# tailscale up command Last validated Jan 26, 2026 `tailscale up` connects your device to Tailscale, and authenticates if needed. ```shell tailscale up [flags] ``` Running `tailscale up` without any flags connects to Tailscale. You can specify flags to configure Tailscale's behavior. Flags are not persisted between runs; you must specify all flags each time. To clear previously set flags like tags and routes, pass the flag with an empty argument: ```shell # Connects with `tag:server` tailscale up --advertise-tags=tag:server # Connects and clears any tags tailscale up --advertise-tags= ``` In Tailscale v1.8 or later, if you forget to specify a flag you added before, the CLI will warn you and provide a copyable command that includes all existing flags. Available flags: * `--accept-dns` Accept [DNS configuration][kb-dns] from the admin console. Defaults to accepting DNS settings. * `--accept-risk=` Accept risk and skip confirmation for risk type. This can be either `lose-ssh` or `all`, or an empty string to not accept risk. * `--accept-routes` Accept [subnet routes][kb-subnets] that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes. * `--advertise-connector` Advertise this node as an [app connector][kb-app-connectors]. * `--advertise-exit-node` Offer to be an [exit node][kb-exit-nodes] for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node. * `--advertise-routes=` Expose physical [subnet routes][kb-subnets] to your entire Tailscale network. * `--advertise-tags=` Give tagged permissions to this device. You must be [listed in `"TagOwners"`][kb-policy-syntax-tag-owners] to be able to apply tags. * `--auth-key=` Provide an [auth key][kb-auth-keys] to automatically authenticate the node as your user account; if it begins with `file:`, then it's a path to a file containing the auth key. * `--client-id` Client ID used to generate [auth keys][kb-auth-keys] by using [workload identity federation][kb-workload-identity]. * `--client-secret` [OAuth Client][kb-oauth-clients] secret used to generate [auth keys][kb-auth-keys]; if it begins with `file:`, then it's a path to a file containing the secret. * `--exit-node=` Provide a [Tailscale IP][kb-ip-and-dns-addresses] or [machine name][kb-machine-names] to use as an exit node. You can also use `--exit-node=auto:any` to track the suggested exit node and automatically switch to it when available exit nodes or network conditions change. To disable the use of an exit node, pass the flag with an empty argument using `--exit-node=`. * `--exit-node-allow-lan-access` Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node. * `--force-reauth` Force re-authentication. * `--hostname=` Provide a hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in [MagicDNS][kb-magicdns]. * `--id-token` ID token from the identity provider to exchange with the control server for [workload identity federation][kb-workload-identity]; if it begins with `file:`, then it's a path to a file containing the token. * `--audience` Audience used when requesting an ID token from an identity provider for auth keys generated by [workload identity federation][kb-workload-identity]. * `--json` Output in JSON format. Format is subject to change. * `--login-server=` Provide the base URL of a control server instead of `https://controlplane.tailscale.com`. If you are using [Headscale][bl-opensource-coordination-server] for your control server, use your Headscale instance's URL. * `--netfilter-mode` (Linux only) Advanced feature for controlling the degree of automatic firewall configuration. Values are either `off`, `nodivert`, or `on`. Defaults to `on`, except for Synology which defaults to `off`. Setting this flag to `off` disables all management of `netfilter`. Setting to `nodivert` creates and manages Tailscale sub-chains, but leaves the calling of those chains up to the administrator. Setting to `on` means using full management of Tailscale's rules. Note that if you set `--netfilter-mode` to `off` or `nodivert`, it is your responsibility to configure the firewall securely for Tailscale traffic. We recommend using the rules installed by `--netfilter-mode=on` as a starting point. Refer to [netfilter modes][kb-netfilter-mode] for more information. * `--operator=` Provide a Unix username other than `root` to operate `tailscaled`. * `--qr` Generate a QR code for the web login URL. Defaults to not showing a QR code. * `--qr-format=` QR code formatting: `small` or `large`. Defaults to `small`. * `--report-posture` Allow management plane to gather [device posture][kb-device-posture] information. Defaults to `false`. * `--reset` Reset unspecified settings to default values. * `--shields-up` [Block incoming connections][kb-client-preferences] from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections. * `--snat-subnet-routes` (Linux only) Source NAT traffic to local routes that are advertised with `--advertise-routes`. Defaults to sourcing the NAT traffic to the advertised routes. Set to false to disable subnet route masquerading. * `--stateful-filtering` (Linux only) Enable stateful filtering for subnet routers and exit nodes. When enabled, inbound packets with another node's destination IP are dropped, unless they are a part of a tracked outbound connection from that node. Defaults to disabled. * `--ssh` Run a [Tailscale SSH][kb-tailscale-ssh] server, permitting access per the tailnet administrator's declared [access policy][kb-acls], or the [default policy][kb-acl-samples-all-default] if none is defined. Defaults to false. * `--timeout=` Maximum amount of time to wait for the Tailscale service to initialize. `duration` can be any value parseable by [`time.ParseDuration()`][xt-go-time-parseduration]. Defaults to `0s`, which blocks forever. * `--unattended`(Windows only) Run in [unattended mode][kb-run-unattended] where Tailscale keeps running even after the current user logs out. [bl-opensource-coordination-server]: /blog/opensource#the-open-source-coordination-server [kb-acl-samples-all-default]: /docs/reference/examples/acls#allow-all-default-acl [kb-acls]: /docs/features/access-control/acls [kb-app-connectors]: /docs/features/app-connectors [kb-auth-keys]: /docs/features/access-control/auth-keys [kb-client-preferences]: /docs/features/client/manage-preferences [kb-device-posture]: /docs/features/device-posture [kb-dns]: /docs/reference/dns-in-tailscale [kb-exit-nodes]: /docs/features/exit-nodes [kb-ip-and-dns-addresses]: /docs/concepts/ip-and-dns-addresses [kb-machine-names]: /docs/concepts/machine-names [kb-magicdns]: /docs/features/magicdns [kb-netfilter-mode]: /docs/reference/netfilter-modes [kb-oauth-clients]: /docs/features/oauth-clients [kb-policy-syntax-tag-owners]: /docs/reference/syntax/policy-file#tag-owners [kb-run-unattended]: /docs/how-to/run-unattended [kb-subnets]: /docs/features/subnet-routers [kb-tailscale-ssh]: /docs/features/tailscale-ssh [kb-workload-identity]: /docs/features/workload-identity-federation [xt-go-time-parseduration]: https://pkg.go.dev/time#ParseDuration