The single most consequential line in your config file is the host you bind to. Almost every "I got owned" solo-dev story starts with the wrong choice here. Three values cover 99% of the cases, and they are wildly different.
| Bind address | What it means | Who can reach you |
|---|---|---|
127.0.0.1 (loopback) | "Only this machine" | Only processes on the same OS |
192.168.1.42 (specific LAN IP) | "Reach me on this LAN address" | Devices on the same LAN that know the IP |
100.64.x.x (Tailscale CGNAT range) | "Reach me through Tailscale only" | Devices in your tailnet (after WireGuard handshake) |
0.0.0.0 (all interfaces) | "Listen on every NIC, including public" | Anyone who can route a packet to any IP this host has |
What 0.0.0.0 really does
It tells the OS: "accept connections on any interface this machine has." On a typical home Mac with one Wi-Fi NIC, the host might have:
127.0.0.1(loopback) — internal only.192.168.1.42(Wi-Fi LAN) — reachable from your router's clients.100.64.0.5(Tailscale) — reachable through your tailnet.- A potential public IPv6 if your ISP gives you one and your firewall isn't blocking.
Bind to 0.0.0.0 and the service answers on all four. The instant your router has UPnP enabled (it does, by default) and an inbound rule appears (it might), your "local" service is on the public internet.