Definition:
Tailscale is an identity-based private connectivity service that creates an encrypted network between computers, servers and applications. This network, known as a tailnet, allows devices to communicate even when they are in different locations, cloud providers or Internet connections.
Tailscale uses WireGuard to encrypt traffic between nodes. Each device receives an identity and a stable private address, while access policies determine which users, devices and services can communicate.
Índice de contenidos
How Tailscale works
The Tailscale client is installed on each device that needs to join the network. During registration, the device generates its keys and is associated with an identity. The control plane distributes the information required to locate nodes and apply policies, but data traffic does not normally pass through the control plane.
Whenever possible, devices establish a direct connection using NAT traversal techniques. If a direct connection cannot be established, Tailscale uses DERP servers as relays. These servers carry packets that are already encrypted and do not hold the private keys required to decrypt them.
Unlike a centralised VPN, a tailnet can use a mesh topology in which nodes communicate directly. An exit node can also route Internet traffic, while a subnet router can provide access to devices that cannot run the client.
The client is available from the official Tailscale download page for major operating systems and other supported environments.
Main Tailscale features
Its features allow the network to support personal devices, organisations and distributed infrastructure:
- Private connections between nodes: Devices communicate through encrypted tunnels without normally depending on a central gateway.
- MagicDNS: It assigns recognisable names to devices so their private IP addresses do not need to be entered manually.
- Tailscale SSH: It manages SSH connections using tailnet identities and policies.
- Subnet routers: They provide access to networks or devices that cannot run the Tailscale client directly.
- Exit nodes: They allow an authorised device to route its Internet traffic through another node.
- API and automated provisioning: They support the enrolment and management of devices, users, tags and settings.
The availability and details of certain features depend on the operating system, configuration and subscription plan.
Security and access control
The sign-in identity, device identity and tailnet rules form the basis of access control. Rules can be expressed through grants or access control lists and can restrict permitted destinations, protocols and ports.
Tags assign a non-human identity to servers, services and other shared devices. This separates a machine’s permissions from the personal permissions of the user who installed it. Device approval, key expiry and device posture checks can provide additional controls.
This approach is related to a software-defined perimeter, but creating a tailnet does not automatically implement a Zero Trust architecture. A permissive initial configuration should be replaced with explicit rules when the network protects sensitive resources.
Tailscale for remote devices and AI agents
Tailscale can be used to administer computers, servers and other remote devices without exposing their management ports directly to the Internet. An authorised operator can connect through SSH, remote desktop, private dashboards or other protocols supported by the destination device.
In infrastructure involving an AI agent, the tailnet can provide a private route between the agent, its tools and the machines it manages. For example, an OpenClaw installation can run on a remote computer while remaining accessible only to authorised nodes.
Agents should not receive unrestricted access to the entire network. Each agent should be limited to the destinations and ports it requires, preferably through dedicated tags and identities. One-off or short-lived authentication keys are appropriate for automated deployments and temporary workloads.
Tailscale protects the communication path and controls which nodes can connect, but it does not determine which actions an agent may perform within an application. Operating-system permissions, tool credentials and each service’s own authorisation controls remain necessary.
Security best practices
A secure implementation requires appropriate network rules and maintained endpoints. Important measures include:
- Apply least privilege: Define rules that allow only the required resources and ports.
- Separate people and services: Use groups for users and dedicated tags for servers, automations and agents.
- Protect keys: Do not place authentication keys in repositories, prompts, histories or unprotected files.
- Review devices and routes: Remove obsolete machines and limit subnet routers and exit nodes carefully.
- Keep systems updated: Patch vulnerabilities, protect accounts and retain relevant access records.
A compromised device can perform the actions allowed by its identity and policies. Tailscale should therefore be combined with strong authentication, updates, endpoint protection, secret management and periodic permission reviews.