Tailscale ships with a built-in CLI that you can use to get information about your Tailscale+WireGuard® network and troubleshoot issues.

Using the CLI

The location of the CLI varies depending on your platform:

tailscale <command>

/Applications/Tailscale.app/Contents/MacOS/Tailscale <command>

alias tailscale="/Applications/Tailscale.app/Contents/MacOS/Tailscale"

"c:\Program Files (x86)\Tailscale IPN\tailscale.exe" <command>

There is no CLI support for iOS and Android.

Command Reference

up

Up connects your device to Tailscale, and authenticates if needed.

tailscale up [flags]

Running tailscale up without any flags connects to Tailscale.

You can specify flags to configure Tailscale’s behavior. Flags are not persisted between runs; you must specify all flags each time.

To clear previously set flags like tags and routes, pass the flag with an empty argument:

# Connects with `tag:server`
tailscale up --advertise-tags=tag:server

# Connects and clears any tags
tailscale up --advertise-tags=

In Tailscale v1.8 or greater, if you forget to specify a flag you added before, the CLI will warn you and provide a copyable command that includes all existing flags.

Available flags:

• --authkey=<key> Provide an auth key to automatically authenticate the node as your user account.
• --advertise-routes=<ip> Expose physical subnet routes to your entire Tailscale network. Read our subnet documentation for more details.
• --advertise-tags=<tags> Give tagged permissions to this device. You must be listed in "TagOwners" to be able to apply tags.
• --accept-routes Accept subnet routes that other nodes advertise. Linux devices default to not accepting routes.
• --shields-up Block incoming connections from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections.

down

down disconnects from Tailscale. This command is the same as the “Disconnect” option on the macOS and Windows GUI clients.

tailscale down

When disconnected, you cannot reach devices over Tailscale. To reconnect, re-run tailscale up without any flags.

ip

ip returns a device’s Tailscale IP address.

tailscale ip [flags] [<hostname>]

By default, this command returns both an 100.x.y.z IPv4 address and an IPv6 address for the current device. You can return only an IPv4 or IPv6 address by passing either the -4 or -6 flags.

$ tailscale ip -4
100.121.112.23

You can also find the Tailscale IP for other devices on your network by adding the device hostname after the command. For example:

$ tailscale ip raspberrypi
100.126.153.111
fd7a:115c:a1e0:ab12:4843:cd96:627e:9975

Available flags:

• -4 Only return an IPv4 address
• -6 Only return an IPv6 address

ping

Ping tries to ping another device exclusively over Tailscale.

The regular ping command often works fine over Tailscale, but tailscale ping provides more details about the connection over Tailscale that can be helpful when troubleshooting connectivity.

tailscale ping <hostname-or-ip>

You can call tailscale ping using either a 100.x.y.z address or a machine name.

logout

Log out disconnects from Tailscale and expires the current log in. The next time you run tailscale up, you’ll need to reauthenticate your device.

tailscale logout

status

Status shows the status of your connections to other Tailscale devices.

tailscale status

This command returns a table of information like so:

1           2         3           4         5
100.1.2.3   device-a  [email protected]   linux     active; direct <ip-port>, tx 1116 rx 1124
100.4.5.6   device-b  [email protected]   macOS     active; relay <relay-server>, tx 1351 rx 4262
100.7.8.9   device-c  [email protected]  windows   idle; tx 1214 rx 50
100.0.1.2   device-d  [email protected]       iOS       —

From left-to-right, these columns represent:

• Column 1 is a Tailscale IP, which you can use to connect to the device
• Column 2 is the machine name of the device. If you use MagicDNS, you can use this name to connect too.
• Column 3 is the email address for the owner of the device.
• Column 4 is the device OS.
• Column 5 shows the current connection status.

Connection status (column 5) is shown using three terms:

• active means traffic is currently being sent/received from this device. You’ll also see either (a) “direct” for peer-to-peer connections, along with the IP address used to connect or (b) “relay” for connections using a relay server along with a city code (nyc, fra, tok, syd) for the respective location.
• idle means traffic is not currently being sent/received from this device.
• – means no traffic has ever been sent/received from this device.

active and idle connection statuses will also include tx/rx values indicating the number of bytes sent (tx) and received (rx) from this device.

You can filter this list down to only active connections by running tailscale status --active.

Running tailscale status with the --json flag will return a machine-readable JSON response.

tailscale status --json

Combine this with jq to automate data collection about your network. For example, the following command will count and sort which relay servers your Tailscale peers are connected to.

tailscale status --json | jq -r '.Peer[].Relay | select(.!="")' | sort | uniq -c | sort -nr

netcheck

Netcheck provides a report on your current physical network conditions. This command is provided to help debug connection troubles.

tailscale netcheck

Netcheck will output a report like this:

Report:
* UDP: true
* IPv4: yes, <ip-address>
* IPv6: no
* MappingVariesByDestIP: false
* HairPinning: false
* PortMapping: false
* Nearest DERP: 1 (nyc)
* DERP latency:
- 1, nyc = 43.6ms
- 2, sfo = 67.4ms
- 3, sin = 202.5ms
- 4, fra = 91.9ms
- 5, syd = 218.5ms

• UDP shows whether UDP traffic is enabled on the current network. If this is false, it’s unlikely Tailscale will be able to make point-to-point connections, and will instead rely on our encrypted TCP relays (DERP)
• IPv4 and IPv6 show your network public IP addresses and support for both protocols.
• MappingVariesByDestIP describes whether your device is behind a difficult NAT that varies the device’s IP address depending on the destination.
• HairPinning describes whether your router can route connections from endpoints on your LAN back to your LAN using those endpoints' globally-mapped IPv4 addresses/ports.
• PortMapping describes a list of which three port-mapping services exist on your router. Possible values are “UPnP”, “NAT-PMP”, and “PCP”.
• DERP latency and Nearest DERP describe latency from our encrypted TCP relays (DERP). The lowest latency (“nearest”) server is used for traffic.

If any fields are blank, it means Tailscale wasn’t able to measure that network property.

All the information from tailscale netcheck is also available in the admin console, by clicking on a particular machine.

bugreport

Bugreport makes it easier to report bugs to the Tailscale team by marking diagnostic logs with indicators to make triage easier.

If you encounter a connectivity issue, run tailscale bugreport on the device experiencing the issue at the time you encounter it. This command will print a random identifier into diagnostic logs, which you can share with our team.

Identifiers look like this:

$ tailscale bugreport
BUG-1b7641a16971a9cd75822c0ed8043fee70ae88cf05c52981dc220eb96a5c49a8-20210427151443Z-fbcd4fd3a4b7ad94

This command shares no personally-identifiable information, and is unused unless you share the bug identifier with our team.