Tailscale is a managed mesh VPN that wraps the WireGuard protocol in an automated key-exchange and identity layer, creating a private network — called a tailnet — that spans all your devices without manual VPN configuration. Because WireGuard tunnels are extremely lightweight, Tailscale builds a full point-to-point mesh rather than the hub-and-spoke topology of legacy VPNs: every device talks directly to every other device, with encrypted relays (DERP) kicking in only when NAT traversal cannot establish a direct path. The key insight for practitioners is that Tailscale separates the control plane (key coordination via login.tailscale.com) from the data plane (direct WireGuard tunnels), so the control plane carries almost no traffic while data flows peer-to-peer at near-native speeds.
What This Cheat Sheet Covers
This topic spans 19 focused tables and 158 indexed concepts, 120 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Architecture and Core Concepts
Understanding Tailscale's layered design — WireGuard encryption, a coordination server for key exchange, NAT traversal via STUN/ICE, and DERP relays as a fallback — is the foundation for every feature and troubleshooting step that follows.
| Concept | Example | Description | |
|---|---|---|---|
All your devices share the yak-bebop.ts.net domain | • Your private network of all Tailscale-connected devices • every device on the tailnet can reach every other device according to your ACL policy | ||
wg show tailscale0 shows active peer tunnels | • Tailscale uses WireGuard (specifically wireguard-go) for end-to-end encrypted tunnels• private keys never leave the local device. | ||
login.tailscale.com exchanges public keys | • A central key drop-box (control plane) that distributes public keys and policy to all nodes • it carries almost zero traffic — only metadata | ||
Node A connects directly to node B without a gateway | • Every node gets WireGuard tunnels to every other permitted node • no central traffic bottleneck unlike hub-and-spoke VPNs | ||
Two nodes behind separate CGNAT routers connect directly | • Tailscale uses STUN and ICE standards to punch through firewalls • works even when both nodes are behind NAT with no open ports. | ||
tailscale netcheck shows relay latency to nyc.relay.tailscale.com | • Designated Encrypted Relay for Packets — HTTPS-based fallback relay when direct connection is blocked • DERP servers cannot decrypt traffic since it is WireGuard-encrypted | ||
Another tailnet node acts as relay for two nodes that cannot reach each other | • A newer relay type using other devices in your tailnet instead of Tailscale-operated DERP servers • lower latency, tried before DERP fallback | ||
100.78.43.12 assigned to your laptop | Each device gets a stable Carrier-Grade NAT (100.64.0.0/10) IPv4 address that never changes, regardless of physical location or network. | ||
curl http://100.100.100.100 returns local Tailscale metadata | A special local address that runs Tailscale's built-in DNS resolver and metadata service on every node. | ||
monitoring.yak-bebop.ts.net | • Your tailnet has a unique .ts.net domain• MagicDNS uses this for automatic hostname resolution across the tailnet | ||
Traffic between two nodes encrypted by their WireGuard keys alone | Even when relayed through DERP, no intermediary can decrypt packets — only the two communicating devices hold the private keys. | ||
ACLs explicitly allow only group:devops to reach tag:prod | Tailscale implements per-connection identity-based access control enforced by each node's packet filter, not by a central firewall. |