# Connect to devices Last validated Jan 5, 2026 Tailscale automatically assigns each device on your network a unique [Tailscale IP address][kb-tailscale-ip-addresses] and [MagicDNS][kb-magicdns] name so that you can establish stable connections between devices anywhere in the world, even if they're behind a firewall or change networks. This guide covers connecting to devices in your tailnet after you've installed Tailscale on two or more devices. > **Note:** > > Before you explore the connection process, it's crucial to understand that Tailscale provides network connectivity between devices, but you must run a specific [service][kb-services] (like SSH or a web server) on the destination device. Tailscale does not provide these services automatically. ## Prerequisites * Tailscale installed on at least two devices. * [Access control policies][kb-acls] that allow the devices to connect. If you're using the [default access control policies][kb-default-acl], all connections will be allowed between any device in your tailnet. * At least one [service][kb-services] running on one of the devices. ## Connect to devices in your tailnet To connect to another device in your tailnet: 1. [Identify the device to connect to][ar-identify-devices]. 2. [Make sure the device is running a service you can access][ar-ensure-services-are-running]. 3. [Connect to the service][ar-connect-to-service]. ### Identify your devices Open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console. You'll find a list of all devices in your tailnet, along with their hostnames ([device names][kb-machine-name]) and [Tailscale IP addresses][kb-tailscale-ip-addresses]. ### Ensure services are running Remember, you can only connect to services running on your devices. Common services include: * SSH (usually on port `22`) You can also use [Tailscale SSH][kb-tailscale-ssh]. * Web servers (often on port `80` or `443`) * File sharing services (such as SFTP) * Remote access tools (such as RDP) Ensure the [service][kb-services] you want to access runs on the target device. You can do so by checking the [Services](https://login.tailscale.com/admin/services) page of the admin console, or by confirming the service is running on the destination device. ### Connect to a service > **Note:** > > Tailscale offers a feature called [MagicDNS][kb-magicdns], which allows you to use [device names][kb-machine-name] instead of Tailscale IP addresses. It's enabled by default, so you can use it right away. To connect to a service on a device in your tailnet: * Use the [device name][kb-machine-name] or [Tailscale IP address][kb-tailscale-ip-addresses] of the target device. * Specify the port of the service you're trying to access. For example, if you want to SSH into a device with the [MagicDNS][kb-magicdns] [name][kb-machine-name] `dev-build-server`, you can use the following command in a terminal emulator: ```shell ssh username@dev-build-server ``` Visit the following topics to find more information more about connecting to different types of services: * [Connect to a database][kb-database]. * [Connect to a Windows server using RDP][kb-secure-rdp-windows]. * [Connect to a cloud server][kb-cloud-server]. * [Connect to a remote development environment][kb-remote-code]. * [Connect to a network attached storage (NAS)][kb-nas]. ## Troubleshooting If you can't connect to a service: * Check if you can reach the device using [`tailscale ping`][kb-tailscale-ping]. * Verify that you're using the correct connection information. * Ensure the service is running on the target device at the expected port number. * Check if any [firewalls][kb-firewalls] (including the built-in firewall on the target device) are blocking the connection. * Ensure that your [tailnet policy file][kb-edit-policies] doesn't contain any [grants][kb-grants] or [ACLs][kb-acls] that prevent a connection between the two devices. * Visit [troubleshooting device connectivity][kb-device-connectivity]. ## Advanced topics The following sections cover other ways you can manage connections to devices in your tailnet. ### Access control When you create a tailnet, Tailscale automatically applies a [default access control policy][kb-default-acl] that lets you connect to all devices you own. You can customize [access control policies][kb-access-control] (such as [ACLs][kb-acls] or [grants][kb-grants]) in the [tailnet policy file][kb-edit-policies] to create policies that control how devices in your tailnet connect to each other and other devices on the internet. ### Tailscale SSH Tailscale offers a built-in SSH feature that extends and simplifies SSH connections between your devices. When enabled, [Tailscale SSH][kb-tailscale-ssh] manages the authentication and authorization of SSH connections in your tailnet, letting you add additional security checks and providing a web console interface. ### Sharing devices You can [share devices][kb-sharing] or [specific services][kb-tailscale-serve] with other Tailscale users, allowing collaboration while maintaining security. ### Routing You can configure a device to route outbound traffic by running it as an [exit node][kb-exit-nodes] or inbound traffic by running it as a [subnet router][kb-subnets]. Using a device as a subnet router lets you access devices without installing the Tailscale client. [ar-connect-to-service]: #connect-to-a-service [ar-ensure-services-are-running]: #ensure-services-are-running [ar-identify-devices]: #identify-your-devices [kb-access-control]: /docs/features/access-control [kb-edit-policies]: /docs/features/tailnet-policy-file/manage-tailnet-policies [kb-acls]: /docs/features/access-control/acls [kb-cloud-server]: /docs/cloud-server [kb-database]: /docs/database [kb-default-acl]: /docs/reference/examples/acls#allow-all-default-acl [kb-device-connectivity]: /docs/reference/device-connectivity [kb-exit-nodes]: /docs/features/exit-nodes [kb-firewalls]: /docs/integrations/firewalls [kb-grants]: /docs/features/access-control/grants [kb-machine-name]: /docs/concepts/machine-names [kb-magicdns]: /docs/features/magicdns [kb-nas]: /docs/integrations/nas [kb-remote-code]: /docs/remote-code [kb-secure-rdp-windows]: /docs/solutions/access-remote-desktops-using-windows-rdp [kb-services]: /docs/features/services [kb-sharing]: /docs/features/sharing [kb-subnets]: /docs/features/subnet-routers [kb-tailscale-ip-addresses]: /docs/concepts/tailscale-ip-addresses [kb-tailscale-ping]: /docs/reference/tailscale-cli#ping [kb-tailscale-serve]: /docs/features/tailscale-serve [kb-tailscale-ssh]: /docs/features/tailscale-ssh