Networking should be simple(r)

Pre-authentication keys automatically register new nodes without having to sign in via a web browser.

Create access tokens for scoped access to the Tailscale API.

ACL tags assign an identity to a node that’s used as part of an ACL to restrict access.

Tailscale brokered and authenticated SSH connection without managing SSH keys.

Initiate browser-based SSH session from the admin console to a designated node.

Share a folder or service with the public internet over HTTPS.

Surface what configuration-based actions occurred, by whom, and when.

Natively stream configuration or network flow logs to our SIEM integration partners.

Surface what node-to-node interaction occurred, and when.

Store any Tailscale SSH session recording long-term in any S3-compatible service or local disk.

Create event triggers that notify you in real-time via partner integrations.

Verify ACLs coverage provides sufficient coverage against unnecessary exposure.

Create RBAC policies to determine which users, roles, or groups can access, which nodes on your tailnet.

Manage ACLs version control within a CI/CD workflow using GitHub or GitLab.

Partner integrations allow administrators to provide time-bound, elevated privileges for users.

Administrative roles with varying privileges to manage your tailnet.

Configure and deploy Tailscale using MDM solutions

Customize Tailscale using system policies

Tailscale uses WireGuard VPN protocol for end-to-end encryption.

Route all traffic through a designated egress point, similar to a privacy VPN.

Ensure users can still access resources if a routing device becomes unavailable.

Route traffic to overlapping IPv4 subnets without renumbering with 4via6 subnet routers, by assigning unique IPv6 addresses for each subnet.

Tailscale uses WireGuard VPN protocol to establish low-latency, peer-to-peer connections.

Ensure users can still access resources if a routing device becomes unavailable.

MagicDNS automatically registers DNS names as human-readable for better discoverability.

Split tunneling only routes internal traffic through the VPN for improved latency.

Require devices to be approved by an administrator before joining the tailnet.

Configure EDR integrations like Crowdstrike to use their custom attributes as part of device posture checks for your Tailnet.

Collect device attributes and use them as part of connectivity rules within your Tailnet to limit access for devices that do not meet security requirements.

A predetermined trusted node must verify the trusted keys of any nodes attempting to join your tailnet.

Enable HTTPS when connecting with web APIs or browsers to encrypt communications.

Share a node with any Tailscale user on any tailnet without exposing it to the public internet.

Monitor services on your tailnet in one central location.

Transfer sensitive or large files with minimal latency between devices.

Embed Tailscale inside Go programs to run multiple services on a single machine to create tools like golinks.

Users can authenticate themselves using their organization’s custom OIDC.

Require users to re-authenticate regularly.

Users can authenticate using one of our supported identity providers to access the tailnet.

Sync users and group settings from one of our supported IdPs to keep ACLs up-to-date.

Require users to be approved by an administrator before gaining access to the tailnet.