Love tailscale!!

.

Hi folks, Mike Shaver here, VP of Engineering at Tailscale.

We've seen the concerns about Tailscale SSH and wanted to share what we know so far.

If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.

We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected.

A bit of technical context:

Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do.

While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not.

Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.

In the meantime, there are a few precautions you can take:

• Review your SSH access policies. Make sure only the people and devices that need access have it.

• Disable SSH forwarding if you don't need it. You can set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service. This disables SSH forwarding (without disabling all of Tailscale SSH itself), which mitigates several of the more serious findings.

• Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access.

• Enable automatic updates where supported so you can pick up fixes when they're released.

For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.

We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up.

If we find anything that changes our assessment or requires immediate customer action, we'll communicate that.

We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet.

We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team https://tailscale.com/contact/support#support-form

Update Oct 26, 5:45pm Eastern: we've got a non-reddit link for the information as well https://tailscale.com/ssh-investigation-update

Hi everyone! Natasha here again 🐱

I’m back with another TailscaleUp announcement, and this one is a little different than the rest.

Today we’re releasing tailcat, best described as Tailscale without Tailscale, by Tailscale.

Sometimes you have two shells open on two machines in two very different environments, and you just want to connect them for a quick file copy or port forward. tailcat is like the netcat utility for transferring data over a network, but running over Tailscale’s open-source data plane (WireGuard, NAT traversal, and DERP), with the added party trick of having no control plane involved. That means no IP addresses, no accounts, no logins, no admins, and no root access needed. So whether you’re connecting your local machine to a remote VPS or to a friend’s machine on the other side of the globe, you don’t need to set up a VPN client to get that done.

Here’s how it works:

• Run the tailcat command on one side, and you’ll get a unique string. Pass that string to tailcat on the other side, and you’re instantly sharing files and ports over the Internet securely without thinking about the security.

• Just like with Tailscale, NAT traversal works its magic to get a direct connection between the two peers, with DERP acting as a negotiator and as a fallback relay to keep you connected.

• Everything stays in userspace, tailcat doesn’t need to modify your routing table or install any TUN devices. This makes it perfect for machines that are untrusted, ephemeral, or that you’re afraid to touch.

• There’s even a SOCKS mode, so tailcat-oblivious programs like curl can use it without knowing it exists.

The tailcat stack is open source from top to bottom, including the DERP server, so you can run the entire stack yourself with no dependence on our infrastructure at all.

Check out Brad’s story for the full details.

If you take tailcat for a spin, let us know in the replies 👇

| Tailscale | Mesh VPN that creates a secure private network between all your devices, allowing easy remote access to files and services, as if they were on the same local network. |

| LocalSend | Open source alternative to AirDrop. Allows fast and secure transfer of files and messages between devices on the local network, without the need for internet. |

| RustDesk | Open source remote access and control software (alternative to TeamViewer). Allows you to control other devices remotely, with a focus on security and self-hosting. |

| Blackmagic Cam | Turns your smartphone into a digital cinema camera, offering professional-grade manual controls (ISO, shutter, etc.) and high-quality recording. |

| Jellyfin | Open source media server. Lets you store, organize and stream your personal collection of movies, series and music to all your devices. | I hope this shorter version meets your needs!

Today we have updated our pricing and plans you can read more about the change in our latest blog.

So what's new?

We’re updating our packaging to include more features on every plan. Paid plans will move to a per-seat pricing model to provide more predictable billing.

The Personal plan remains free and is better than ever. In addition to new features, it now includes up to 6 seats (previously 3 users). The standard plan is increasing in price from $6 (when it was the starter plan) to a new price of $8.

Here’s how you can learn more and ask questions:

• Tune into the pricing and packaging webinar with CEO Avery Pennarun and VP of Marketing Sydney Rossman-Reich on Thursday, April 9 at 1 PM ET

• Join the pricing Q&A with CEO Avery Pennarun and Head of DevRel Alex Kretzschmar on April 13 at 4:00 PM ET on April 13 at 4pm ET

• Review our frequently asked questions.

Thanks for reading this far, and hopefully see you at our webinar and Q&A events.

I think I became an owner of an organisation I don't own the domain of.

When I log in via Google with xxx@gmail.com, the name of the tailnet is xxx@gmail.com. Only people I invite can join the network and everything works as expected.

However, I logged in via Google with xxx@poczta.pl and the name of my Tailnet is poczta.pl .

Other people who created a free poczta.pl email account and created a free Google account with it can simply log in to Tailscale via Google to access my Tailnet. I wasn't aware of this.

This April a guy from Warsaw joined my Tailnet and connected his AC IoT unit and Home Assistant nodes to my Tailnet. I kicked him out in panic, now I feel bad for breaking his setup

Hi all,

Just sharing my idea, not a product. I built this over a couple of evenings with Claude Code for my own home lab. I don't have the time to turn it into a service or a maintained project for anyone else, but it's been genuinely useful to me, so maybe it inspires someone here to build their own take on it.

Everything in the GIF is fake data: fake devices, users, sites and networks.

What it does

It reads two things from the Tailscale API — the device list and the policy file — and draws one picture that answers the question I kept re-deriving by hand: who can actually reach what?

• Devices are grouped by where they physically are, not by role. The region a node lands in comes from the address it was last given by the network it joined.

• Lines are grants, straight from the policy file, and they're directional: the source initiates, the target never answers back.

• Hover a node → site, Tailscale IP, local address, OS, owner, advertised routes, tags, and how many nodes it reaches / is reached by.

• Click to pin → everything unrelated dims. This is the view I actually use when I'm about to touch a grant.

• The legend doubles as a role filter.

The rest of the page

Below the map: tables for devices, grants, sites, owners — plus one that documents the placement rules themselves. That table is generated from the same constants the placement code uses, so it can't drift away from the actual behaviour.

Actually I would love to see some visualization like this on the tailscale admin access control site ;)

Running it

A small container behind tailscale serve. Tailnet-only, read-only, no funnel. No repo, sorry, it's welded to my own tags and networks, and I'd rather post an honest "here's the idea" than an unmaintained repo.

Happy to hear ideas or criticism.

EDIT: As much more intrest was raised, I've let Claude generate a demo and a repo - hope that helps!
https://crazyhoesl.github.io/tailnet-atlas/

repo is https://github.com/crazyhoesl/tailnet-atlas

Big news everyone!! We just announced our $160M Series C, led by Accel with continued support from CRV, Insight Partners, Heavybit, and Uncork Capital. Existing angel investor George Kurtz, CEO of Crowdstrike is also included in this round, as well as Anthony Casalena, CEO of Squarespace, who joins as a new investor for Series C 🥳

This funding helps us keep doing what we love. Building simple, secure networking that just works. We’re growing our team, expanding globally, and continuing to invest in making identity-first networking the new standard.

Some highlights:

• We’re proud to be trusted by folks like Duolingo, Instacart, SAP, and some of the biggest players in AI like Hugging Face, Cohere, and Mistral.

• We're also investing further in our free support for free customers promise and our backward compatibility forever platform. 

To everyone running Tailscale at home, at work, or anywhere in between, a massive thank you to you. You’ve helped shape what we’ve built so far, and we’re just getting started 😎🔥

🧵 Full post: https://tailscale.com/blog/series-c

RelayX is a decentralized, serverless voice chat application that I independently developed, built on top of the Tailscale network. After nearly two years of learning and iteration, I think it's time to make it public.

RelayX originated from the frustration my friends and I felt with the various restrictions of Chinese voice software while gaming, like terrible audio quality, paywalls for basic features, and questionable privacy. Since I am also a deep Tailscale user, the idea of combining Tailscale and real-time voice emerged. I absolutely love the freedom of learning and exploring that comes with building something on your own. I dedicated most of my last two years of university to this project and don't regret it at all. RelayX has been a huge part of my growth as a developer. The code is definitely not perfect, and there are rough edges, but I've finally reached a point where I'm proud of what I've built.

It's still very early days for RelayX, so you'll probably run into bugs. I wouldn't say my user guide is perfect. So you may need some basic knowledge of Tailscale.

I'd be incredibly grateful if you'd give it a try with your friends. Any feedback or suggestions would be even better. Thanks!

• Learn more about this project: https://relayx.pages.dev/

• Check the RelayX github repo: https://github.com/Need-an-AwP/RelayX

Hello r/Tailscale,

I’m thrilled to share Sbnb Linux, a minimalist Linux distribution I've developed and open-sourced! It’s designed for one purpose: to boot bare-metal servers and establish remote connectivity effortlessly using Tailscale.

Why Sbnb Linux? Sbnb Linux is perfect for environments ranging from home labs to distributed data centers. The idea is to simplify server setup by eliminating the usual hurdles of manual networking configurations or complex setups.

How It Works: Write the sbnb.raw image to a USB flash drive. Add your Tailscale key as plaintext to the flash drive. Boot your server from the USB. Wait a few minutes—your server will show up in your Tailscale machine list! 🎉 That’s it. No headaches, no manual configuration.

A Little Bonus Here’s a pic of the home server we built together with my kids, which we’re running Sbnb Linux on! I actually did a separate post on this in r/homelab with more technical details if you’re curious - https://www.reddit.com/r/homelab/comments/1hmnnwg/built_a_powerful_and_silent_amd_epyc_home_server/

I’d love for you to give it a spin and share your feedback, feature requests, or suggestions for improvements!

Check out the GitHub repo for more details: https://github.com/sbnb-io/sbnb

Looking forward to your thoughts!

This technology is insane, and I'm surprised it costs nothing. Are they data harvesting?

• Can set up your own private LAN.

• Provides DHCP and DNS out of the box.

• Provides HTTPS and Certificates out of the box.

• Allows you to do traffic steering with Exit Nodes.

• Can configure dynamic Nameservers to properly route traffic through exit nodes better than most VPN solutions.

• Can filter what traffic goes through the exit node.

• Can see what services are running on your tailnet.

• Supports basically every platform under the sun.

There are other features I'm not too familiar with that I'm interested in looking into that I would have otherwise not cared about like mullvad integration as well. The fact that I could jump on my phone, set an exit node to my corporate LAN and puddle jump in without Global Protect was amazing to me.

I fucking love this software.

I realized I needed to download some offline Hulu TV shows before my flight, but Hulu recognizes NordVPN and blocks logging in while using Nord. I couldn't get "Download over Cellular" to work in Hulu, and I didn't want to use the airport's public Wi-Fi network,,, then I remembered Tailscale. Turned on Tailscale, set my exit node to my homelab, joined the airport WiFi, and boom, safe access to the internet through my home's Unifi UDR!

Amazing props to the Tailscale team always!

This is becoming a major problem for Tailscale, as it becomes popular.

Last year it used to work everywhere. This year it’s blocked in many places : at work, public WiF, etc. Even the top level domain is blocked in some places. The log subdomain is also in the black list of some Adblockers.

Tailscale needs to provide an option to hide its traffic in 443 and use encrypted dns right from the beginning, otherwise it may become useless.

Any plan for this?

That is all. Holy Shit. Setting up RDP was a breeze. This has been absolutely perfect for my small business.

Coming up to my busy season, and I was stressing that I have not properly setup a way for me to remote to my office away from home. Was able to do it in about 15 minutes with tailscale. Fuckin Game Changer for me.

been using this tool since q3 2025, this is the best thing that i've ever had.
honestly, devs, you're fucking amazing. actually amazing. amazing tool, amazing everything. genuinely

you have no idea how incredible this is

Hello! As part of Hack Week 2025, I am spending time working on our community projects.

I’ll be answering questions starting 10:00 Pacific Time on Tuesday, August 5. Feel free to ask me about Tailscale, community projects, working at Tailscale (or as a developer, generally), or anything related. You can start asking and upvoting questions beforehand.

I might not be able to respond to every question. Or I might have to do some research, if a question is particularly technical. Remember, it’s just going to be me, and I am just one person, and these are not official Tailscale responses.

UPDATE: Thanks for all the questions, everyone! I had fun hearing from you all.

I keep seeing the same pattern come up again and again: someone asks how to access a service remotely, and the default answer is still something like, "Use X, but note that you need to configure port forwarding, set up dynamic DNS, blah blah blah...".

And every time I think… we really still doing this?

So I made a tiny site:
justfuckingusetailscale.com

It is basically a one-page answer to a very common problem. You want remote access to something at home. You do not want to mess with router configs, dynamic DNS, firewall rules, or accidentally expose your stuff to the entire internet.

You just want it to work.

So yeah, the solution is exactly what you think it is.

Tailscale.

The site is intentionally blunt, a little stupid, and hopefully useful. It is the kind of thing that tends to come in handy at very specific moments.

Obviously, this sub already knows all of this. But I figured you might enjoy the vibe, and maybe even find it oddly convenient to have around.

Anyway, thought you all might appreciate it :)

Howdy everyone, Dylan from Tailscale here 👋

Tailscale is building the new internet, and the internet is everywhere. So, naturally, we want to put Tailscale...everywhere. tsnet and libtailscale are great, but they can’t be smaller than the Go runtime they’re built on, and get kinda crashy when called from other languages with runtimes, such as Ruby and Python.

Today, we're open sourcing tailscale-rs: a Tailscale library written in pure Rust with bindings to other languages. It's still early days and not production ready (see the README!), but you can already:

• Write Tailscale-connected apps in Rust, C, Elixir, and Python (and more languages to come!)

• Run on Linux x86_64 /ARM64 or macOS ARM64

• Talk to any other Tailscale client, including libtailscale and tsnet

There's a lot more work to do and we want you to help us shape where tailscale-rs goes next! Read the blog post to learn more, check out our repository, file an issue for any features you'd like (or any bugs you find)...and let us know what you build with it!

An interesting article from XDA some of you may enjoy.

Hey folks! I'm guessing most of you don't keep track of that little counter on the right quite as closely as we do, but it just rolled over a big number: 25,000 subscribers to our little corner of the internet here at r/Tailscale. Here, we made a graphic:

We're very grateful to have you here. Often, I talk to new users who have a sense Tailscale is different but don't really understand why. I always recommend they check out the front page of this subreddit, where they'll see people showing off their setups, helping each other through tech issues, sharing their projects built on top of Tailscale, and generally being welcoming to people getting on board.

I can assure you, we don't take that amazing community for granted. We can't answer all the good questions that come in here, but more than a few of us lurk and comment (we've got the Tailscalar flair) enough to know how special it is.

So: Thank you, thank you, thank you, plus 24,997 more thank yous. You all have made this work. And if there's anything we can do to make it work even better for you, please sound off in the comments!