Tailscale

Name: Tailscale
Author: Tailscale Inc.

In-depth entry

by Tailscale Inc. · Service · also known as tailscaled

WireGuard-based mesh overlay network with a hosted coordination service, identity-provider login, access policies, MagicDNS and features such as Tailscale SSH, Serve and Funnel

BSD-3-Clause licenseFreemiumPaidEnterpriseCloudLocal

Visit official site Compare

Link verified Nov 2, 2026

Overview

Tailscale is a connectivity service from Tailscale Inc. that builds a private mesh network, a tailnet, on top of WireGuard. Each device runs an open-source client (BSD-3-Clause) that authenticates through an existing identity provider such as Google, Microsoft, GitHub or any OIDC server; a proprietary coordination server operated by Tailscale then distributes public keys, assigns stable addresses and pushes access policies, while the encrypted traffic itself flows directly between peers, using DERP relay servers only when NAT traversal fails.

The result is a network that mostly configures itself. MagicDNS gives every machine a name, ACLs written in HuJSON restrict who can reach which ports, exit nodes route internet traffic through a chosen device, and subnet routers expose networks that cannot run the client. Tailscale SSH authenticates shell sessions with tailnet identity instead of keys, Serve publishes a local port to the tailnet with automatic HTTPS, and Funnel extends that to the public internet. Clients exist for Linux, macOS, Windows, iOS, Android, Synology and container images.

It is popular with homelabs, small teams and distributed fleets of machines, including Mac clusters, because joining a device is a single login. The Personal plan is free for non-commercial use; business plans add users, SSO and support features. The main caveats are reliance on Tailscale's hosted control plane (the open-source Headscale project reimplements it for self-hosting), the fact that device-to-device SSH over the tailnet may be restricted by ACLs, and limits on advanced routing compared with a hand-built WireGuard topology.

Editorial note on uncertainty. The client is BSD-3-Clause; the coordination server is proprietary, hence source_model mixed and self_hostable false (Headscale is a third-party reimplementation).

Capabilities

Zero-configuration WireGuard mesh with NAT traversal and DERP relays
Single sign-on through Google, Microsoft, GitHub, Okta and generic OIDC providers
Access control lists and device tags with a policy file
MagicDNS, exit nodes and subnet routers
Tailscale SSH with identity-based authentication
Serve and Funnel for publishing local services privately or publicly
Clients for Linux, macOS, Windows, iOS, Android, Synology and Docker

Typical workflows

Join laptops, servers and phones to one private network with a login
Reach a home or lab machine from anywhere without port forwarding
Publish a development server to the internet with Funnel
Route a cloud VPC into the tailnet through a subnet router

Strengths

Minutes to set up compared with manual WireGuard
Identity-based policies instead of shared keys
Direct peer-to-peer connections in most cases
Free personal plan and open-source client

Limitations

Coordination server is hosted and proprietary
Relay (DERP) paths are slower when direct connections fail
Policy semantics can block expected traffic until ACLs are tuned
Advanced routing options are fewer than raw WireGuard

Prerequisites

An identity-provider account to sign in
Client installed on each device

Who it is for

Homelab and self-hosting users
Small teams and distributed infrastructure operators
Developers needing secure access to remote machines

Alternatives & comparison

Plain WireGuard gives full control and no third-party dependency but requires manual key distribution and routing. Cloudflare Tunnel and ngrok publish individual services through a provider's edge rather than building a private network between devices; Tailscale Funnel overlaps with them for occasional public exposure. OpenSSH remains the lowest-common-denominator remote shell and works over a tailnet or without it.

Cloudflare Tunnel
Outbound-only connector (cloudflared) that publishes local web services and private networks through Cloudflare's edge without opening inbound ports
MixedFreemium
ngrok
Hosted ingress service that exposes local servers through public URLs via an agent or SDK, with Traffic Policy rules, API gateway features and reserved domains
ProprietaryFreemium
OpenSSH
Reference implementation of the SSH protocol from the OpenBSD project: remote shell, file transfer, port forwarding, key agent and certificate authority tooling
Open sourceOpen source
WireGuard
Minimal, high-speed VPN protocol and implementation built on modern cryptography, included in the Linux kernel and available on macOS, iOS, Windows, Android and BSD
Open sourceOpen source

Compare Tailscale with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

License
tailscale/tailscale LICENSE (BSD 3-Clause)
https://github.com/tailscale/tailscale/blob/main/LICENSE
Supports: license_spdx, source_model
checked Nov 1, 2026
Official documentation
Tailscale Docs
https://tailscale.com/docs
Supports: capabilities, workflows, limitations
checked Nov 1, 2026
Official site
Tailscale
https://tailscale.com/
Supports: name, summary, operating_systems
checked Nov 1, 2026
Pricing page
Tailscale Pricing
https://tailscale.com/pricing
Supports: pricing_model
Plans named Personal (free, non-commercial), Standard, Premium and Enterprise.
checked Nov 1, 2026

Confidence: High
Reviewed: Nov 1, 2026
Links: Verified · Nov 2, 2026