Blog

A combination of our newsletter and other posts, where we talk about Tailscale, WireGuard®, 2-factor auth, and other networking-related topics.

Subscribe via email, RSS or follow our Twitter.

Provision TLS certificates for your internal Tailscale services

Connections between Tailscale nodes are already secured with end-to-end encryption—that’s a huge benefit of being built on WireGuard. However, browsers are not aware of that because they rely on verifying the TLS certificate of a domain.

To protect a website with an HTTPS URL, you need a TLS certificate from a public Certificate Authority. Tailscale now makes that easily available for the machines in your Tailscale network, also known as a tailnet, with certificates provisioned from Let’s Encrypt.

Even more for free: Tailscale for open source projects

Tailscale loves open source. We know that it can be tough to develop a project in the open, and collaborate with individuals and organizations around the world.

We’re excited to announce that Tailscale is free for GitHub organizations using Tailscale for open source projects. And given Tailscale is good at, well, making connections, friends and family who coordinate using GitHub organization accounts can also benefit from this free plan.

We get stuck opening the socket

Photo of David Crawshaw
David Crawshaw on
I have a soft spot for the Unix sockets API. Yes, it is clunky to get started and has grown some odd options over the decades. It is usually buried now under higher level programming layers. But at the heart of it is a small and versatile interface that is easy to build on and easy to recreate: read(socket, bytes) write(socket, bytes) What bytes, how many bytes, and in what order are up to you. Under the hood TCP gives you reliable transmission. It is a quick and fun way to write a network program. Streams of bytes can contain discrete request-response messages, be used as a message bus, A/V streams, they can be multiplexed and demultiplexed… there are many ways to use them. As a bonus, most programming languages can represent streams of bytes efficiently, so sockets make for good protocol boundaries. It also has the great benefit of being a stable technology.

Private DNS with MagicDNS

Brad Fitzpatrick and David Crawshaw on
Photo of Brad Fitzpatrick
Photo of David Crawshaw
MagicDNS runs a DNS server on each Tailscale device to quickly and securely serve DNS.

Connect a GitHub Action to your Tailscale network - now in GitHub marketplace!

A few months back we released a GitHub Action to make it easier for you to access Tailscale. This allows a GitHub Action you’re running to first connect to Tailscale using an ephemeral authentication key, then perform other steps. Ephemeral auth keys clean up their state after the runner finishes, meaning you’re not persisting a connection to your network.

We’re excited that our GitHub Action is now available in the marketplace! This means that with the Connect Tailscale action, you can easily pull this into whatever actions you write.

RBAC like it was meant to be

Photo of Avery Pennarun
Avery Pennarun on

Most of us have heard of role-based access control (RBAC) and its slightly updated successor, attribute-based access control (ABAC). But we don’t always appreciate all the great ideas they contain.

August Tailscale newsletter

Laura Franzese on
Photo of Laura Franzese
This month’s newsletter has guides on running Tailscale on a Mango Router, running a Minecraft server on Tailscale, how to manage a Windows Firewall from Go, and Tailscale v1.14.

Programming the Windows firewall

David Anderson on
Photo of David Anderson
An introduction to the Windows Filtering Platform, and how to make your software program the Windows firewall.

July Tailscale newsletter

Laura Franzese on
Photo of Laura Franzese
Lots of community contributions to highlight this month! Thank you to everyone writing and sharing their enthusiasm for Tailscale. This month includes a community AWS Lambda Layer for Tailscale, Tailscale v1.12, and Taildrop for Android.

How to set up a private Minecraft server

Laura Franzese on
Photo of Laura Franzese
This post will guide you through the process on how to set up a secure, fast, and private Minecraft server with Tailscale.

June Tailscale newsletter

Laura Franzese on
Photo of Laura Franzese
It has been another productive month for the team here at Tailscale, and we are brimming with community contributions including a getting started video tutorial from David Burgess and a new guide by Justin Rhee on setting up a Tailscale VPN on Kubernetes. Let us jump in!

New Pricing

David Carney, Ross Zurowski and Sonia Appasamy on
Photo of David Carney
Photo of Ross Zurowski
Photo of Sonia Appasamy

Today, we’re announcing a new pricing model for Tailscale that makes it less expensive for everyone, and easier to scale from a small test deployment to something your whole friend group, startup, or organization can use.

Check out the new pricing, or read on for details about what’s changed and why.

Tailscale v1.10 & GitHub Auth

Laura Franzese on
Photo of Laura Franzese
Tailscale 1.10 is now available on all platforms (pending iOS approval to the App Store — we expect it to go through this weekend). Learn how to update or read on for details. While this was generally a bug fix and cleanup release, a few noteworthy changes happened in and around this release worth highlighting.

Taildrop was kind of easy, actually

Avery Pennarun on
Photo of Avery Pennarun
Taildrop was the first test of an experimental p2p app discovery layer in Tailscale. Let’s talk about why it was so easy to build, and where we go from here.

NAS access from anywhere with Tailscale

Laura Franzese on
Photo of Laura Franzese
Use Tailscale to set up your NAS for access from any device

NAS 101: An intro chat about Network Attached Storage

Naman Sood and Christine Dodrill on
Photo of Naman Sood
Photo of Christine Dodrill

A lot of people use Tailscale with Network Attached Storage (NAS) devices. In an effort to make this technology more accessible we’re publishing this transcript of a conversation about the basics of Network Attached Storage between our past co-op student Naman Sood, and our Archmage of Infrastructure, Christine Dodrill. Enjoy!

May Tailscale newsletter

Laura Franzese on
Photo of Laura Franzese
This has been a busy month, with the launch of Tailscale v1.8 and a new feature, Taildrop, that lets you easily send files between your devices.

Sending Files with Taildrop

Sonia Appasamy on
Photo of Sonia Appasamy
Taildrop is a feature that makes it easy to send files between your personal devices on a Tailscale network. Unlike cloud-based file transfer services, Taildrop’s peer-to-peer design makes it well-suited for lots of kinds of files you might want to send.

The long wondrous life of a Tailscale packet

Photo of Josh Bleecher Snyder
Josh Bleecher Snyder on
We track a single packet from creation in one process to arrival in another, far away.

Using GitHub Actions and Tailscale to build and deploy applications securely

Naman Sood on
Photo of Naman Sood
Automating deployment of a web server using GitHub Actions should be DevOps 101, so as a university student, it is the perfect time for me to be learning this. But what if, for security reasons, the server is accessible only over Tailscale?

Tailscale v1.8 is here!

Laura Franzese on
Photo of Laura Franzese
The latest version of Tailscale is available today! Learn how to update or read the full release notes on Github. This release contains a lot of general improvements, along with support for some upcoming feature previews.

April Tailscale newsletter

Laura Franzese on
Photo of Laura Franzese
April has us hard at work on our 1.8 stable release. We’ve got lots of great community contributions to highlight this month.

The Sisyphean Task Of DNS Client Config on Linux

Christine Dodrill and David Anderson on
Photo of Christine Dodrill
Photo of David Anderson
A brief history of DNS on Linux systems and what steps we are taking to ensure it is configured consistently in Tailscale 1.8.

March Tailscale newsletter

Ross Zurowski on
Photo of Ross Zurowski
March brings Tailscale v1.6, including IPv6 support, exit nodes, netstack integration, and more. We also have writing about using Tailscale to create a Dropbox-like system, and details about the new library Tailscale uses for IP addresses behind the scenes.

netaddr.IP: a new IP address type for Go

Brad Fitzpatrick on
Photo of Brad Fitzpatrick
The Go standard library’s net.IP type is problematic for a number of reasons. We wrote a new one.

Key management characteristics of the Tailscale Control Protocol

Photo of David Crawshaw
David Crawshaw on

Tailscale is split into a control plane and a data plane. The data plane is built out of direct WireGuard links that provides end-to-end encryption between any two machines on the network. The control plane is responsible for verifying the identity of users, validating machine keys, and delivering the public keys of peers to each machine in the network. This document focuses on the management of keys in the control plane. For a broader overview of Tailscale, see “How Tailscale Works.”

Modules, monoliths, and microservices

Avery Pennarun on
Photo of Avery Pennarun

Lately, I get people asking me when microservices are a good idea. In systems design explains the world, I talked about big-picture issues like second system effect, innovator’s dilemmas, and more. Can systems design answer the microservices question?

Yes, but you might not like the answers. First, we'll need some history.

How often should I rotate my ssh keys?

Photo of Avery Pennarun
Avery Pennarun on

If you’re like most people, your answer to this is… “What? Why?”

When ssh was introduced back in the 1990s, its appeal was simple. Passwords are too short, too guessable, too phishable, too often stored incorrectly, too MITM-able, too brute-forceable. Also its primary competition was rsh’s classic “no authentication,” but we don’t talk about that.

February Tailscale newsletter

Ross Zurowski on
Photo of Ross Zurowski
This past month we announced our sharing beta, released v1.4, and have a slew of new writing and podcasts about Tailscale to share with you all.

Philosophy of Tailscale: Social proximity networks

Photo of Christine Dodrill
Christine Dodrill on
Tailscale enables you to create networks between people you are close to. This article spells out our philosophy of social proximity networks as opposed to physical proximity networks you use today.

Sharing over Tailscale

Photo of Ross Zurowski
Ross Zurowski on
Today, we’re launching sharing as a public beta feature. Sharing lets you invite users outside your network to access your private devices securely. It makes it easy to host game servers with friends, host open-source software for family, collaborate with contractors, and much more.

Tailscale on NixOS: A new Minecraft server in ten minutes

Photo of Christine Dodrill
Christine Dodrill on
How to provision a new NixOS machine on Digital Ocean with nixos-infect and automatically connect it to your Tailscale network, then use that server to set up a fully private Minecraft world.

Hello 2021!

Laura Franzese on
Photo of Laura Franzese
As we start the new year, we want to take a moment to thank the community around Tailscale for making 2020 a stand out year, reflect on where we’ve been, and where we’re headed next…

An unlikely database migration

Brad Fitzpatrick and David Crawshaw on
Photo of Brad Fitzpatrick
Photo of David Crawshaw
When I first joined Tailscale, I was horrified to learn that “the database” was a single JSON file that was rewritten on any change. We migrated to something better.

Tailscale v1.2 is here

Brad Fitzpatrick and David Anderson on
Photo of Brad Fitzpatrick
Photo of David Anderson

The team has been hard at work making Tailscale more Tailscale-y. Today we’re announcing v1.2 is stable and ready for teams and hobbyists alike. Most notably, this release includes MagicDNS for everyone and major improvements for our Windows client.

How to update:

*For macOS and iOS, you may need to quit Tailscale first; the App Store doesn’t seem to update running VPN apps.

The next milestone for Tailscale

Photo of Avery Pennarun
Avery Pennarun on
Big news today! We’ve raised US$12 million in Series A funding led by Accel, with participation from Heavybit and Uncork Capital. The new funding follows the seed round we announced just a few months ago in April, and will allow us to build out our team and product at a faster pace, given the level of demand accompanying the world’s shift to remote work.

October Tailscale newsletter

Ross Zurowski on
Photo of Ross Zurowski
October brings two exciting new features courtesy of our summer co-op students, and some writing about Tailscale on Wi-Fi routers & NixOS from the community.

The Log Blog

Photo of Wendi Yu
Wendi Yu on

Did you know that our CEO, apenwarr, is something of a B-list Internet celebrity? Part of his claim to fame is a pithy-but-informational blog, which contains a pithy-but-informational post detailing exactly how to handle and parse a distributed logging system correctly. Tailscale’s logging infrastructure follows this system in broad strokes.

August Tailscale newsletter

Ross Zurowski on
Photo of Ross Zurowski
August brings Tailscale v1.0, now available for all platforms. It also brings new relay servers in Bangalore and Tokyo, and a new “guides” section to our knowledgebase, inspired by members of our community.

How NAT traversal works

Photo of David Anderson
David Anderson on

We covered a lot of ground in our post about How Tailscale Works. However, we glossed over how we can get through NATs (Network Address Translators) and connect your devices directly to each other, no matter what’s standing between them. Let’s talk about that now!

Subscribe for monthly updates

Product updates, blog posts, company news, and more.

Too much email? RSS Twitter