edc6550ac1b27272ff9164e461a8461\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sepno.net\\\/?p=2478\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478#primaryimage\",\"url\":\"https:\\\/\\\/sepno.net\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/tailscale-docker-swarm-secure-mesh-web.jpg\",\"contentUrl\":\"https:\\\/\\\/sepno.net\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/tailscale-docker-swarm-secure-mesh-web.jpg\",\"width\":1600,\"height\":900},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sepno.net\\\/?p=2478#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sepno.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sepno.net\\\/#website\",\"url\":\"https:\\\/\\\/sepno.net\\\/\",\"name\":\"Sepno Network\",\"description\":\"DevOps\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sepno.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sepno.net\\\/#\\\/schema\\\/person\\\/5edc6550ac1b27272ff9164e461a8461\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/00c2182714c0a81a06e0e6778a79794f969622bb79c398db5e5045e07d4d32b3?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/00c2182714c0a81a06e0e6778a79794f969622bb79c398db5e5045e07d4d32b3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/00c2182714c0a81a06e0e6778a79794f969622bb79c398db5e5045e07d4d32b3?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\\\/\\\/sepno.net\"],\"url\":\"https:\\\/\\\/sepno.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs - Sepno Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sepno.net\/?p=2478","og_locale":"en_US","og_type":"article","og_title":"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs - Sepno Network","og_description":"A practical guide to connecting Docker Swarm nodes across different networks with Tailscale\u2014without public IPs, router port forwarding, or exposed management ports.","og_url":"https:\/\/sepno.net\/?p=2478","og_site_name":"Sepno Network","article_published_time":"2026-08-05T11:12:06+00:00","article_modified_time":"2026-08-05T12:01:49+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/sepno.net\/wp-content\/uploads\/2026\/08\/tailscale-docker-swarm-secure-mesh-web.jpg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sepno.net\/?p=2478#article","isPartOf":{"@id":"https:\/\/sepno.net\/?p=2478"},"author":{"name":"admin","@id":"https:\/\/sepno.net\/#\/schema\/person\/5edc6550ac1b27272ff9164e461a8461"},"headline":"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs","datePublished":"2026-08-05T11:12:06+00:00","dateModified":"2026-08-05T12:01:49+00:00","mainEntityOfPage":{"@id":"https:\/\/sepno.net\/?p=2478"},"wordCount":741,"commentCount":0,"image":{"@id":"https:\/\/sepno.net\/?p=2478#primaryimage"},"thumbnailUrl":"https:\/\/sepno.net\/wp-content\/uploads\/2026\/08\/tailscale-docker-swarm-secure-mesh-web.jpg","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/sepno.net\/?p=2478#respond"]}]},{"@type":"WebPage","@id":"https:\/\/sepno.net\/?p=2478","url":"https:\/\/sepno.net\/?p=2478","name":"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs - Sepno Network","isPartOf":{"@id":"https:\/\/sepno.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sepno.net\/?p=2478#primaryimage"},"image":{"@id":"https:\/\/sepno.net\/?p=2478#primaryimage"},"thumbnailUrl":"https:\/\/sepno.net\/wp-content\/uploads\/2026\/08\/tailscale-docker-swarm-secure-mesh-web.jpg","datePublished":"2026-08-05T11:12:06+00:00","dateModified":"2026-08-05T12:01:49+00:00","author":{"@id":"https:\/\/sepno.net\/#\/schema\/person\/5edc6550ac1b27272ff9164e461a8461"},"breadcrumb":{"@id":"https:\/\/sepno.net\/?p=2478#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sepno.net\/?p=2478"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sepno.net\/?p=2478#primaryimage","url":"https:\/\/sepno.net\/wp-content\/uploads\/2026\/08\/tailscale-docker-swarm-secure-mesh-web.jpg","contentUrl":"https:\/\/sepno.net\/wp-content\/uploads\/2026\/08\/tailscale-docker-swarm-secure-mesh-web.jpg","width":1600,"height":900},{"@type":"BreadcrumbList","@id":"https:\/\/sepno.net\/?p=2478#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sepno.net\/"},{"@type":"ListItem","position":2,"name":"Tailscale VPN: Secure Docker Swarm Networking Without Public IPs"}]},{"@type":"WebSite","@id":"https:\/\/sepno.net\/#website","url":"https:\/\/sepno.net\/","name":"Sepno Network","description":"DevOps","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sepno.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sepno.net\/#\/schema\/person\/5edc6550ac1b27272ff9164e461a8461","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/00c2182714c0a81a06e0e6778a79794f969622bb79c398db5e5045e07d4d32b3?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/00c2182714c0a81a06e0e6778a79794f969622bb79c398db5e5045e07d4d32b3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/00c2182714c0a81a06e0e6778a79794f969622bb79c398db5e5045e07d4d32b3?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/sepno.net"],"url":"https:\/\/sepno.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/sepno.net\/index.php?rest_route=\/wp\/v2\/posts\/2478","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sepno.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sepno.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sepno.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sepno.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2478"}],"version-history":[{"count":4,"href":"https:\/\/sepno.net\/index.php?rest_route=\/wp\/v2\/posts\/2478\/revisions"}],"predecessor-version":[{"id":2487,"href":"https:\/\/sepno.net\/index.php?rest_route=\/wp\/v2\/posts\/2478\/revisions\/2487"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sepno.net\/index.php?rest_route=\/wp\/v2\/media\/2480"}],"wp:attachment":[{"href":"https:\/\/sepno.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2478"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sepno.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2478"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sepno.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2478"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}