Tailscale

1. Device authenticates via identity provider
2. Coordination server distributes peer keys and ACL policies
3. Devices attempt direct WireGuard connection (NAT hole-punching)
4. If direct connection fails, traffic relays through DERP servers
5. DERP relay sees only encrypted WireGuard packets

sudo pacman -S tailscale
sudo systemctl enable --now tailscaled

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list

sudo apt update
sudo apt install tailscale
sudo systemctl enable --now tailscaled

sudo dnf config-manager --add-repo https://pkgs.tailscale.com/stable/fedora/tailscale.repo
sudo dnf install tailscale
sudo systemctl enable --now tailscaled

docker run -d \
  --name=tailscale \
  --hostname=<container-hostname> \
  --cap-add=NET_ADMIN \
  --cap-add=NET_RAW \
  -v /dev/net/tun:/dev/net/tun \
  -v tailscale-state:/var/lib/tailscale \
  -e TS_AUTHKEY=<auth-key> \
  tailscale/tailscale:latest

# Start Tailscale and authenticate
sudo tailscale up

# Use an auth key for headless/automated setups
sudo tailscale up --authkey=<auth-key>

# Disconnect
sudo tailscale down

# Check status
tailscale status

# Show detailed peer information
tailscale status --peers --active

# Ping a peer (via Tailscale, shows direct vs relayed)
tailscale ping <peer-name-or-ip>

# Show current Tailscale IP addresses
tailscale ip

# Show network diagnostics
tailscale netcheck

# Show debug information
tailscale debug metrics
tailscale debug prefs

# Send a file to another device
tailscale file cp <file> <peer-name>:

# Receive files (waits for incoming transfers)
tailscale file get <output-directory>

# Enable IP forwarding
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl --system

# Advertise the subnet
sudo tailscale up --advertise-routes=192.0.2.0/24,198.51.100.0/24

# On the admin's machine (if using ACL auto-approvers)
# Add to ACL file under "autoApprovers":
{
  "autoApprovers": {
    "routes": {
      "192.0.2.0/24": ["tag:server"]
    }
  }
}

sudo tailscale up --accept-routes

# On the exit node
sudo tailscale up --advertise-exit-node

# Route all traffic through a specific exit node
sudo tailscale up --exit-node=<exit-node-ip-or-name>

# Allow LAN access while using an exit node
sudo tailscale up --exit-node=<exit-node-ip-or-name> --exit-node-allow-lan-access

# Stop using the exit node
sudo tailscale up --exit-node=

{
  "dns": {
    "magic": true,
    "nameservers": ["1.1.1.1", "8.8.8.8"],
    "routes": {
      "corp.example.com": ["192.0.2.53"]
    },
    "domains": ["example.com"]
  }
}

# Devices are reachable by hostname
ping my-laptop

# Full domain format
ping my-laptop.<tailnet-name>.ts.net

# Check DNS configuration
tailscale dns status

{
  "dns": {
    "routes": {
      "internal.corp.com": ["192.0.2.53"],
      "staging.corp.com": ["198.51.100.53"]
    }
  }
}

# On the target machine
sudo tailscale up --ssh

{
  "ssh": [
    {
      "action": "accept",
      "src": ["autogroup:member"],
      "dst": ["autogroup:self"],
      "users": ["autogroup:nonroot", "root"]
    },
    {
      "action": "check",
      "src": ["autogroup:member"],
      "dst": ["tag:production"],
      "users": ["root"],
      "checkPeriod": "12h"
    }
  ]
}

# SSH using Tailscale identity (no keys needed)
ssh <user>@<tailscale-hostname>

# Tailscale handles authentication and authorization
# No SSH keys are exchanged; identity comes from the IdP

# Serve a local service publicly
tailscale funnel 8080

# Serve with a specific path
tailscale funnel --set-path=/api localhost:3000

# Serve a local directory
tailscale funnel /path/to/files

# Disable funnel
tailscale funnel --remove 8080

# Expose a local port within the tailnet
tailscale serve 8080

# Expose with HTTPS (auto-certs within tailnet)
tailscale serve https / localhost:8080

# Show current serve configuration
tailscale serve status

{
  "nodeAttrs": [
    {
      "target": ["autogroup:member"],
      "attr": ["funnel"]
    }
  ]
}

{
  "acls": [
    {
      "action": "accept",
      "src": ["group:engineering"],
      "dst": ["tag:webserver:80,443"]
    },
    {
      "action": "accept",
      "src": ["autogroup:member"],
      "dst": ["autogroup:self:*"]
    }
  ],

  "groups": {
    "group:engineering": ["user1@example.com", "user2@example.com"],
    "group:devops": ["user3@example.com"]
  },

  "tagOwners": {
    "tag:webserver": ["group:devops"],
    "tag:database": ["group:devops"]
  },

  "hosts": {
    "monitoring": "100.64.0.5"
  }
}

{
  "acls": [
    {"action": "accept", "src": ["*"], "dst": ["*:*"]}
  ]
}

{
  "acls": [
    {"action": "accept", "src": ["group:devops"], "dst": ["*:*"]},
    {"action": "accept", "src": ["group:engineering"], "dst": ["tag:webserver:80,443", "tag:webserver:22"]},
    {"action": "accept", "src": ["group:engineering"], "dst": ["tag:database:5432"]}
  ]
}

{
  "acls": [
    {"action": "accept", "src": ["group:admins"], "dst": ["*:*"]},
    {"action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:*"]},
    {"action": "accept", "src": ["tag:monitoring"], "dst": ["*:9090,9100"]}
  ]
}

{
  "tests": [
    {
      "src": "user1@example.com",
      "accept": ["tag:webserver:80"],
      "deny": ["tag:database:5432"]
    }
  ]
}

# Initialize tailnet lock (generates a signing key)
tailscale lock init

# Sign a new node
tailscale lock sign <node-key>

# View lock status
tailscale lock status

# List trusted signing keys
tailscale lock list

# Requires signatures from a majority of TLK holders
tailscale lock disable

# In the admin console: Settings > Keys > Generate auth key
# Options:
#   - Reusable: allow multiple devices to use the same key
#   - Ephemeral: device is removed when it goes offline
#   - Pre-approved: skip manual approval
#   - Tags: automatically apply tags on registration

# Generate an API key or OAuth client in the admin console
# Use with the Tailscale API
curl -s -H "Authorization: Bearer <api-key>" \
  https://api.tailscale.com/api/v2/tailnet/-/devices | jq .

# Install headscale (example for Debian)
wget https://github.com/juanfont/headscale/releases/latest/download/headscale_<version>_linux_amd64.deb
sudo dpkg -i headscale_<version>_linux_amd64.deb

# Configure /etc/headscale/config.yaml
# Start the server
sudo systemctl enable --now headscale

# Create a user
headscale users create myuser

# Generate a pre-auth key
headscale preauthkeys create --user myuser

# Connect a client to headscale
sudo tailscale up --login-server=https://headscale.example.com