Tailscale is a mesh VPN built on WireGuard. Every device you enroll gets a stable private IP in the 100.64.0.0/10 CGNAT range, and devices can talk to each other directly over an encrypted tunnel — no port forwarding, no public IP needed.
What you get
- Stable private IPs per device, regardless of LAN or cellular changes.
- Encrypted point-to-point tunnels (WireGuard) without per-device key management.
- NAT traversal "for free" — devices behind home routers find each other.
- MagicDNS — hostnames like
my-mac.tailnet-name.ts.netresolve inside the tailnet. - An auth boundary — only devices that signed in via your identity provider (Google, GitHub, etc.) can join.
What you don't get
- Per-user authentication inside the tailnet. Once a device is in, it is in — no per-app login.
- Application-layer authorization. Tailscale doesn't know what your app is or who should access which routes.
- Lost-device protection (automatic). Until you manually revoke a device, its key is valid.
- Strong defense against a compromised endpoint. If malware on your laptop wants to access your tailnet, it just does — the OS holds the key.