C.W.K.
Stream
Lesson 01 of 05 · published

What Tailscale Actually Is (and Isn't)

~15 min · tailscale, wireguard, mesh-vpn

Level 0Greenhorn
0 XP0/53 lessons0/14 achievements
0/100 XP to next level100 XP to go0% complete

Tailscale is a mesh VPN built on WireGuard. Every device you enroll gets a stable private IP in the 100.64.0.0/10 CGNAT range, and devices can talk to each other directly over an encrypted tunnel — no port forwarding, no public IP needed.

What you get

  • Stable private IPs per device, regardless of LAN or cellular changes.
  • Encrypted point-to-point tunnels (WireGuard) without per-device key management.
  • NAT traversal "for free" — devices behind home routers find each other.
  • MagicDNS — hostnames like my-mac.tailnet-name.ts.net resolve inside the tailnet.
  • An auth boundary — only devices that signed in via your identity provider (Google, GitHub, etc.) can join.

What you don't get

  • Per-user authentication inside the tailnet. Once a device is in, it is in — no per-app login.
  • Application-layer authorization. Tailscale doesn't know what your app is or who should access which routes.
  • Lost-device protection (automatic). Until you manually revoke a device, its key is valid.
  • Strong defense against a compromised endpoint. If malware on your laptop wants to access your tailnet, it just does — the OS holds the key.

External links

Exercise

Open Tailscale admin (login.tailscale.com → Machines). For each device listed, write down: when it last connected, its key expiry date, and which user added it. Anything that hasn't been online in 90 days is a candidate for removal — fewer enrolled devices = smaller blast radius if one is compromised.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.