networks//VPN//Tailscale

Tailscale is a mesh VPN product that joins a person's or a company's devices into one private network, its **tailnet**, using WireGuard tunnels between every pair of devices. It is used to reach machines at home or in an office from anywhere without opening ports on a router, and to give each device a stable private address wherever it is.

Tailscale is a mesh VPN product that joins a person's or a company's devices into one private network, its tailnet, using WireGuard tunnels between every pair of devices. It is used to reach machines at home or in an office from anywhere without opening ports on a router, and to give each device a stable private address wherever it is.

The work is split in two (control plane). A coordination server run by the company signs devices in through an existing identity (a Google or Microsoft account, for instance), collects each device's public key and current addresses, and hands every device the keys and addresses of the others. The traffic itself never passes through that server: each pair of devices tries to build a direct WireGuard path with NAT traversal, and falls back to a DERP relay, which forwards packets it cannot decrypt over HTTPS, when no direct path exists.

Every device gets an address in 100.64.0.0/10, a range reserved for operator NAT that never appears on the public internet, and a name under MagicDNS (the machine name plus a per-tailnet domain), so a device can be reached as laptop instead of by number. Renaming a device in the admin console changes that name.

Device keys expire after 180 days by default and the device must sign in again; the expiry can be disabled per machine, which suits an unattended server and does not suit a phone that could be lost.

On Windows the client runs as a service and can stay connected with nobody logged in (unattended mode), which is what makes a home machine reachable after a reboot.

The clients are open source and the coordination server is not. Headscale is an independent open-source reimplementation of the coordination server for people who want to run that part themselves.

What it protects is reachability and transport. Who may reach which service is a separate decision: the tailnet's access rules, and on each device its firewall and the service's own authentication.