Tailscale
An identity-aware networking client built on WireGuard that connects devices through peer-to-peer or relay paths while distributing keys, routes and access policies.
What Tailscale is for
Tailscale creates an identity-aware private network using WireGuard, allowing approved devices to connect directly when possible or through a relay when required. The control plane handles identity, keys, device state and policy; the encrypted data path and the host service permissions remain separate security boundaries.
Start with two test devices
Add a small number of known devices, verify their owner and operating system and test one service port. Joining the same network does not automatically define least privilege. Use grants or ACLs to describe which users, device tags and ports may communicate, then test both allowed and denied cases.
Treat routes and exit nodes as high-impact features
A subnet route can expose an entire private network, while an exit node changes where internet traffic leaves. Publish these features only when needed, restrict who may use them and preserve an out-of-band administration path before changing firewall, DNS or forwarding settings.
Maintenance note
This page covers Tailscale device enrollment, WireGuard connectivity, grants, subnet routes and exit-node boundaries. Content review date: 2026-08-23.
Save to your cloud drive
Open the cloud drive to get the file directly, or save it for convenient access on another device.
Quark Cloud Drive
RecommendedSave Tailscale to this cloud drive
Baidu Netdisk
Save Tailscale to this cloud drive
Tailscale installation, device enrollment and least-privilege access
Add two test devices, verify identity and connectivity, then restrict access to the exact users, devices and ports required by the use case.
Before you start
- Prepare a protected identity account with multi-factor authentication and two patched test devices.
- List the services, ports, owners, expiry dates and emergency revocation steps that the connection needs.
- Keep a console or existing SSH path for a server before changing firewall, routing or DNS settings.
Installation steps
- 01
Install the supported build
Install the package for Windows, macOS, Linux, mobile or NAS and verify the client version and platform requirements.
- 02
Enroll and inspect device identity
Complete the sign-in flow, then check the device name, user, operating system, key expiry and version in the administration view.
- 03
Keep the host firewall narrow
Tailscale networking does not replace service authentication or the host firewall. Expose only the required local services and ports.
Quick start
- 01
Test basic connectivity
Confirm the device status and path, resolve the target Tailscale address or name and test the intended service port from the second device.
- 02
Write a minimum grant
Authorize the known user or device tag to the exact target and port, keep unrelated traffic denied and test an allowed and denied connection.
- 03
Evaluate routes separately
Add a subnet route or exit node only when required, restrict its users and inspect forwarding, DNS, logs and bandwidth after activation.
Usage tips
- WireGuard encryption protects traffic in transit but does not patch endpoint software, weak passwords or over-permissioned services.
- Control-plane roles, device approval, identity-provider accounts and key expiry deserve the same review as firewall rules.
- Remove stale devices and tags regularly, and record why each high-privilege route or exit node exists.
Troubleshooting and uninstall
Why is a device online but the service unreachable?
Check the grant or ACL, device tags, local service listener, host firewall, target port and route. A connected overlay does not prove that the application accepts the connection.
Why is traffic using a relay instead of a direct path?
NAT, firewall, network policy or endpoint compatibility can prevent a direct connection. Verify connectivity and latency first; relay transport remains encrypted.
- Revoke the device and record routesRemove the device from the network, revoke or expire its keys and document any subnet route, exit-node or DNS change made for it.
- Remove the clientUninstall through the platform package manager and restore only the host firewall or routing entries that were created specifically for the client.
Frequently asked questions
Does joining a tailnet allow every device to access every other device?
Policy determines access. Use grants or ACLs to limit users, device tags, targets and ports instead of assuming network membership is least privilege.
Can Tailscale read the content of an encrypted connection?
WireGuard protects the data path, including relay transport. The control plane still handles identity, keys, device state and policy metadata.
Should a subnet route be enabled for convenience?
Enable it only for a documented need, restrict who can use it and keep a separate administration path in case routing or firewall changes interrupt access.