64 lines
2.1 KiB
Markdown
64 lines
2.1 KiB
Markdown
---
|
|
title: Tailscale
|
|
description: Tool overview for Tailscale as a private networking and remote access layer
|
|
tags:
|
|
- tailscale
|
|
- vpn
|
|
- networking
|
|
category: tools
|
|
created: 2026-03-14
|
|
updated: 2026-03-14
|
|
---
|
|
|
|
# Tailscale
|
|
|
|
## Summary
|
|
|
|
Tailscale is a WireGuard-based mesh VPN that provides identity-aware connectivity between devices. It is frequently used to reach homelab services, private admin interfaces, and remote systems without exposing them directly to the public internet.
|
|
|
|
## Why it matters
|
|
|
|
Tailscale simplifies remote access and private service connectivity without requiring a traditional central VPN gateway for all traffic. It is especially useful for small environments where easy onboarding and policy-driven access matter more than complex appliance-based VPN design.
|
|
|
|
## Core concepts
|
|
|
|
- Tailnet as the private network boundary
|
|
- Identity-based access controls
|
|
- Peer-to-peer encrypted connectivity with DERP fallback
|
|
- MagicDNS for tailnet name resolution
|
|
- Subnet routers and exit nodes for advanced routing roles
|
|
|
|
## Practical usage
|
|
|
|
Tailscale commonly fits into infrastructure as:
|
|
|
|
```text
|
|
Admin or device -> tailnet -> private service or subnet router
|
|
```
|
|
|
|
Typical uses:
|
|
|
|
- Remote SSH access to servers
|
|
- Private access to dashboards and management services
|
|
- Routing selected LAN subnets into a private network overlay
|
|
|
|
## Best practices
|
|
|
|
- Use tags and access controls early instead of keeping the tailnet flat
|
|
- Treat exit nodes and subnet routers as high-trust infrastructure roles
|
|
- Use MagicDNS or split DNS instead of memorized addresses
|
|
- Limit which services are intended for tailnet-only access
|
|
|
|
## Pitfalls
|
|
|
|
- Advertising broad routes without matching access policy
|
|
- Treating overlay connectivity as a substitute for local firewalling
|
|
- Leaving unused devices enrolled in the tailnet
|
|
- Using one large unrestricted trust domain for every user and service
|
|
|
|
## References
|
|
|
|
- [Tailscale: What is Tailscale?](https://tailscale.com/kb/1151/what-is-tailscale)
|
|
- [Tailscale: Access controls](https://tailscale.com/kb/1018/acls)
|
|
- [Tailscale: MagicDNS](https://tailscale.com/kb/1081/magicdns)
|