Insights
SSH from Windows over Tailscale
Use Windows OpenSSH Client to reach an existing Linux server over Tailscale. Check host keys, credentials and common connection errors.
On this page
From Windows, connect both devices to Tailscale, then open PowerShell and run ssh username@myserverOpens in a new tab if MagicDNS is enabled, or ssh username@100.100.123.123 using the server’s Tailscale IP address. Replace these examples with your destination account and address. Windows needs OpenSSH Client, not OpenSSH ServerOpens in a new tab, for this outgoing Secure Shell (SSH) connection to an existing Linux server.
In short:
- Client only: Use Windows OpenSSH Client to start the connection.
- Name or IP: Use the server’s machine name with MagicDNS, or its confirmed Tailscale IP.
- Existing credentials: Ordinary SSH still checks the server’s host key and your approved key or password.
Connect from PowerShell to your remote server
Use only devices you’re authorized to access, and keep a trusted console or administrator recovery path. Both devices must be connected to Tailscale. The Linux destination must already have an SSH service listening on a port permitted by network policy. Have the destination account and its approved credentials ready.
Choose one of these Windows PowerShell commands for the same destination. They’re alternatives, not two required connections.
1. Use the machine name when MagicDNS is enabled.
MagicDNS is Tailscale’s device-name service, based on the Domain Name System (DNS).
ssh username@myserver
2. Or use the server’s confirmed Tailscale IP address.
ssh username@100.100.123.123
Starting a connection doesn’t prove that authentication succeeded. Check the host key before accepting the server, as described below.
Make sure Windows has the client you need
1. Check Optional Features in Windows Settings.
Search for OpenSSH Client and install it if it’s missing. The client starts outgoing connections. Don’t install OpenSSH Server, start an SSH server service, or create an inbound SSH firewall rule on this Windows client.
2. Connect Windows to Tailscale if needed.
Follow the Tailscale Windows installation instructionsOpens in a new tab. Under your account, select Log in and complete the browser sign-in.
3. Reopen PowerShell and retry with your confirmed destination.
For a server named myserver with MagicDNS enabled:
ssh username@myserver
If PowerShell still says it can’t find ssh, recheck that OpenSSH Client is installed. That error doesn’t establish anything about the remote server.
Use the server’s address and account
1. Find the intended destination in Tailscale’s device list.
In Windows PowerShell, inspect Tailscale’s status outputOpens in a new tab:
tailscale status
The output shows each device’s Tailscale IP, machine name and owner email. Match the intended server, not just a familiar email address. The owner email isn’t the Linux login name.
2. Confirm the server account and connection details.
Ask the destination administrator for the existing Linux username, approved SSH credentials and listener port. If the listener uses a custom portOpens in a new tab, get the matching connection command from the administrator.
3. Choose the confirmed name or IP.
Use the machine name when MagicDNS is enabled. If name resolution is unavailable, use the server’s confirmed Tailscale IP.
Running tailscale ip -4 without a hostname reports the device where you run it. Running it on Windows won’t automatically give you the remote server’s address. Tailscale provides network access, but it doesn’t manage ordinary SSH authentication keys.
Check the host key before you sign in
The host key identifies the server. Your user key or password authenticates your account.
1. Compare the first-connection fingerprint through a trusted path.
A fingerprint is a short representation of the host key. Get the expected fingerprint from the administrator or a trusted server console, then compare it with the prompt. A prompt alone doesn’t prove the key is correct. Accept it only after it matches, which saves the server in Windows’ known-hosts list.
2. Stop if a saved host key has changed.
Confirm the replacement through that trusted path before proceeding. Don’t disable host-key checks or automatically delete the saved entry.
3. Use the credentials already approved for this server.
For ordinary SSH over Tailscale, signing in to Tailscale doesn’t replace the Linux account’s SSH authentication. Use the approved key or password for the confirmed destination account.
Check where you landed before changing anything
1. Check the remote hostname and account in the Linux shell.
hostname
whoami
You should see the expected host name and Linux account. These are general Linux checks, not Tailscale identity checks or substitutes for host-key verification. If either result differs, stop and confirm the destination with its administrator.
2. Leave the remote shell.
exit
You should return to your Windows PowerShell prompt. That shows the remote shell has ended.
3. Repeat your original SSH command from Windows PowerShell.
For the same MagicDNS example:
ssh username@myserver
A new remote shell confirms that you can reconnect at that moment. It doesn’t prove access will remain available after policy or service changes.
Find which part of the connection failed
Only troubleshoot devices you own or administer, and keep your recovery path available before changing settings.
Use these general checks to narrow the problem without treating an error as a unique diagnosis.
| What happened | What it shows | Next check |
|---|---|---|
PowerShell can’t find ssh | Client command unavailable | OpenSSH Client installation, then a new PowerShell window |
| Hostname lookup fails | Name wasn’t resolved | Confirmed machine name, then confirmed Tailscale IP |
| Connection times out | Connection didn’t complete | Tailscale reach, server availability, listener and policy |
| Ordinary SSH authentication denied | Account sign-in wasn’t accepted | Destination username, approved credentials and authentication logs |
1. For a timeout, check Tailscale reach from Windows PowerShell.
Replace myserver with the confirmed destination name or Tailscale IP.
tailscale status
tailscale ping myserver
A successful Tailscale ping shows Tailscale connectivity, not that the SSH port is permitted or the account can authenticate. If ping fails, check both devices’ Tailscale connection status. Ask the administrator to check destination availability, the SSH listener, permitted port and network policy. Don’t diagnose a timeout as a specific firewall failure or broaden policy just to make it work.
For denied ordinary authentication, confirm the account and credentials first. Ask the administrator to inspect account permissions and authentication logs if those details are correct.
If your administrator enabled Tailscale SSH
If the destination administrator explicitly enabled Tailscale SSHOpens in a new tab, Windows can still connect using its ordinary SSH client. Embedded Tailscale SSH uses Tailscale identity and SSH policy for authentication and access. It routes port 22 traffic on the destination’s Tailscale address to Tailscale’s SSH server instead of the standard SSH server. Both network access and SSH access must be permitted.
Embedded hosting is available on Linux and the documented open-source macOS command-line setup, not Windows. Check mode applies only to Tailscale SSH, not ordinary SSH over Tailscale. Follow the administrator’s access-check instructions if it applies. Leave embedded setup and policy changes to the destination administrator instead of switching modes to fix an ordinary credential failure.