# Tailscale CLI

Last validated Jan 26, 2026

The Tailscale client includes a built-in command-line interface (CLI) you can use to manage and troubleshoot your device within your Tailscale network (known as a tailnet).

> **Note:** The Tailscale CLI is available for [all plans](/pricing).

## Using the Tailscale CLI

The location of the CLI varies depending on your platform:

#### Linux

On Linux, the CLI is your primary interface to Tailscale. The `tailscale` binary is likely already in your `$PATH`, so you can run commands with:

```shell
tailscale <command>
```

#### macOS

If you use the Standalone variant of the macOS client, you can install the CLI integration from the client settings. This feature requires macOS Ventura 13.0 or later.

1. From the Tailscale client, select **Settings**.
2. Locate CLI integration section, then select **Show me how**.
3. Select **Install Now** and provide the macOS administrator password.

This installs a `tailscale` CLI launcher to `/usr/local/bin/tailscale`, letting you type `tailscale` in the Terminal, without specifying the full path.

> **Note:**
>
> If you installed the macOS client through the App Store, the CLI is bundled inside the Tailscale app. Run commands with:
>
> ```shell
> /Applications/Tailscale.app/Contents/MacOS/Tailscale <command>
> ```
>
> If you frequently access the Tailscale CLI, you might find it convenient to add an alias to your `.bashrc`, `.zshrc`, or shell config to make it easier.
>
> ```shell
> alias tailscale="/Applications/Tailscale.app/Contents/MacOS/Tailscale"
> ```

> **Note:**
>
> Tailscale for macOS includes its CLI within the application executable. When you launch the Tailscale executable, it checks for specific environment variables (like `SHLVL`, `TERM`, `TERM_PROGRAM`, and `PS1`) to decide whether to launch as a macOS app with a windowed interface or as a CLI tool.
>
> If you're using the Tailscale CLI in a script (for instance, to parse the output of `tailscale status`), ensure you set the correct environment variables. If your script accidentally opens the macOS app version of Tailscale, you can force your script to run Tailscale as a CLI (instead of the macOS app) by setting the environment variable `TAILSCALE_BE_CLI=1`.

#### Windows

On Windows, you can access the CLI by executing the `.exe` from the Command Prompt.

```powershell
tailscale <command>
```

There is no CLI support for iOS and Android.

### Tab completion

The Tailscale CLI supports tab-completion for commands, flags, and arguments. You can configure tab-completion with the [`completion` command][ar-completion].

```shell
tailscale completion <shell> [--flags] [--descs]
```

Select your shell, then follow the instructions to load Tailscale CLI completions.

#### Bash

To load tab-completions for Bash, run the following command.

```shell
source <(tailscale completion bash)
```

Run the following command to load completions for every new session on Linux, then reload your shell.

```shell
tailscale completion bash > /etc/bash_completion.d/tailscale
```

Run the following command to load completions for every new session on macOS, then reload your shell.

```shell
tailscale completion bash > $(brew --prefix)/etc/bash_completion.d/tailscale
```

#### Zsh

> **Note:**
>
> You must have shell completion enabled for your Zsh environment.
>
> ```shell
> echo "autoload -U compinit; compinit" >> ~/.zshrc
> ```

Run the following command to load completions for Zsh, then reload your shell.

```shell
tailscale completion zsh > "${fpath[1]}/_tailscale"
```

#### Fish

Run the following command to load completions for Fish, then reload your shell.

```shell
tailscale completion fish > ~/.config/fish/completions/tailscale.fish
```

#### PowerShell

Run the following command to load completions for PowerShell.

```powershell
tailscale completion powershell | Out-String | Invoke-Expression
```

Run the following command, then source `tailscale.ps1` from your PowerShell profile to load completions for every new session.

```powershell
tailscale completion powershell > tailscale.ps1
```

## Command Reference

Common flags for all commands:

* `--socket=<path>` Path to the tailscaled socket.

### up

Connect your device to Tailscale and authenticate if needed.

```shell
tailscale up [flags]
```

Running `tailscale up` without any flags connects to Tailscale.

Common flags:

* `--accept-routes` Accept [subnet routes][kb-subnets] that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.
* `--advertise-exit-node` Offer to be an [exit node][kb-exit-nodes] for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.
* `--advertise-routes=<ip>` Expose physical [subnet routes][kb-subnets] to your entire Tailscale network.
* `--exit-node=<ip|name>` Provide a [Tailscale IP][kb-ip-and-dns-addresses] or [machine name][kb-machine-names] to use as an exit node. To disable the use of an exit node, pass the flag with an empty argument: `--exit-node=`.
* `--exit-node-allow-lan-access` Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.
* `--force-reauth` Force re-authentication.
* `--snat-subnet-routes` (Linux only) Disable source NAT. In normal operations, a subnet device sees the traffic originating from the subnet router. This simplifies routing, but does not allow traversing multiple networks. By disabling source NAT, the end machine sees the LAN IP address of the originating machine as the source.
* `--stateful-filtering` Enable stateful filtering for [subnet routers][kb-subnets] and [exit nodes][kb-exit-nodes]. When enabled, inbound packets with another node's destination IP are dropped, unless they are a part of a tracked outbound connection from that node. Defaults to disabled.
* `--shields-up` [Block incoming connections][kb-client-preferences] from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections.
* `--ssh` Run a [Tailscale SSH][kb-tailscale-ssh] server, permitting access per the tailnet administrator's declared [access policy][kb-acls], or the [default policy][kb-acl-samples-all-default] if none is defined. Defaults to false.

For a complete list of available flags, refer to the [`tailscale up`][kb-tailscale-up] topic.

### down

Disconnect from Tailscale. Running this command is the same as choosing to disconnect from or quit a Tailscale client.

```shell
tailscale down
```

When disconnected, you cannot reach devices over Tailscale. To reconnect, re-run `tailscale up` without any flags.

Available flags:

* `--accept-risk=<risk>` Accept risk and skip confirmation for risk type. This can be either `lose-ssh` or `all`, or an empty string to not accept risk.
* `--reason="<description>"` Specify the reason (inside quotes) for disconnecting Tailscale when the [system policies][kb-mdm-keys] `AlwaysOn.Enabled` and `AlwaysOn.OverrideWithReason` are enabled. For example, `tailscale down --reason="DNS issues"`.

### bugreport

> **Note:**
>
> The `bugreport` command is available in Tailscale v1.8 or later. If you don't see this command, consider [updating][kb-update] your Tailscale client.

Generate a bug report with diagnostic information.

The `bugreport` command makes it easier to report bugs to the Tailscale team by marking diagnostic logs with indicators to make triage easier.

If you encounter a connectivity issue, run `tailscale bugreport` on the device experiencing the issue at the time you encounter it.

```shell
tailscale bugreport
```

This command prints a random identifier into diagnostic logs, which you can share with our team.

Identifiers look like this:

```shell
BUG-1b7641a16971a9cd75822c0ed8043fee70ae88cf05c52981dc220eb96a5c49a8-20210427151443Z-fbcd4fd3a4b7ad94
```

This command shares no personally identifiable information and is unused unless you share the bug identifier with our team.

Available flags:

* `--diagnose` Prints additional verbose information about the system to the Tailscale logs after generating a `bugreport` identifier, which can then be viewed by our support team. Defaults to `false`.
* `--record` Pause and then write another `bugreport`. Use this flag to create an initial `bugreport` identifier. During the pause, perform the action that reproduces your issue. Then, press Enter to create a second `bugreport` identifier. Share both bug identifiers with our team. Defaults to `false`.

### cert

Generate Let's Encrypt certificate and key files on the host for [HTTPS certificates][kb-enabling-https] in your tailnet.

> **Note:**
>
> If you are trying to serve a folder of files or reverse proxy to an HTTP service, use the [`tailscale serve`][ar-serve] command instead.

```shell
tailscale cert hostname.tails-scales.ts.net
```

Alternatively, if you want to save the certificate and private key to files, you can use the `--cert-file` and `--key-file` arguments:

```shell
tailscale cert --cert-file=cert.pem --key-file=key.pem hostname.tails-scales.ts.net
```

The certificates provided by Let's Encrypt have a 90-day expiry and require periodic renewal. When a certificate is delivered as files on disk which you then move to an install location, such as when using `tailscale cert`, the [`tailscaled` daemon][kb-tailscaled] doesn't know where to place a renewed certificate or how to install it. As a result, you are responsible for renewing any certificates that you create using `tailscale cert`.

If a certificate is handled without the user initiating any file-based certificate installation (such as when using the [Caddy integration of Tailscale][xt-gh-tailscale-caddy-tailscale]) then the certificate will automatically renew without the user doing anything.

Available flags:

* `--cert-file=<cert>` Specify the certificate output path.
* `--key-file=<key>` Specify the private key output path.
* `--min-validity=<duration>` Request a specified minimum remaining validity on the returned certificate. `duration` can be any value parseable by [`time.ParseDuration()`][xt-go-time-parseduration]. For example, use `120h` to set the duration to five days.
* `--serve-demo` Serve on port `:443` using the cert as a demo, instead of writing out the files to disk.

> **Note:**
>
> The `--min-validity` flag lets you ensure that the returned certificate is valid for at least the specified duration. If you specify a duration longer than the [certification lifetime set by Let's Encrypt][xt-lets-encrypt-cert-lifetime], it uses the maximum lifetime set by Let's Encrypt.

### dns

The `dns` command lets you access [Tailscale DNS settings][kb-dns]. It's available in Tailscale v1.74.0 and later.

Subcommands:

* `status` Print the configuration of the local DNS forwarder and the tailnet-wide [MagicDNS][kb-magicdns] configuration.
* `query` Perform a DNS query using the local DNS forwarder. It's available in Tailscale v1.76.0 and later.

Available flags for `status`:

* `--all` Outputs advanced debugging information.

Available flags for `status` and `query`:

* `--json` Output in JSON format.

### drive

Share a directory with your tailnet using [Taildrive][kb-taildrive].

```shell
tailscale drive share <name> <path>
tailscale drive rename <oldname> <newname>
tailscale drive unshare <name>
tailscale drive list
```

Subcommands:

* `share` Create or modify a share.
* `rename` Rename a share.
* `unshare` Remove a share.
* `list` List current shares.

### completion

Configure tab-completion for the Tailscale CLI.

```shell
tailscale completion <subcommand> [flags]
```

Subcommands:

* `bash` Configure tab-completion for the `bash` shell.
* `zsh` Configure tab-completion for the `zsh` shell.
* `fish` Configure tab-completion for the `fish` shell.
* `powershell` Configure tab-completion for PowerShell.

Available flags:

* `--flags=<true|false>` Configure whether to suggest flags (in addition to subcommands). Set to `true` by default.
* `--descs=<true|false>` Configure whether to include descriptions of subcommands in the suggestions. Set to `true` by default.

### configure

Configure resources that you want to include in your tailnet.

```shell
tailscale configure <subcommands>
```

Subcommands:

* `kubeconfig` (alpha) Configure `kubectl` to connect to a Kubernetes cluster using Tailscale.
* `mac-vpn` Install or uninstall the VPN configuration on [App Store][kb-macos-mac-app-store] and [Standalone variant][kb-macos-standalone] of macOS.
* `synology` Configure Synology to enable outbound connections needed for Tailscale.
* `sysext` Activate, deactivate, or manage the state of the Tailscale [system extension][kb-apple-sysext] on the [Standalone variant][kb-macos-standalone] of macOS.
* `systray` Manage the `systray` client for Linux.

Available flags for `kubeconfig`:

* `--http` Use HTTP instead of HTTPS to connect to the auth proxy. Ignored if you include a scheme in the hostname argument.

Available subcommands for `mac-vpn`:

* `install` Write the Tailscale VPN configuration to the macOS settings.
* `uninstall` Delete the Tailscale VPN configuration from the macOS settings.

Available subcommands for `sysext`:

* `activate` Register the Tailscale system extension with macOS.
* `deactivate` Deactivate the Tailscale system extension on macOS.
* `status` Print the enablement status of the Tailscale system extension.

Available flags for `systray`:

* `--enable-startup=<init-system>` Install the startup script for the init system. The only currently supported value is `systemd`.

Examples:

* To configure your local `kubeconfig` file for authentication with a Kubernetes auth proxy:

```shell
tailscale configure kubeconfig <hostname-or-fqdn>
```

* To configure Synology to enable outbound connections:

```shell
tailscale configure synology
```

### exit-node

Get information about [exit-nodes][kb-exit-nodes] in your tailnet.

```shell
tailscale exit-node <subcommands>
```

Available subcommands:

* `list` Lists the exit nodes in your tailnet.
* `suggest` Suggests a [recommended exit node][kb-auto-exit-nodes].

Available flags for `list`:

* `--filter=<country>` Filter exit nodes by country.

### file

Access and make files available to [Taildrop][kb-taildrop].

```shell
tailscale file cp <files...> <target>:
tailscale file get <target-directory>
```

Available commands:

* `cp` Copy files to a host.
* `get` Move files out of the Tailscale file inbox.

Available flags for `cp`:

* `--name=<name>` Alternate filename to use, especially useful when `<file>` is `-` (`stdin`).
* `--targets` List possible file `cp` targets.
* `--update-interval=<time>` How often to repaint the progress line; zero or negative disables progress display entirely. Defaults to `250ms`.
* `--verbose` Verbose output.

Available flags for `get`:

* `--conflict=<behavior>` `behavior` when a conflicting (same-named) file already exists in the target directory.
  * `skip` Skip conflicting files: leave them in the Taildrop inbox and print an error. Get any non-conflicting files.
  * `overwrite` Overwrite existing file.
  * `rename` Write to a new number-suffixed filename.
* `--loop` Run get in a loop, receiving files as they come in.
* `--verbose` Verbose output.
* `--wait` Wait for a file to arrive if inbox is empty.

### funnel

Serve content and local servers from your Tailscale node to the internet.

To limit local service access to your tailnet, use the [`serve`][ar-serve] command.

```shell
tailscale funnel <target>
tailscale funnel <subcommand> [flags] <args>
```

Subcommands:

* [`status`][kb-tailscale-funnel-get-the-status] Gets the status.
* [`reset`][kb-tailscale-funnel-reset-tailscale-funnel] Resets the configuration.

For more information, refer to the [`tailscale funnel`][kb-tailscale-funnel] topic.

### ip

Get a device's Tailscale IP address.

```shell
tailscale ip [flags] [<hostname>]
```

By default, this command returns both an [`100.x.y.z` IPv4 address][kb-ip-and-dns-addresses] and an IPv6 address for the current device. You can return only an IPv4 or IPv6 address by passing either the `-4` or `-6` flags.

```shell
tailscale ip -4
```

For example, this command will return information similar to the following:

```shell
100.121.112.23
```

You can also find the Tailscale IP for other devices on your network by adding the device hostname after the command. For example:

```shell
tailscale ip raspberrypi
```

This command will return information similar to the following:

```shell
100.126.153.111
fd7a:115c:a1e0:ab12:4843:cd96:627e:9975
```

Available flags:

* `--4` Only return an IPv4 address.
* `--6` Only return an IPv6 address.
* `--1` Only return one address, preferring IPv4.
* `--assert=<specific-ip-address>` Assert that the node's IP (or one of the node's IPs) matches this IP address.

### licenses

Get open source license information.

```shell
tailscale licenses
```

### lock

Manage [Tailnet Lock][kb-tailnet-lock] for your tailnet.

```shell
tailscale lock <subcommand> [flags] <args>
```

Common subcommands:

* [`init`][kb-tailscale-lock-lock-init] Initializes Tailnet Lock.
* [`status`][kb-tailscale-lock-lock-status] Outputs the state of Tailnet Lock.
* [`add`][kb-tailscale-lock-lock-add] Adds one or more trusted signing keys to Tailnet Lock.
* [`remove`][kb-tailscale-lock-lock-remove] Removes one or more trusted signing keys from Tailnet Lock.
* [`sign`][kb-tailscale-lock-lock-sign] Signs a node key and transmits the signature to the coordination server.

Running `tailscale lock` with no subcommand and no arguments is equivalent to running [`tailscale lock status`][kb-tailscale-lock-lock-status].

For a complete list of subcommands and flags, refer to the [`tailscale lock`][kb-tailscale-lock] topic.

### login

Log into Tailscale (and add this device to your Tailscale network). For more information about logging in, refer to [fast-user-switching][kb-fast-user-switching].

```shell
tailscale login [flags]
```

Available flags:

* `--accept-dns` Accept [DNS configuration][kb-dns] from the admin console. Defaults to accepting DNS settings.
* `--accept-routes` Accept [subnet routes][kb-subnets] that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.
* `--advertise-connector` Offer to be an [app connector][kb-app-connector] for domain-specific internet traffic for the tailnet.
* `--advertise-exit-node` Offer to be an [exit node][kb-exit-nodes] for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.
* `--advertise-routes=<ip>` Expose physical [subnet routes][kb-subnets] to your entire Tailscale network.
* `--advertise-tags=<tags>` Give tagged permissions to this device. You must be [listed in `"TagOwners"`][kb-policy-syntax-tag-owners] to be able to apply tags.
* `--auth-key=<key>` Provide an [auth key][kb-auth-keys] to automatically authenticate the node as your user account. For a best practice when handling the `--auth-key` value, refer to [Securely handle an auth key][kb-secure-auth-key-cli].
* `--client-id` Client ID used to generate [auth keys][kb-auth-keys] by using
  [workload identity federation][kb-workload-identity].
* `--client-secret` [OAuth Client][kb-oauth-clients] secret used to generate
  [auth keys][kb-auth-keys]; if it begins with `file:`, then it's a path to a
  file containing the secret.
* `--exit-node=<ip|name>` Provide a [Tailscale IP][kb-ip-and-dns-addresses] or [machine name][kb-machine-names] to use as an exit node. To disable the use of an exit node, pass the flag with an empty argument: `--exit-node=`.
* `--exit-node-allow-lan-access` Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.
* `--hostname=<name>` Provide a hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in [MagicDNS][kb-magicdns].
* `--id-token` ID token from the identity provider to exchange with the control
  server for [workload identity federation][kb-workload-identity]; if it begins
  with `file:`, then it's a path to a file containing the token.
* `--audience` Audience used when requesting an ID token from an identity provider for auth keys generated by [workload identity federation][kb-workload-identity].
* `--login-server=<url>` Provide the base URL of a control server instead of `https://controlplane.tailscale.com`. If you are using [Headscale][bl-opensource-coordination-server] for your control server, use your Headscale instance's URL.
* `--netfilter-mode=<mode>` Netfilter mode (one of `on`, `nodivert`, `off`). Refer to [Tailscale netfilter modes][kb-netfilter-modes] for more information.
* `--nickname=<name>` [Nickname][kb-fast-user-switching-set-nickname] for the current account.
* `--operator=<user>` Provide a Unix username other than `root` to operate `tailscaled`.
* `--qr` Generate a QR code for the web login URL. Defaults to not showing a QR code.
* `--qr-format=<format>` QR code formatting: `small` or `large`. Defaults to `small`.
* `--report-posture` Allow management plane to gather [device posture][kb-device-posture] information. Defaults to `false`.
* `--stateful-filtering` Enable stateful filtering for [subnet routers][kb-subnets] and [exit nodes][kb-exit-nodes]. When enabled, inbound packets with another node's destination IP are dropped, unless they are a part of a tracked outbound connection from that node. Defaults to disabled.
* `--shields-up` [Block incoming connections][kb-client-preferences] from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections.
* `--snat-subnet-routes` Source NAT traffic to local routes advertised with `--advertise-routes`.
* `--ssh` Run a [Tailscale SSH][kb-tailscale-ssh] server, permitting access per the tailnet administrator's declared [access policy][kb-acls], or the [default policy][kb-acl-samples-all-default] if none is defined. Defaults to false.
* `--timeout=<duration>` Maximum amount of time to wait for the Tailscale service to initialize. `duration` can be any value parseable by [`time.ParseDuration()`][xt-go-time-parseduration]. Defaults to `0s`, which blocks forever.
* `--unattended`(Windows only) Run in [unattended mode][kb-run-unattended] where Tailscale keeps running even after the current user logs out.

### logout

Disconnect from Tailscale and expire the current log in. The next time you run `tailscale up`, you'll need to reauthenticate your device.

```shell
tailscale logout
```

If you run `tailscale logout` on an [ephemeral node][kb-ephemeral-nodes], the node will be removed from your tailnet immediately.

Available flags:

* `--reason` Reason for the logout, if required by a [system policy][kb-mdm-keys].

### metrics

Expose and collect [Tailscale client metrics][kb-client-metrics] for use with third-party monitoring systems.

```shell
tailscale metrics
```

Subcommands:

* `print` Shows client metrics in the current terminal session.
* `write` Writes metric values to a text file.

### netcheck

Get a report on your current physical network conditions. This command is provided to help debug connection troubles.

```shell
tailscale netcheck
```

`netcheck` will output a report like this:

```shell
Report:
	* Time: 2025-03-13T16:35:03.336481Z
	* UDP: true
	* IPv4: yes, <ipv4-address>
	* IPv6: yes, <ipv6-address>
	* MappingVariesByDestIP: false
	* PortMapping:
	* Nearest DERP: Seattle
	* DERP latency:
		- sea: 24.2ms  (Seattle)
		- sfo: 50.5ms  (San Francisco)
		- lax: 57.2ms  (Los Angeles)
		- den: 58.5ms  (Denver)
		- dfw: 63ms    (Dallas)
		- ord: 73.3ms  (Chicago)
```

(In the example output, the list of [DERP servers][kb-derp-servers] is truncated for brevity.)

* `UDP` shows whether UDP traffic is enabled on the current network. If this is false, it's unlikely Tailscale will be able to make point-to-point connections, and will instead rely on our [encrypted TCP relays (DERP)][kb-derp-servers]
* `IPv4` and **IPv6** show your network public IP addresses and support for both protocols.
* `MappingVariesByDestIP` describes whether your device is behind a difficult NAT that varies the device's IP address depending on the destination.
* `HairPinning` describes whether your router can route connections from endpoints on your LAN back to your LAN using those endpoints' globally-mapped IPv4 addresses/ports.
* `PortMapping` describes a list of which three port-mapping services exist on your router. Possible values are "UPnP", "NAT-PMP", and "PCP".
* `DERP latency` and `Nearest DERP` describe latency from our [encrypted TCP relays (DERP)][kb-derp-servers]. The lowest latency ("nearest") server is used for traffic.

If any fields are blank, it means Tailscale wasn't able to measure that network property.

All the information from `tailscale netcheck` is also available in the [Machines](https://login.tailscale.com/admin/machines) page of the admin console, by selecting a particular machine.

Available flags:

* `--every=<duration>` If non-zero, do an incremental report with the given frequency.
* `--format=<format>` Output format; empty (for human-readable), `json` or `json-line`.
* `--verbose` Verbose logs.
* `--bind-address` Send and receive connectivity probes using this locally bound IP address.
* `--bind-port` Send and receive connectivity probes using this UDP port.

### nc

Connect to a port on a host, connected to stdin/stdout.

```shell
tailscale nc <hostname-or-IP> <port>
```

### ping

Attempt to ping another device exclusively over Tailscale.

The regular `ping` command often works fine over Tailscale, but `tailscale ping` provides more details about the connection over Tailscale that can be helpful when troubleshooting connectivity.

```shell
tailscale ping <hostname-or-ip>
```

You can call `tailscale ping` using either a [100.x.y.z address][kb-ip-and-dns-addresses] or a [machine name][kb-machine-names].

Available flags:

* `--c` Maximum number of pings to send. Defaults to 10.
* `--icmp`, `--icmp=false` Perform an ICMP-level ping (through WireGuard, but not the local host OS stack). Defaults to false.
* `--peerapi`, `--peerapi=false` Try hitting the peer's PeerAPI HTTP server. Defaults to false.
* `--size=<size>` Size of the ping message (default pings only). 0 for minimum size.
* `--tsmp`, `--tsmp=false` Perform a TSMP-level ping (through WireGuard, but not either host's OS stack). Defaults to false.
* `--timeout=<duration>` Maximum amount of time to wait before giving up on a ping. `duration` can be any value parseable by [`time.ParseDuration()`][xt-go-time-parseduration]. Defaults to `5s`.
* `--until-direct`, `--until-direct=false` Stop once a direct path is established. Defaults to true.
* `--verbose`, `--verbose=false` Show verbose output. Defaults to false.

> **Tip:**
>
> There are [four types of ping messages][kb-ping-types] supported by the `tailscale ping` command.

### serve

Serve content and local servers from your Tailscale node to your tailnet.

To publicly share the local service to the internet, use the [`funnel`][ar-funnel] command.

```shell
tailscale serve <target>
tailscale serve <subcommand> [flags] <args>
```

Subcommands:

* [`status`][kb-tailscale-serve-get-the-status] Gets the status.
* [`reset`][kb-tailscale-serve-reset-tailscale-serve] Resets the configuration.

For more information, refer to the [`tailscale serve`][kb-tailscale-serve] topic.

### set

Change specified preferences.

Unlike [`tailscale up`][ar-up], this command does not require the complete set of desired settings. It only updates the settings you explicitly set. There are no default values. Note that when using [Fast User Switching][kb-fast-user-switching], changes made are only for the currently connected tailnet.

```shell
tailscale set [flags]
```

Available flags:

* `--accept-dns` Accept [DNS configuration][kb-dns] from the admin console.
* `--accept-risk=<risk>` Accept risk and skip confirmation for risk type. This can be either `lose-ssh` or `all`, or an empty string to not accept risk.
* `--accept-routes`, `--accept-routes=false` Accept [subnet routes][kb-subnets] that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.
* `--advertise-connector` Offer to be an [app connector][kb-app-connector] for domain-specific internet traffic for the tailnet.
* `--advertise-exit-node`, `--advertise-exit-node=false` Offer to be an exit node for internet traffic for the tailnet.
* `--advertise-routes=<ip>` Expose physical [subnet routes][kb-subnets] to your entire Tailscale network. This is a comma-separated string, such as "10.0.0.0/8,192.168.0.0/24", or an empty string to not advertise routes.
* `--auto-update`, `--auto-update=false` Enable or disable [auto-updates][kb-update-auto-updates] for the client.
* `--exit-node=<ip|name>` Provide a [Tailscale IP][kb-ip-and-dns-addresses] or [machine name][kb-machine-names] to use as an exit node. You can also use `--exit-node=auto:any` to track the suggested exit node and automatically switch to it when available exit nodes or network conditions change. To disable the use of an exit node, pass the flag with an empty argument using `--exit-node=`.
* `--exit-node-allow-lan-access`, `--exit-node-allow-lan-access=false` Allow the client node access to its own LAN while connected to an exit node.
* `--hostname=<name>`   Hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in [MagicDNS][kb-magicdns].
* `--netfilter-mode=<mode>` Netfilter mode (one of `on`, `nodivert`, `off`). Refer to [Tailscale netfilter modes][kb-netfilter-modes] for more information.
* `--nickname=<name>`   [Nickname][kb-fast-user-switching-set-nickname] for the current account.
* `--operator=<user>`   A Unix username other than `root` to operate `tailscaled`.
* `--relay-server-port=<port>` Specify a UDP port to accept peer relay connections on. UDP port number (`0` will pick a random unused port) for the relay server to bind to, on all interfaces, or empty string to disable relay server functionality. Refer to [Tailscale Peer Relays][kb-peer-relays] for more information.
* `--relay-server-static-endpoints` Use static endpoints for [Tailscale Peer Relays][kb-peer-relays].
* `--report-posture` Allow management plane to gather [device posture][kb-device-posture] information.
* `--shields-up`, `--shields-up=false` [Block incoming connections][kb-client-preferences] from other devices on your Tailscale network.
  Useful for personal devices that only make outgoing connections.
* `--snat-subnet-routes` Source NAT traffic to local routes advertised with `--advertise-routes`.
* `--ssh`, `--ssh=false` Run a [Tailscale SSH][kb-tailscale-ssh] server, permitting access per the tailnet administrator's declared [access policy][kb-acls], or the [default policy][kb-acl-samples-all-default] if none is defined.
* `--stateful-filtering` Apply stateful filtering to forwarded packets (subnet routers, exit nodes, and so on).
* `--update-check` Notify about available Tailscale updates.
* `--webclient`, `--webclient=false` Expose the [web interface][kb-device-web-interface] to your tailnet persistently in the background on port `:5252.`

### ssh

Establish a [Tailscale SSH][kb-tailscale-ssh] session to a Tailscale machine.

You can often use the regular `ssh` command or another SSH client to make an SSH session to a Tailscale machine. However, when your local node is in [userspace-networking][kb-kernel-vs-userspace-routers-netstack] mode and can't make a direct connection, use `tailscale ssh`. This sets up an SSH `ProxyCommand` to connect through the local `tailscaled` daemon. You can also use `tailscale ssh` when your local node is in [kernel][kb-kernel-vs-userspace-routers-kernel] mode.

The `tailscale ssh` command automatically checks the destination server's SSH host key against the node's SSH host key as advertised by using the Tailscale coordination server.

```shell
tailscale ssh <args>
```

`<args>` is one of the following forms:

* `host` The destination server. An interactive session will prompt you for the user name to use for the session.
* `user@host` The user name for the session and the destination server.

For both forms, `host` can be the destination server's [MagicDNS][kb-magicdns] name (even if `--accept-dns=false` was set on the local node) or the destination server's [Tailscale IP address][kb-ip-and-dns-addresses].

> **Note:**
>
> `tailscale ssh` is not available on sandboxed macOS builds—use the regular `ssh` client instead.

### status

Get the status of your connections to other Tailscale devices.

```shell
tailscale status
```

This command returns a condensed table of information in human-readable format:

```
1           2         3           4         5
100.1.2.3   device-a  apenwarr@   linux     active; direct <ip-port>, tx 1116 rx 1124
100.4.5.6   device-b  crawshaw@   macOS     active; relay <relay-server>, tx 1351 rx 4262
100.7.8.9   device-c  danderson@  windows   idle; tx 1214 rx 50
100.0.1.2   device-d  ross@       iOS       -
```

From left-to-right, these columns represent:

* Column 1 is a [**Tailscale IP**][kb-100.x-addresses], which you can use to connect to the device.
* Column 2 is the [**machine name**][kb-machine-names] of the device. If you use [MagicDNS][kb-magicdns], you can also use this name to connect.
* Column 3 is the **email address** for the owner of the device.
* Column 4 is the **device OS**.
* Column 5 shows the current **connection status**.

Connection status (column 5) is shown using three terms:

* `active` means traffic is currently being sent/received from this device. It also includes the connection type, which can be `direct`, `relay`, or `peer-relay`.
  * If the connection is `direct`, it includes peer device's IP address.
  * If the connection is `relay`, it includes the [DERP server][kb-derp-servers]'s city code (`nyc`, `fra`, `tok`, `syd`) for the respective location.
  * If the connection is [`peer-relay`][kb-peer-relays], it includes the Tailscale IP address of the peer relay and the VNI (virtual network interface) used.
* `idle` means traffic is not currently being sent/received from this device.
* `-` means no traffic has ever been sent/received from this device.

`active` and `idle` connection statuses will also include `tx`/`rx` values indicating the number of bytes sent (`tx`) and received (`rx`) from this device.

Running `tailscale status` with the `--json` flag returns a machine-readable JSON response.

```shell
tailscale status --json
```

Unlike `tailscale status`, using this flag gives a detailed list of peers and users in your tailnet that makes it well-suited for automation tasks. It also includes additional metadata associated with your device.

Combine this with [`jq`][xt-githubio-stedolan-jq] to automate data collection about your network. For example, the following command counts and sorts the relay servers your Tailscale peers are connected to.

```shell
tailscale status --json | jq -r '.Peer[].Relay | select(.!="")' | sort | uniq -c | sort -nr
```

Available flags:

* `--active` Filter output to only peers with active sessions (not applicable to web mode).
* `--browser` Open a browser in web mode (default `true`).
* `--header` Show column headers in table format (default `false`).
* `--json` Output in JSON format (WARNING: format subject to change).
* `--listen=<address>` Listen address for web mode; use port 0 for automatic (default `127.0.0.1:8384`).
* `--peers` Show status of peers (default `true`).
* `--self` Show status of local machine (default `true`).
* `--web` Run webserver with HTML showing status.

### switch

Switch to a different Tailscale account. For more information about switching accounts, refer to [fast-user-switching][kb-fast-user-switching].

```shell
tailscale switch <account> [flags]
```

Examples:

* To switch to the `alice@example.com` account:

  ```shell
  tailscale switch alice@example.com
  ```

* To switch to the account that has the [nickname][kb-fast-user-switching-set-nickname] "work":

  ```shell
  tailscale switch work
  ```

Available flags:

* `--list` Lists available accounts.

  * `--json` List available accounts in JSON format.

  ```shell
  tailscale switch --list --json
  ```

Subcommands:

* `remove <id>` removes a Tailscale account from the local machine. This does not delete the account itself, but it will no longer be available for switching to. You can add it back by logging in again. This command is currently in alpha and may change in the future.

### syspolicy

List system policies, reload system policies, or inspect errors related to the [system policies][kb-mdm-keys] configured in your tailnet.

```shell
tailscale syspolicy
```

Subcommands:

* `list` Shows system policies, reload system policies, or explore errors related to the [system policies][kb-mdm-keys] configured on the device.
* `reload` Forces the Tailscale client to reload and reapply system policy settings on the device.

Available flags:

* `--json` Return a machine-readable JSON response.

### systray

> **Note:**
>
> The `systray` command is available on the Linux client, is currently in [beta][kb-release-stages-beta], and is available in Tailscale v1.88 or later.

Run the [system tray (`systray`) application][kb-linux-systray] for Linux desktop clients to access some common actions like fast user switching and exit node selection.

```shell
tailscale systray
```

> **Warning:**
>
> Do not run `tailscale systray` as superuser (`sudo tailscale systray`), because systray is not designed to run as superuser and the command will fail.

Available flags:

* `--theme=<color-option>` Color theme for Tailscale icon: `dark`, `dark:nobg`, `light`, `light:nobg`.

### update

> **Note:**
>
> The `update` command is available in Tailscale v1.36 or later for Windows and Ubuntu/Debian Linux, in v1.48.0 or later for the Mac Apple Store version and Synology, and in v1.54.0 or later for QNAP and the [Standalone variant of the macOS application][kb-macos-standalone]. If you don't see this command and you are running one of these operating systems, consider [updating your Tailscale client][kb-update].

Update the Tailscale client version to the latest version, or to a different version.

```shell
tailscale update [flags]
```

Available flags:

* `--dry-run` Show what update would do, without performing the update and without prompting to start the update.
* `--track` The track to check for updates, either "stable", "release-candidate", or unstable. If not specified, the update uses the track currently in effect for the client. For more information, refer to [Tailscale client versions and release tracks][kb-release-tracks].
* `--version` An explicit version to use for the update or downgrade. You cannot specify both `--track` and `--version`. This flag is not available on the macOS client.
* `--yes` Perform the update without interactive prompts. Defaults to false.

If you downgrade to a version that does not have the `tailscale update` functionality, you won't be able to run `tailscale update` to return to the prior version. You would need to [perform an update][kb-update] without using the Tailscale CLI.

To determine the current version on a client, run [`tailscale version`][ar-version].

Examples:

Update to the latest version within your current track (stable or unstable, depending on what you're running):

```shell
tailscale update
```

Update to the latest version within your current track without using interactive prompts:

```shell
tailscale update --yes
```

Update to Tailscale v1.34:

```shell
tailscale update --version=1.34.0
```

Update to the latest unstable version:

```shell
tailscale update --track=unstable
```

### version

Print the version of Tailscale.

```shell
tailscale version [flags]
```

Available flags:

* `--daemon` Also print local node's daemon version. Defaults to false.
* `--json` Return a machine-readable JSON response.
* `--upstream` Print the latest upstream release version from `pkgs.tailscale.com`. Defaults to false.
* `--track`, `--track=[stable|unstable|release-candidate]` Check a specified track for updates. Empty value is the current track. For more information, refer to [Tailscale client versions and release tracks][kb-release-tracks].

> **Tip:**
>
> Running `tailscale version` also prints other information, including the Go version. Here's an example of the output:
>
> ```shell
> tailscale version
> 1.72.0
>   tailscale commit: 9a0f00ea8ed08d1a94b357fb232ac9d44a512664
>   other commit: 387e0b40ad87031fb4444372ee80a97156e8deb9
>   go version: go1.22.5
> ```

### wait

Wait for Tailscale resources to become available for binding within a specified timeout or indefinitely.

The command returns exit code `0` on success. It returns a non-zero exit code on failure or timeout.

> **Note:**
>
> As of Tailscale version 1.96, the only resource available to wait for is the Tailscale interface and its IPs. A future version of this command may support waiting for other types of resources.
>
> If running in userspace-networking mode, this command only waits for `tailscaled` and the `Running` state, as no physical network interface exists.

```shell
tailscale wait [flags]
```

Available flags:

* `--timeout=<duration>` Set a timeout duration in seconds. Setting the duration to `0` will set the timeout to indefinite.

Examples:

To wait on a specific type of IP address, use `tailscale ip` in combination with the `tailscale wait` command. For example, to wait for an IPv4 address:

```shell
tailscale wait && tailscale ip --assert=<specific-ip-address>
```

Linux `systemd` users can wait for the `tailscale-online.target` target, which runs this command.

A service that wants to bind to (listen on) a Tailscale interface or IP address, can use the following pattern to ensure Tailscale is ready before the program starts:

```shell
tailscale wait && /path/to/service [...]
```

### web

Start a web server for controlling the `tailscaled` daemon. Starting a web server is useful when the CLI or a native app is impractical (such as on NAS devices).

```shell
tailscale web [flags]
```

Available flags:

* `--cgi=<true|false>` Run the web server as a CGI script. Defaults to false.
* `--listen=<ip|name>` Set the listen address. Use port `0` for automatic. Defaults to `localhost:8088`.
* `--origin=<hostname>` Origin at which the web UI is served (if behind a reverse proxy or used with CGI).
* `--prefix=<string>` Set the URL prefix added to requests (for CGI or reverse proxies).
* `--readonly` Run the web server in read-only mode.

### whois

Get the machine and user associated with a Tailscale IP.

```shell
tailscale whois ip[:port]
```

For user devices, this command returns:

```
Machine:
  Name:
  ID:
  Addresses:
  AllowedIPs:
User:
  Name:
  ID:
Capabilities:
```

For devices that are tagged, this command returns:

```
Machine:
  Name:
  ID:
  Addresses:
  AllowedIPs:
  Tags:
Capabilities:
```

For each of these fields:

* `Machine`, `Name` is the [machine name][kb-machine-names] of the device. If you use [MagicDNS][kb-magicdns], you can also use this name to connect.
* `Machine`, `ID` is the [node id][kb-terminology-and-concepts-node] of the device.
* `Machine`, `Addresses` are the [Tailscale IP][kb-100.x-addresses], which you can use to connect to the device.
* `Machine`, `AllowedIPs` are the subnet routes available to the device.
* `Machine`, `Tags` are the tags to which the device belongs.
* `User`, `Name` is the email address for the owner of the device.
* `User`, `ID` is the unique ID of the user
* `Capabilities` show the grants for the device.

Running `tailscale whois` with the `--json` flag will return a machine-readable JSON response. (Note that the `--json` option must come before the `ip[:port]` argument.)

```shell
tailscale whois --json ip[:port]
```

Available flags:

* `--json` Output in JSON format.
* `--proto=<proto>` Protocol for the WhoIs request; one of `tcp` or `udp`; empty means both.

### appc-routes

Print the current [app connector][kb-app-connector] route status.

By default this command prints the domains configured in the app connector
configuration and how many routes have been learned for each domain.

```shell
tailscale appc-routes [flags]
```

Available flags:

* `--all` Print learned domains and routes and extra policy configured routes.
* `--map` Print the map of learned domains.
* `--n` Print the total number of routes this node advertises.

[ar-completion]: #completion

[ar-funnel]: #funnel

[ar-serve]: #serve

[ar-up]: #up

[ar-version]: #version

[bl-opensource-coordination-server]: /blog/opensource#the-open-source-coordination-server

[kb-100.x-addresses]: /docs/concepts/tailscale-ip-addresses

[kb-acl-samples-all-default]: /docs/reference/examples/acls#allow-all-default-acl

[kb-acls]: /docs/features/access-control/acls

[kb-app-connector]: /docs/features/app-connectors

[kb-apple-sysext]: /docs/concepts/macos-sysext

[kb-auth-keys]: /docs/features/access-control/auth-keys

[kb-auto-exit-nodes]: /docs/features/exit-nodes/auto-exit-nodes

[kb-client-metrics]: /docs/reference/tailscale-client-metrics

[kb-client-preferences]: /docs/features/client/manage-preferences

[kb-derp-servers]: /docs/reference/derp-servers

[kb-device-posture]: /docs/features/device-posture

[kb-device-web-interface]: /docs/features/client/device-web-interface

[kb-dns]: /docs/reference/dns-in-tailscale

[kb-enabling-https]: /docs/how-to/set-up-https-certificates

[kb-ephemeral-nodes]: /docs/features/ephemeral-nodes

[kb-exit-nodes]: /docs/features/exit-nodes

[kb-fast-user-switching]: /docs/features/client/fast-user-switching

[kb-fast-user-switching-set-nickname]: /docs/features/client/fast-user-switching#setting-a-nickname

[kb-ip-and-dns-addresses]: /docs/concepts/ip-and-dns-addresses

[kb-kernel-vs-userspace-routers-kernel]: /docs/reference/kernel-vs-userspace-routers#kernel-mode

[kb-kernel-vs-userspace-routers-netstack]: /docs/reference/kernel-vs-userspace-routers#userspace-netstack-mode

[kb-linux-systray]: /docs/features/client/linux-systray

[kb-machine-names]: /docs/concepts/machine-names

[kb-macos-mac-app-store]: /docs/concepts/macos-variants#mac-app-store-variant

[kb-macos-standalone]: /docs/concepts/macos-variants#standalone-variant

[kb-magicdns]: /docs/features/magicdns

[kb-mdm-keys]: /docs/features/tailscale-system-policies

[kb-netfilter-modes]: /docs/reference/netfilter-modes

[kb-oauth-clients]: /docs/features/oauth-clients

[kb-peer-relays]: /docs/features/peer-relay

[kb-ping-types]: /docs/reference/ping-types

[kb-policy-syntax-tag-owners]: /docs/reference/syntax/policy-file#tag-owners

[kb-release-stages-beta]: /docs/reference/tailscale-release-stages#beta

[kb-release-tracks]: /docs/reference/tailscale-client-versions#client-release-tracks

[kb-run-unattended]: /docs/how-to/run-unattended

[kb-secure-auth-key-cli]: /docs/features/access-control/auth-keys/how-to/secure-auth-keys

[kb-subnets]: /docs/features/subnet-routers

[kb-taildrive]: /docs/features/taildrive

[kb-taildrop]: /docs/features/taildrop

[kb-tailnet-lock]: /docs/features/tailnet-lock

[kb-tailscale-funnel]: /docs/reference/tailscale-cli/funnel

[kb-tailscale-funnel-get-the-status]: /docs/reference/tailscale-cli/funnel#get-the-status

[kb-tailscale-funnel-reset-tailscale-funnel]: /docs/reference/tailscale-cli/funnel#reset-tailscale-funnel

[kb-tailscale-lock]: /docs/reference/tailscale-cli/lock

[kb-tailscale-lock-lock-add]: /docs/reference/tailscale-cli/lock#lock-add

[kb-tailscale-lock-lock-init]: /docs/reference/tailscale-cli/lock#lock-init

[kb-tailscale-lock-lock-remove]: /docs/reference/tailscale-cli/lock#lock-remove

[kb-tailscale-lock-lock-sign]: /docs/reference/tailscale-cli/lock#lock-sign

[kb-tailscale-lock-lock-status]: /docs/reference/tailscale-cli/lock#lock-status

[kb-tailscale-serve]: /docs/reference/tailscale-cli/serve

[kb-tailscale-serve-get-the-status]: /docs/reference/tailscale-cli/serve#get-the-status

[kb-tailscale-serve-reset-tailscale-serve]: /docs/reference/tailscale-cli/serve#reset-tailscale-serve

[kb-tailscale-ssh]: /docs/features/tailscale-ssh

[kb-tailscale-up]: /docs/reference/tailscale-cli/up

[kb-tailscaled]: /docs/reference/tailscaled

[kb-terminology-and-concepts-node]: /docs/reference/glossary#node

[kb-update]: /docs/features/client/update

[kb-update-auto-updates]: /docs/features/client/update#auto-updates

[kb-workload-identity]: /docs/features/workload-identity-federation

[xt-gh-tailscale-caddy-tailscale]: https://github.com/tailscale/caddy-tailscale

[xt-githubio-stedolan-jq]: https://stedolan.github.io/jq

[xt-go-time-parseduration]: https://pkg.go.dev/time#ParseDuration

[xt-lets-encrypt-cert-lifetime]: https://letsencrypt.org/docs/faq#what-is-the-lifetime-for-let-s-encrypt-certificates-for-how-long-are-they-valid