Building a Zero-Trust Private Network Across Global Dedicated Servers using Tailscale

For this tutorial, imagine you have provisioned three iDatam bare-metal servers across our global data centers:

• Node 1: Tokyo, Japan (Asian Hub)

• Node 2: London, UK (European Hub)

• Node 3: New York, US (North American Hub)

Our goal is to lock down these servers so they can securely share database replication traffic and internal APIs, acting as if they are plugged into the same physical network switch.

Execute this step on all three servers.

Connect to your Ubuntu 24.04/22.04 servers via SSH. Tailscale provides a highly convenient installation script that automatically adds the correct repository and installs the package.

Run the following command on Tokyo, London, and New York:

curl -fsSL https://tailscale.com/install.sh | sh
                                

Tailscale installs incredibly fast. Once it finishes, it will register itself as a systemd service and start automatically in the background.

Execute this step on all three servers.

Now, you need to authenticate each server to your Tailscale account (which you can create for free using Google, Microsoft, or GitHub SSO at tailscale.com).

Run the "up" command to initialize the node:

sudo tailscale up
                                

The terminal will output an authentication link that looks like this: To authenticate, visit: https://login.tailscale.com/a/1a2b3c4d5e

Copy that URL, paste it into your web browser, and log in. Once authenticated, the terminal on your server will return to the prompt. Your server is now part of your private mesh network!

Repeat this sudo tailscale up process for the other two servers.

Tailscale automatically assigns a static, private 100.x.y.z IP address to every device on your Tailnet. Furthermore, it enables a feature called MagicDNS, which automatically registers the hostname of your server.

Log into your Tokyo server and check the status of the Tailnet:

tailscale status
                                

You will see a list of your connected nodes (London and New York), their Tailscale IP addresses, and their active connection status.

Because of MagicDNS, you don't even need to memorize those IPs. From your Tokyo server, try pinging the London server using just its OS hostname:

ping london-server
                                

The ping will succeed, routing securely over the encrypted WireGuard tunnel across the globe.

Right now, your servers can talk over Tailscale, but their public network interfaces are still exposed to the internet. True Zero-Trust means dropping all public traffic and only accepting connections over the encrypted Tailscale interface (tailscale0).

CRITICAL WARNING: Before proceeding, ensure you have installed Tailscale on your local laptop and connected to the Tailnet. We are about to block public SSH access. You will only be able to SSH into your servers using their Tailscale IP addresses.

Log into each server (using its Tailscale IP) and configure ufw (Uncomplicated Firewall):

# Allow all traffic on the secure Tailscale interface
sudo ufw allow in on tailscale0

# (Optional but recommended) Allow outbound traffic
sudo ufw default allow outgoing

# Deny all other incoming traffic by default
sudo ufw default deny incoming

# Enable the firewall
sudo ufw enable
                                

If you try to SSH into the server using its public IP address from an unauthorized device, the connection will drop. If you SSH into it using its 100.x.y.z Tailscale IP from your authenticated laptop, you will instantly connect.

Your servers are now dark to the public internet, but fully connected to each other.

You have successfully replaced a convoluted IPSec architecture with a modern, zero-config WireGuard mesh. Your applications can now replicate databases, share internal APIs, and perform CI/CD deployments securely across continents.

However, a global software mesh is only as good as the physical fiber underneath it.

When you deploy your infrastructure on iDatam’s Global Dedicated Servers, you aren't just getting raw compute power. You are getting access to unmetered, high-throughput network uplinks in the world's most critical financial and technological hubs. Pair Tailscale's software-defined security with iDatam’s enterprise hardware, and build a truly borderless infrastructure without the egress fees.