A Tailscale Manual

Data crosses the internet in small parcels called packets. Every packet carries a destination and a sender, and the address on it is an IP address.

• Router — the box on the border between your home network (LAN) and the internet (WAN). Everything going out passes through it
• Port numbers — the room number inside one device, saying which app a packet is for. The web uses 443, Remote Desktop uses 3389, and so on
• DNS — the phone book that turns a name like example.com into an IP address. People remember names; machines connect by number

A home has one public IP address, yet several devices can use the internet at once. That works because the router performs NAT, network address translation.

The usual ways of getting through that wall have been:

• Port forwarding — adding a row to the router's table by hand: “anything for this port goes to that device.” But the hole is open to the whole world, and it attracts attacks
• Often you can't — mobile networks and some broadband lines add a second layer of NAT at the provider (CGNAT). Some IPv6-based ISP setups common in Japan (IPv4 over IPv6) limit the ports you can use or rule out port forwarding entirely
• Running your own VPN server — secure, but it still needs port forwarding and a fair amount of setup

A VPN (virtual private network) builds an encrypted tunnel across the internet so that faraway devices can talk as if they were in the same house. Many people know it from work.

A traditional VPN has everyone connect to a central VPN server, the hub. Even if the other device is next door, the traffic goes to the hub and back. When the hub is busy everyone slows down; when it stops, everyone stops.

The key idea is that Tailscale separates deciding how to connect from carrying the data. Tailscale's servers do the first; your devices do the second.

• The coordination server — the tailnet's registrar. It tracks which devices belong, their public keys and how to reach them, and hands that out. Your data never passes through it, and if it goes down briefly, devices that are already connected keep talking
• WireGuard keys — each device makes its own key pair and the private key never leaves the device. Only public keys go to the server, so Tailscale itself can't read your traffic
• 100.x.y.z addresses — each device gets a stable address from the 100.64.0.0/10 range. It stays the same when you switch from Wi-Fi to mobile data
• MagicDNS — lets you connect with just a device name such as my-nas. It is on by default for new tailnets

Getting through NAT to a direct connection

As chapter 2 showed, incoming traffic is normally dropped by NAT. Tailscale has both sides send outgoing packets to each other at the same moment, so each router creates a table entry, and a direct path opens up. This is NAT traversal, or hole punching.

The basic promise is: your own devices, safely connected, wherever they are. Common uses:

It is not really meant for publishing a website to the public (though a feature called Funnel can do that). And before installing it on a work computer, check your company's policy and get IT's approval.

• Account — Tailscale has no passwords of its own. You sign in with a Google, Microsoft, GitHub or Apple account (or OIDC). Remember which one you used; it matters later
• Use the same account everywhere — sign in to all your devices with the same account. A different account means a different tailnet
• Two devices or more — you need something to connect to. This guide uses a Windows PC at home plus a Mac and a phone

Official download links are below. The current version at the time of writing was 1.102.4.

Your account is created automatically the first time you sign in from the app. You can also create it in a browser first (login.tailscale.com/start).

Signing up with an email address on a company domain starts a 14-day trial of the Enterprise plan. To try it for yourself, use a personal account such as Gmail.

Start with the machine you'll connect to: the Windows PC at home.

There are three ways to get Tailscale for Mac. Tailscale recommends the standalone version from its own site: updates arrive without waiting for App Store review, and nothing is restricted. If you'd rather keep it simple, the Mac App Store version is fine too.

Once signed in, the menu bar icon lets you connect, disconnect and see your devices. Since March 2026 the windowed interface shown at the top of this article has been generally available too, which helps when the menu bar icon is hidden behind a MacBook's notch.

With the App Store version, steps 02–03 are replaced by simply allowing the VPN configuration. Tailscale notes that the App Store version can clash with Screen Time's web content filter.

A phone can use only one VPN at a time. Turning on another VPN app, such as a work VPN or an ad blocker, disconnects Tailscale.

Open the admin console in a browser (Machines in the admin console) to see every device on your tailnet. This is where all the settings live.

• ADDRESSES — each device's 100.x address. The “∨” next to it lets you copy it along with the MagicDNS name
• LAST SEEN — a green Connected means online; otherwise it shows when the device was last seen
• Add device — tells you where to download Tailscale for each OS

Give devices sensible names

Names are generated from each device's hostname (“desktop-7k2…” and so on). Rename them via … at the end of the row → Edit machine name, and connecting by name later becomes much easier.

Turn off key expiry on always-on devices

For security, each device's key expires (after 180 days on new tailnets) and you have to sign in again. If the home PC you use remotely expires, you're locked out until you get home. For machines like that, use … → Disable key expiry.

1. Check that it works

On Windows, in Command Prompt or PowerShell; on a Mac, in Terminal after installing the CLI from the app's settings:

# List devices on the tailnet (address, name, OS, status)
tailscale status

# Can I reach it over Tailscale, and is it direct or relayed?
tailscale ping my-nas
pong from my-nas (100.88.4.5) via 203.0.113.9:41641 in 9ms   ← direct
pong from my-nas (100.88.4.5) via DERP(tok) in 38ms         ← relayed

Example output. Even if it stays “via DERP” you can still communicate, and after a few tries it often switches to direct.

2. Connect by name (MagicDNS)

In a browser or app you can type the device name instead of an IP address. For a NAS admin page, something like http://my-nas:5000 in the address bar is all it takes.

3. Use your home Windows PC remotely (Remote Desktop)

No port forwarding at all. Remote Desktop's port 3389 is never opened to the internet.

4. Send files between your devices (Taildrop)

Taildrop is still an alpha feature, so first turn on Send Files under Settings → General in the admin console. On a Mac, also enable Tailscale under System Settings → General → Login Items & Extensions → Sharing.

• Sending — Mac: right-click in the Finder → Share → Tailscale / Windows: right-click → Send with Tailscale / iPhone and Android: the Share button → Tailscale
• Receiving — on Mac and Windows, files go to Downloads; on iPhone and Android, open them from the notification
• Limit — only between your own devices (not to other people's, even on the same tailnet)

5. Route your traffic through home when you're out (exit node)

While using an exit node, your home connection's speed is the ceiling. To keep using local devices where you are, such as a printer, turn on Allow local network access.

• Remove devices you no longer use — for a sold or lost device, choose … → Remove in the console. Its key is revoked immediately
• What if Tailscale goes down? — if the coordination server is unavailable, connected devices keep talking, but you can't make new connections or change settings
• If you want to run everything yourself — there is an open-source, compatible coordination server you can host (Headscale). The upkeep is then yours