Tailscale is a WireGuard-based private networking client that connects authorized devices across different networks, enabling remote access to servers, desktops, applications, and selected local resources through encrypted connections.
Tailscale creates a private network between computers, servers, and other devices using WireGuard encryption. After devices join the same network, called a tailnet, users can reach permitted services through stable private addresses rather than exposing those services directly to the internet. It is useful for remote desktop access, development servers, home labs, and connections between cloud environments. The service coordinates device discovery and distributes connection information, while clients establish encrypted paths for application traffic. Direct connections are preferred, but encrypted relays remain available when network conditions prevent them. This separates network connectivity from the particular file-transfer, database, or administration tools users already rely on.
Tailscale provides network reachability, not the application or account permissions required by the destination service. An administrator must still enable the server, configure its firewall, and authorize the intended users. Cyberduck can connect to an SFTP server over the private network using its assigned address or MagicDNS name. Normal internet browsing keeps its existing route unless an exit node is explicitly selected. Subnet routers extend access to devices that cannot install the client, but routes and access rules must be approved appropriately. Review the initial tailnet policy before inviting colleagues because its default configuration allows broad communication between enrolled devices.
Tailscale makes private resources easier to reach from changing locations without repeatedly rebuilding remote-access settings. A laptop moving between home, office, and mobile networks can keep using the same device addresses and names, reducing changes to saved connections and administrative tools. For small teams, centralized policy provides a practical way to describe who should reach which services instead of managing separate network exceptions on every router. Existing applications remain usable because the network carries their normal traffic rather than replacing their interfaces. Administrators can also extend access to selected legacy equipment through a subnet router instead of installing software on every endpoint. When a direct connection fails, an encrypted relay can preserve access, although performance may decrease. These capabilities reduce routine connectivity work, but endpoint updates, application authentication, and carefully scoped permissions are still essential. Tailscale simplifies establishing the path; it does not make every service or connected device trustworthy.
Key capabilities and highlights.
Tailscale establishes WireGuard-encrypted connections between enrolled devices and attempts direct communication through network address translation. When direct connectivity is unavailable, traffic can pass through a configured peer relay or a DERP relay. Encryption remains between the communicating devices, so relay servers forward encrypted packets rather than readable application traffic.
Administrators define access using users, groups, device tags, destinations, and permitted network services. Grants provide the recommended policy syntax, while existing ACL configurations remain supported. Tailscale applies these rules to connections between devices, allowing an organization to restrict a contractor to selected resources instead of granting unrestricted network access.
MagicDNS automatically assigns DNS names to enrolled devices so users can connect with recognizable machine names instead of memorizing private addresses. It updates names when a device is renamed and supplies a full tailnet domain name. This makes saved server connections and command-line administration easier to read and maintain.
A subnet router advertises selected network ranges so authorized devices can reach resources without installing a client on each destination. This supports equipment such as printers, appliances, and existing private servers. Administrators must configure forwarding, approve advertised routes, and set access policies; the router becomes the connection point into that network.
An approved exit node can carry a device's public internet traffic through another enrolled machine. Each client explicitly selects this routing mode rather than enabling it automatically. Tailscale also provides a separate local-network access option, allowing users to decide whether nearby resources remain reachable while an exit node is active.
Run Unattended mode keeps the Windows connection available when no user is logged into the desktop. This is useful for machines reached through remote administration tools after a restart or sign-out. The computer must remain powered on and network-connected, and the destination application still needs its own permissions and configuration.
Tailscale lets users share an individual machine with someone outside their own tailnet rather than inviting that person into the entire network. The recipient accepts a sharing invitation, and applicable access policies govern connectivity. This supports limited collaboration around a specific server without automatically exposing other enrolled machines or routed networks.
Built-in command-line diagnostics help determine whether a peer connection is direct or relayed and identify network conditions affecting connectivity. The status command reports peer information, while netcheck examines the network environment. These tools help distinguish routing and firewall problems from failures in the remote application itself during troubleshooting.
Browse historical releases and previous builds.
Common questions about Tailscale.
Not by default. It normally carries traffic for the private network while public internet browsing uses the existing connection. Routing general internet traffic through the network requires selecting an approved exit node.
Usually not. NAT traversal and relay connections let devices communicate through many existing routers and firewalls. Restrictive networks can prevent direct connections, leading to relayed traffic and potentially lower throughput. Local firewall rules and the destination service must still permit the intended connection.
No. Much of the client networking code is open source, but the official Windows graphical interface and hosted coordination service are not fully open source. The supplied BSD-3-Clause classification should not be interpreted as covering every component of the commercial service.
No. It supplies private network connectivity; you still need a remote desktop server and compatible client. Enable the remote desktop service, authorize the user, and permit the connection through both the tailnet policy and the destination computer's firewall.
Released August 19, 2026, this update fixes Windows upgrade failures involving spaces in the user's home-directory name, improves handling when IPv6 or NetBIOS is disabled, corrects a MagicDNS forwarding issue, and addresses a security vulnerability involving host-scoped IPv4 destinations.
Tailscale is a WireGuard-based private networking client that connects authorized devices across different networks, enabling remote access to servers, desktops, applications, and selected local resources through encrypted connections.
Microsoft.Azure.ArtifactSigningClientTools is the Windows package that installs the Artifact Signing client plugin, letting SignTool sign code and artifacts through Azure without a local certificate.
Microsoft Safety Scanner is a free, portable on-demand scanning tool from Microsoft that finds and removes malware, spyware, and unwanted software from Windows PCs without installing anything.
1Password CLI is a command-line tool that reads secrets from a 1Password account and injects them into scripts, environment variables, and configuration files at runtime, so no plaintext credential has to be stored on disk.
Remote Desktop is the Microsoft client for connecting to remote PCs, cloud desktops, and published applications over the Remote Desktop Protocol. It lets people work in a full desktop environment from another device, with local printers, drives, and audio available during the session.
Comments