Tailscale + SSH workflow

What a mesh network reduces and what it leaves

Tailscale uses WireGuard to create encrypted paths between devices and coordinate NAT traversal. It can reduce public port forwarding, but it does not automatically secure service binding, firewalls, ACLs, application authentication, or recovery.

Setup

brew install --cask tailscale
open -a Tailscale
# Sign in with the approved identity on each device

After sign-in, each device appears in the admin console with a 100.x address and a hostname such as office.tailnet.ts.net. Verify the device identity before trusting a memorable name.

SSH over Tailscale

Once routing is ready, connect with a Tailscale address or hostname without exposing a public SSH port. An OpenSSH alias can keep the target explicit:

Host office
  HostName 100.x.x.x
  User your_username
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

The same alias works with ssh office, scp file office:, and rsync ... office: for clients that read OpenSSH configuration.

Tailscale SSH is a separate authentication model

Tailscale SSH can authorize access through tailnet identity and policy. It has a different policy owner and audit path from ordinary OpenSSH keys, so choose one deliberately and document its ACLs, recovery path, and verification method.

Use MagicDNS for names

MagicDNS lets clients use a hostname such as office instead of memorizing a 100.x address. DNS provides naming, not authorization; confirm the current device and role in the admin console before sensitive work.

Why this belongs in a terminal quest

Even a two-device workflow becomes easier to repeat when stable names, SSH, scp, and rsync share one reviewed connection contract. The source of truth, transfer direction, and recovery owner still belong to an operating procedure outside the network tool.

Separate reachability from authorization

A device joining the tailnet creates a route; it does not grant every user permission to every service. Design least-privilege ACLs by identity, source device, destination, and port, and retire stale device keys.

A correct name can point to a changed host role

Names are easier to remember, but migrations and recovery can make the same name point to a different machine. Verify the host identity and service health before changing state.

Private routing still needs policy

A mesh address does not remove host-key checks, service exposure boundaries, logging, or an independent recovery path. Bind services narrowly and keep the access policy reviewable.