Border0 architecture and core concepts

Designed for high availability and low latency, Border0 + Tailscale is part of the Tailscale platform, combining secure application access with Tailscale's globally distributed networking infrastructure. This gives you fast, secure access to resources in your Tailscale network from anywhere, without adding operational overhead.

The following sections describe the architecture and core concepts for Border0 + Tailscale.

Services

Border0 services represent the resources in your Tailscale network, known as a tailnet, that you make available to users. These can be any service that you need to securely expose, such as:

• HTTP/HTTPS
• SSH
• Databases, such as:
  • Amazon RDS
  • Elasticsearch
  • Google Cloud SQL
  • Microsoft SQL Server
  • MongoDB
  • MySQL
  • PostgreSQL
  • Snowflake
• Kubernetes
• Remote Desktop Protocol (RDP)
• Virtual Network Computing (VNC)
• Any TCP port

Border0 treats services as the application-aware proxies that handle connections securely.

Policies

Policies are key to managing access to your services. By default, no one has access to your services unless you explicitly grant it. Unlike traditional firewalls, which restrict access based on IP address and port number, Border0 lets you control access with more granular conditions such as:

• Who: The identity of the user.
• What: The specific services. That is, the resources in your tailnet.
• When: The time of day or date.
• Where: IP addresses or countries.

There are two types of policies:

• Organization-wide policies: These apply automatically to all services in your organization.
• Service-specific policies: These can be manually linked to individual services.

This fine-grained control ensures that only authorized users can access your services under specific conditions.

Policies are managed in the tailnet policy file, which you can access in the Access controls page of the Tailscale admin console.

Sessions

A session represents the connection between a user and a service. This lets you track who accessed what resource, when, and from where. Each session log include details such as:

• User single sign-on identity.
• IP address.
• Geolocation.
• Device information.
• Connection time and duration.

Additionally, Border0 provides session recording, which means you can replay sessions for services like SSH, database, and HTTP/HTTPS, to review precisely what happened during a session. This is particularly useful for security audits or troubleshooting.

Connectors

A Border0 connector acts as a bridge between your infrastructure and the Tailscale platform, serving as an identity-aware application proxy. It handles critical functions like:

• Session termination: Securely terminates all client sessions.
• Policy enforcement: Evaluates policies in real-time to control access.
• Session recording: Captures session data for auditing and replay (SSH, database, HTTP/HTTPS).
• Service discovery: Automatically detects available resources.
• Secrets injection: Seamlessly injects credentials and authentication tokens.

A connector is deployed inside your infrastructure, ensuring that sensitive traffic remains private. Connections between clients and the connector are fully encrypted, meaning Border0 never sees your traffic. This gives you full control over your security while benefiting from the platform's ease of use.

Tunnels

Tunnels are secure, encrypted connections between a Border0 connector and a user's device, enabling seamless access to private resources. Tunnels provide the following functions:

• Encryption: Tunnels use WireGuard, a modern, high-performance VPN protocol, to create end-to-end encryption.
• Automated management: The Border0 + Tailscale platform automatically manages tunnel creation and orchestration, requiring no manual setup from the user.
• Seamless connectivity: Whether connecting to SSH, databases, Kubernetes, or internal web applications, tunnels provide secure, low-latency access without exposing services to the internet.

User and group management

Border0 does not maintain a separate directory of users and groups. Instead, it uses Tailscale identity as the source of truth. The users and groups in your tailnet are synchronized from Tailscale into Border0 automatically, about every 20 minutes. You manage membership in Tailscale, and Border0 reflects those changes on the next synchronization. There is no need to provision or deprovision users separately in Border0.

How Tailscale roles map to Border0 roles

During synchronization, each user's Tailscale role determines the Border0 role they receive. Border0 has three roles: Admin, Read Only, and Client Access Only. Tailscale roles map to Border0 roles as follows:

Tailscale role	Border0 role
Owner	Admin
Admin	Admin
Member	Client Access Only
Billing admin	Client Access Only
IT admin	Admin
Network admin	Read Only
Auditor	Read Only

Because a user's Border0 role is derived from their Tailscale role, changing that role in the Tailscale admin console updates their Border0 role on the next synchronization.

Border0 roles

The following provides information about the Border0 roles:

• Admin: This role grants full privileges for Border0 management, including user, group, and service account management as well as the ability to modify all configuration and settings.
• Client Access Only: This role has no privileges for Border0 management. Assign this role to users who will only be clients of services in your tailnet. Access to services is managed through the tailnet policy file. Adding a user with this role to your tailnet is not enough to grant the user access to a service as a client. A user or service account must be referenced in an grant attached to the desired service for them to have access to the service.
• Read Only: This role has read privileges for the Border0 configuration, but no write privileges.

Tailscale client

The Tailscale client offers a modern graphical user interface (GUI) for end-users, streamlining the process of connecting to services and discovering available services. In a single action, users can securely access any service for which they have permission, including servers, databases, web applications, desktops, and Kubernetes clusters.

Client portal

The Border0 client portal provides users with secure access to services without installing the native Tailscale client on their desktop. The client portal is built on WebAssembly (Wasm). This clientless browser access provides quick and seamless access to your services.

The key benefits of the client portal include:

• No installation required: Access your resources directly from the browser.
• User-friendly resource discovery: A visual and intuitive interface helps users determine what they have access to.
• Web-based access to critical services: Use SSH, databases (MySQL/Postgres), and even VNC directly in the browser.
• End-to-end encryption: With Wasm-powered VPN technology, the client portal runs entirely in the browser, ensuring that connections remain fully encrypted and secure.
• Access requests for Zero Standing Privileges (ZSP): From the client portal, users can request just-in-time access. Admins can grant time-limited permissions, thereby reducing security risks.

Users can connect to their infrastructure instantly, without requiring complex setup.