Access a TCP service using Tailscale PAM

Last validated: Sep 3, 2026View as Markdown

Tailscale PAM is currently in beta.

Tailscale PAM gives users identity-based access to internal TCP services without requiring direct network access to those services.

You can make internal applications and services that communicate over TCP available without exposing them directly to the internet or giving users broader network access. Tailscale PAM determines whether users are allowed to access the service using the PAM grants in your tailnet access policy.

The PAM connector handles the connection to the upstream TCP service on the user's behalf. The upstream service can remain on your private network as long as the connector can reach it.

How TCP access works

When you create a TCP PAM service, Tailscale PAM provides an endpoint that users can connect to with a TCP client.

When a user connects:

Tailscale PAM authenticates the user with their Tailscale identity.
Tailscale PAM checks whether their tailnet access policy lets them use the TCP service.
If access is allowed, the PAM connector establishes a connection to the upstream TCP service.
Tailscale PAM proxies traffic between the user and the upstream service.

Only the connector needs network connectivity to the upstream TCP service. The upstream service itself does not need to be directly reachable by the user or from the internet.

Prerequisites

Before you begin, confirm you have the following:

A Tailscale PAM connector that is installed and online.
A connector that can reach the upstream TCP service.
The hostname or IP address and port of the upstream service.
Permission to update your tailnet policy file.
Tailscale installed and signed in on the device you'll use to connect, if you plan to use a native TCP client.

Create a TCP PAM service

To create the service:

Open the Services page of the Tailscale admin console.
Select Add service.
Select PAM service.
Select TCP.
Select Continue.
Enter a name for the service.

Use a name that makes the TCP service suitable for users to recognize when they browse the services they can access.
(Optional) Enter a display name for the service.
(Optional) Enter a description for the service.
Select one or more Tailscale PAM connectors that can reach the TCP service.
Select Continue.
For Upstream Hostname or IP, enter the hostname or IP address of the TCP service.

For example:
```
10.10.10.10
```
You can also use an internal DNS name:
```
service.internal.example.com
```
For Port, enter the port on which the upstream TCP service is listening.

For example:
```
9000
```
Select Save.

Your TCP PAM service is ready to use. You can access it in the Services page.

Grant access to the TCP service

Before users try to connect, make sure a Tailscale PAM grant gives them access to the TCP service. Tailscale PAM uses your tailnet access policy to determine which users, groups, devices, or tags can connect to the service.

For example, the following grant permits any source to connect to PAM TCP services:

{
  "grants": [
    {
      "src": ["*"],
      "dst": ["*"],
      "ip": ["*"],
      "app": {
        "tailscale.com/cap/pam": [
          {
            "version": "v1",
            "permissions": {
              "tcp": {}
            }
          }
        ]
      }
    }
  ]
}

This is a broad grant that's useful for getting started. In a production environment, you can restrict the src and dst fields to control which users, groups, devices, or tags can access specific services.

For more information about controlling access to PAM services, refer to Control access to Tailscale PAM services.

For information about editing grants, refer to Edit access control policies in your tailnet policy file.

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

Connect to the TCP service

After you've configured the service and granted access, users can connect to the TCP service using a compatible client.

Use the hostname and port for the Tailscale PAM service instead of the private hostname or IP address of the upstream service.

For example, you can test a TCP connection using nc:

nc -v <service-hostname> <port>

Users don't need direct network connectivity to the upstream TCP service. Tailscale PAM authenticates the user and checks their access against the tailnet policy. If a matching PAM grant permits TCP access to the service, Tailscale PAM proxies the connection through the connector to the upstream service.

Users can also connect to the TCP service by opening the Tailscale PAM browser client and selecting the service.

Review TCP sessions

Tailscale PAM gives you a central place to review who accessed your internal TCP services and when they accessed them.

To review a TCP session, open the Sessions page of the admin console and select the session you want to inspect. From there, you can review information about the user, the service they accessed, and the session.

Troubleshooting

If you can't connect to a TCP PAM service, first confirm that the PAM connector is online.

Then verify that:

The connector can reach the configured upstream hostname or IP address.
The configured port is correct.
The upstream service is listening on the configured port.
The PAM grant gives your Tailscale identity TCP access to the service.
The connector can resolve the hostname if you configured the upstream service using a DNS name.
Firewalls between the connector and upstream service permit the TCP connection.
If you're connecting from the browser client and your tailnet uses device approval, the browser device has been approved.

You can also test connectivity to the upstream service from the connector's network. For example, depending on your connector's environment, use commands like:

nc -zv <upstream-hostname> <port>
telnet <upstream-hostname> <port>

If the connection fails, resolve connectivity between the connector and upstream service before troubleshooting the user's Tailscale PAM connection.

If none of the troubleshooting steps mentioned above resolve your issue, review the connector logs and the details for the failed session in the PAM session logs. The session details can help determine whether the connection was blocked by access controls, network connectivity, or authentication to the upstream Windows server.