Border0 connectors overview

A Border0 connector lets you establish a session between your network clients with your sockets like SSH, a database, and Kubernetes. To use a connector, you set up and run the Tailscale connector service on a device that will act as the connector. That service includes both the Tailscale connectivity components and the Border0 connector function. The Tailscale connectivity components use WireGuard for creating identity-aware encrypted communication channels. The Border0 connector provides application-aware privileged access to your services, also known as sockets. For information about setting up a connector, refer to Install a Border0 connector.

Where you run a connector depends on how you can and want to connect to the target sockets you wish to expose over Tailscale. The connector must be able to reach your target resources through the network, or through the use of external tools as is the case with AWS Session Manager targets.

How many connectors you run depends on how many disjoint networks you have with resources that you wish to expose over Tailscale. Assuming you have N networks, each with resources that can only be accessed by other machines in the same network, you will need N connectors - one in each network. If you have a large number of networks but all resources in these networks are accessible through the internet, you might need only one connector.

For high availability sockets, you can run more than one connector per network pointed at the same target sockets.

To minimize the damage of a single connector device being compromised, you can segment your targets across multiple connectors.

Connector token

A connector token is a credential used to authenticate a connector against the Tailscale control plane. Each token is always associated with only one connector.

While there can be multiple connector tokens active at the same time, a connector can only have one active connection at a time. Attempting to connect a connector that is already connected will result in the second connection being rejected with an error message mentioning that the connector is already connected.

Multiple active tokens for the same connector enable safer token rotations, with minimal downtime, for a given connector.

Socket

A socket refers to the available resources on your tailnet that have been associated with a given connector. For example, SSH, a database, Kubernetes, and others.

Connector logs

Connector logs are logs for connector events occurring locally. The following are examples of events that will emit a log entry:

• Errors and failures to operate.
• Service updates received, such as configuration changes and new or removed services.