Tailscale

Tailscale creates a private network, called a tailnet, across devices and services that may sit on completely different physical networks. Users authenticate through an identity provider, each enrolled device receives a cryptographic node identity, and Tailscale uses WireGuard to establish end-to-end encrypted connections—directly between peers when possible, with encrypted relaying when a direct path is unavailable. That makes common jobs such as reaching a development machine, opening a self-hosted service or connecting infrastructure across clouds possible without exposing ports to the public internet. MagicDNS gives devices readable names; subnet routers bring in equipment that cannot run the client; exit nodes can route internet traffic through a trusted device. The convenience does not remove the need for access design: teams should still define least-privilege policies for who and what may connect.