That nagging feeling when you know your server’s SSH port is sitting out there, exposed to the entire internet—even with key-based auth, it still feels wrong. You’re not alone. Most developers tolerate this risk because it’s convenient, but convenience is the enemy of security.
I spent a weekend wrestling with this exact anxiety. I had two problems: my SSH port was open to the world, and I had no visibility into what my VPS was actually doing. Every time something went wrong, I had to SSH in blindly. It was like managing a server with a blindfold on.
The solution? A combination of Tailscale and Beszel. And it changed everything.
Your server’s SSH port should be a secret door, not a front gate. Tailscale creates an overlay network that lets you access your VPS over a zero-trust WireGuard tunnel. No more open ports. No more scanning bots. Just a private, encrypted connection that only you can reach.
But here’s where it gets interesting. I dove into how Tailscale actually works—WireGuard under the hood, NAT hole punching, DERP relays, and how SSH still works over a UDP-based VPN. The learning curve was steep, but the payoff was immediate: my server went from ‘exposed’ to ‘invisible’ to the outside world.
Then I added Beszel for monitoring. Now I can see CPU, RAM, disk usage, and service status without ever opening a terminal. If a service crashes, I know instantly. No more guessing. No more blind troubleshooting.
This combo isn’t just about security—it’s about peace of mind. You stop worrying about the attack surface and start focusing on what matters: building.
The real twist? Most people think securing a server means complex firewall rules, VPN setups, and enterprise tools. But Tailscale and Beszel are dead simple. You can have both running in under an hour. And once you do, you’ll wonder why you tolerated the old way for so long.
I wrote a detailed guide on exactly how I set it up—step by step, with all the networking rabbit holes I fell into. If you’re tired of the nagging anxiety of an exposed server, or the frustration of blind troubleshooting, this is for you.
Check it out: https://syedfazil.dev/blogs/tech/tailscale-beszel-vps/
Security isn’t about being safe; it’s about making it not worth the attacker’s time. With Tailscale, your server isn’t even on the map. That’s the kind of security you can sleep with.
FAQ
Q: Isn't key-based SSH authentication already secure enough?
A: Key-based auth is better than passwords, but it still exposes your SSH port to the internet. Attackers can scan for open ports, attempt brute-force (even with keys, there's a theoretical risk), or exploit vulnerabilities in SSH itself. Tailscale eliminates that attack surface entirely by making your server invisible to the public internet.
Q: What's the practical benefit of using Beszel alongside Tailscale?
A: Once your server is hidden behind Tailscale, you need a way to monitor its health without SSHing in. Beszel gives you a dashboard showing CPU, RAM, disk, and service status—so you know if something crashes before your users do. It's the difference between reactive troubleshooting and proactive awareness.
Q: Isn't this overkill for a simple VPS?
A: That's exactly the mindset that keeps servers insecure. The setup takes less than an hour, requires minimal maintenance, and works for any VPS. The real overkill is leaving your server exposed and hoping nothing happens. For the cost of a single coffee, you get enterprise-grade security and observability.