1<!DOCTYPE html><html><head><meta charSet="utf-8"/><title>Blog | Tailscale</title><meta name="robots" content="index,follow"/><meta name="description" content="Updates on innovations and the state of virtual private networks - globally, as well as Tailscale product and company news."/><meta property="og:title" content="Blog | Tailscale"/><meta property="og:description" content="Updates on innovations and the state of virtual private networks - globally, as well as Tailscale product and company news."/><meta property="og:url" content="https://tailscale.com/blog"/><meta property="og:image" content="https://tailscale.com/api/og-image?id=6ebebdd7-d862-4b40-b9aa-ce389f0471ca"/><link rel="canonical" href="https://tailscale.com/blog"/><link rel="alternate" type="application/rss+xml" href="https://tailscale.com/blog/index.xml"/><link rel="alternate" type="application/rss+xml" href="https://tailscale.com/changelog/index.xml"/><link rel="alternate" type="application/rss+xml" href="https://tailscale.com/security-bulletins/index.xml"/><meta name="viewport" content="initial-scale=1.0, width=device-width, maximum-scale=1"/><link rel="icon" href="/favicon.png" type="image/png"/><link rel="icon" href="/favicon.svg" type="image/svg+xml"/><meta name="msapplication-TileColor" content="#492847"/><meta name="theme-color" content="#ffffff"/>
1<script async="" src="https://bwa.marketplace.awsstatic.com/assets/partner.js"></script>
1<meta name="twitter:card" content="summary_large_image"/><meta name="twitter:title" content="Blog | Tailscale"/><meta name="twitter:image" content="https://tailscale.com/api/og-image?id=6ebebdd7-d862-4b40-b9aa-ce389f0471ca"/><meta name="twitter:description" content="Updates on innovations and the state of virtual private networks - globally, as well as Tailscale product and company news."/><meta name="twitter:site" content="@tailscale"/><meta name="next-head-count" content="23"/><link rel="preload" href="/_next/static/media/97a52bce187043ec-s.p.woff2" as="font" type="font/woff2" crossorigin="anonymous" data-next-font="size-adjust"/><link rel="preload" href="/_next/static/media/e4af272ccee01ff0-s.p.woff2" as="font" type="font/woff2" crossorigin="anonymous" data-next-font="size-adjust"/><link rel="preload" href="/_next/static/css/86b4149a58d43333.css" as="style"/><link rel="stylesheet" href="/_next/static/css/86b4149a58d43333.css" data-n-g=""/><link rel="preload" href="/_next/static/css/9eee414ec9ffd447.css" as="style"/><link rel="stylesheet" href="/_next/static/css/9eee414ec9ffd447.css" data-n-p=""/><noscript data-n-css=""></noscript>
1<script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script>
1<script src="/_next/static/chunks/webpack-4855b3d7a1e839a0.js" defer=""></script>
1<script src="/_next/static/chunks/framework-5c59b3faca784f4c.js" defer=""></script>
1<script src="/_next/static/chunks/main-fc51a042ada8f325.js" defer=""></script>
1<script src="/_next/static/chunks/pages/_app-eb0837587ebacb04.js" defer=""></script>
1<script src="/_next/static/chunks/47397-1c0811c5767dd37e.js" defer=""></script>
1<script src="/_next/static/chunks/48354-1c6772f2b5b4e807.js" defer=""></script>
1<script src="/_next/static/chunks/63448-1e4bb16637393fff.js" defer=""></script>
1<script src="/_next/static/chunks/88556-68c54805ab62c57a.js" defer=""></script>
1<script src="/_next/static/chunks/18148-b3a292a7f5ac3aa6.js" defer=""></script>
1<script src="/_next/static/chunks/92099-96e43f041b450de0.js" defer=""></script>
1<script src="/_next/static/chunks/84328-88d7cfb3810d9315.js" defer=""></script>
1<script src="/_next/static/chunks/5769-1cedfa3b2729bc08.js" defer=""></script>
1<script src="/_next/static/chunks/92232-bf8aa8e0f7aae002.js" defer=""></script>
1<script src="/_next/static/chunks/16772-90c6cc12c1a6b34b.js" defer=""></script>
1<script src="/_next/static/chunks/48955-b5f6a360aa923376.js" defer=""></script>
1<script src="/_next/static/chunks/pages/blog-d918e36c9a1f9427.js" defer=""></script>
1<script src="/_next/static/Nt7ie1oVhelppcz9-73LX/_buildManifest.js" defer=""></script>
1<script src="/_next/static/Nt7ie1oVhelppcz9-73LX/_ssgManifest.js" defer=""></script>
1<style id="__jsx-459994682">:root{--font-inter:'__Inter_98cf97', '__Inter_Fallback_98cf97';--font-mdio:'__MDIOFont_8d6c39', '__MDIOFont_Fallback_8d6c39'}</style></head><body><div id="__next"><!--$--><!--/$--><div class="sticky top-0 z-[20000]"><div class="z-[20000] w-full p-4 font-mdio text-xs uppercase !tracking-[0.6px] xl-small:p-1.5 bg-gray-700 text-white"><div class="mx-auto flex w-full max-w-[1360px] items-center justify-center px-6 xl-small:max-w-[1440px] xl-small:justify-between xl-small:px-16"><div><a class="group flex flex-wrap items-center justify-center gap-x-2 text-pretty pt-0.5 text-center font-medium text-white sm:text-left" href="https://tailscale.com/tailscaleup-date-week-26"><span class="hidden sm:block"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" style="color:#BE8FE1" aria-hidden="true"><path d="M12 3L10.088 8.813C9.99015 9.11051 9.82379 9.38088 9.60234 9.60234C9.38088 9.82379 9.11051 9.99015 8.813 10.088L3 12L8.813 13.912C9.11051 14.0099 9.38088 14.1762 9.60234 14.3977C9.82379 14.6191 9.99015 14.8895 10.088 15.187L12 21L13.912 15.187C14.0099 14.8895 14.1762 14.6191 14.3977 14.3977C14.6191 14.1762 14.8895 14.0099 15.187 13.912L21 12L15.187 10.088C14.8895 9.99015 14.6191 9.82379 14.3977 9.60234C14.1762 9.38088 14.0099 9.11051 13.912 8.813L12 3Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M5 3V7" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M19 17V21" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M3 5H7" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M17 19H21" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path></svg></span>See everything you missed at TailscaleUp.<span class="pl-2 text-gray-0/80 underline group-hover:no-underline">Read the recap â</span></a></div><nav class="hidden xl-small:block"><ul class="flex gap-6"><li><a class="block py-3.5 font-medium text-gray-0/80 hover:underline" href="/blog">Blog</a></li><li><a class="block py-3.5 font-medium text-gray-0/80 hover:underline" href="/docs">Docs</a></li><li><a class="block py-3.5 font-medium text-gray-0/80 hover:underline" href="/download">Download</a></li><li><a class="block py-3.5 font-medium text-gray-0/80 hover:underline" href="/contact/sales">Contact Sales</a></li></ul></nav></div></div><header class="bg-white transition-colors duration-300"><div class="mx-auto flex h-[75px] w-full max-w-[1360px] items-center justify-between gap-[4px] px-6 md:max-w-[1440px] lg:px-16"><a href="/"><svg width="145" height="28" viewBox="0 0 145 28" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M3.5 17.5C5.43299 17.5 6.99999 15.933 6.99999 14C6.99999 12.067 5.43299 10.5 3.5 10.5C1.567 10.5 0 12.067 0 14C0 15.933 1.567 17.5 3.5 17.5Z" fill="#232222"></path><path d="M14 17.5C15.933 17.5 17.5 15.933 17.5 14C17.5 12.067 15.933 10.5 14 10.5C12.067 10.5 10.5 12.067 10.5 14C10.5 15.933 12.067 17.5 14 17.5Z" fill="#232222"></path><path d="M14 28C15.933 28 17.5 26.433 17.5 24.5C17.5 22.567 15.933 21 14 21C12.067 21 10.5 22.567 10.5 24.5C10.5 26.433 12.067 28 14 28Z" fill="#232222"></path><path d="M24.5 17.5C26.433 17.5 28 15.933 28 14C28 12.067 26.433 10.5 24.5 10.5C22.567 10.5 21 12.067 21 14C21 15.933 22.567 17.5 24.5 17.5Z" fill="#232222"></path><g opacity="0.4"><path d="M3.5 28C5.43299 28 6.99999 26.433 6.99999 24.5C6.99999 22.567 5.43299 21 3.5 21C1.567 21 0 22.567 0 24.5C0 26.433 1.567 28 3.5 28Z" fill="#232222"></path><path d="M24.5 28C26.433 28 28 26.433 28 24.5C28 22.567 26.433 21 24.5 21C22.567 21 21 22.567 21 24.5C21 26.433 22.567 28 24.5 28Z" fill="#232222"></path><path d="M3.5 6.99999C5.43299 6.99999 6.99999 5.43299 6.99999 3.5C6.99999 1.567 5.43299 0 3.5 0C1.567 0 0 1.567 0 3.5C0 5.43299 1.567 6.99999 3.5 6.99999Z" fill="#232222"></path><path d="M14 6.99999C15.933 6.99999 17.5 5.43299 17.5 3.5C17.5 1.567 15.933 0 14 0C12.067 0 10.5 1.567 10.5 3.5C10.5 5.43299 12.067 6.99999 14 6.99999Z" fill="#232222"></path><path d="M24.5 6.99999C26.433 6.99999 28 5.43299 28 3.5C28 1.567 26.433 0 24.5 0C22.567 0 21 1.567 21 3.5C21 5.43299 22.567 6.99999 24.5 6.99999Z" fill="#232222"></path></g><path d="M46.1746 24.5C47.0875 24.5 47.8293 24.4144 48.7137 24.2432V20.9334C48.1717 21.1331 47.5725 21.1902 47.0019 21.1902C45.604 21.1902 45.0904 20.5054 45.0904 19.1929V12.4592H48.7137V9.14945H45.0904V4.24185H41.0962V9.14945H38.5V12.4592H41.0962V19.5638C41.0962 22.7024 42.751 24.5 46.1746 24.5Z" fill="#232222"></path><path d="M55.2368 24.5C57.3766 24.5 58.8031 23.7867 59.5163 22.6739C59.5734 23.159 59.7446 23.8152 59.9728 24.2147H63.5676C63.3679 23.5299 63.2252 22.4456 63.2252 21.7323V13.9144C63.2252 10.6902 60.9143 8.86412 57.0057 8.86412C54.0386 8.86412 51.7277 9.9769 50.4438 11.6033L52.7262 13.8573C53.7533 12.716 55.0657 12.1168 56.6633 12.1168C58.6034 12.1168 59.4593 12.7731 59.4593 13.7432C59.4593 14.5706 58.8887 15.1413 55.8074 15.1413C52.8403 15.1413 49.8447 16.3682 49.8447 19.7921C49.8447 22.9592 52.1271 24.5 55.2368 24.5ZM56.0357 21.4755C54.4951 21.4755 53.7818 20.8193 53.7818 19.6494C53.7818 18.6223 54.6377 17.9375 56.0642 17.9375C58.3466 17.9375 58.9743 17.7948 59.4593 17.3098V18.5367C59.4593 20.163 58.0898 21.4755 56.0357 21.4755Z" fill="#232222"></path><path d="M65.8217 7.23777H69.9871V3.5H65.8217V7.23777ZM65.9073 24.2147H69.9015V9.14945H65.9073V24.2147Z" fill="#232222"></path><path d="M72.8113 24.2147H76.8055V3.95652H72.8113V24.2147Z" fill="#232222"></path><path d="M85.1075 24.5C89.5011 24.5 91.755 22.1888 91.755 19.7636C91.755 17.5666 90.6423 15.9402 86.9905 15.284C84.4228 14.8274 82.8251 14.2568 82.8251 13.3723C82.8251 12.6019 83.7381 12.0598 85.2787 12.0598C86.6481 12.0598 87.7893 12.5163 88.6452 13.5149L91.1844 11.375C89.9005 9.77717 87.7893 8.86412 85.2787 8.86412C81.4271 8.86412 79.0306 10.9185 79.0306 13.4293C79.0306 16.1685 81.5412 17.3954 84.2516 17.8804C86.5055 18.2799 87.7608 18.7079 87.7608 19.678C87.7608 20.5054 86.8763 21.1902 85.1931 21.1902C83.5383 21.1902 82.2545 20.4198 81.6554 19.2785L78.2888 20.8763C79.1162 22.9307 81.9407 24.5 85.1075 24.5Z" fill="#232222"></path><path d="M100.685 24.5C103.538 24.5 105.592 23.3587 107.132 20.7907L103.937 19.1644C103.338 20.3628 102.368 21.1902 100.685 21.1902C98.1455 21.1902 96.7
176 19.1359 96.776 16.6535C96.776 14.1712 98.2311 12.1739 100.685 12.1739C102.225 12.1739 103.252 13.0014 103.851 14.2568L107.075 12.5448C105.991 10.1766 103.851 8.86412 100.685 8.86412C95.4636 8.86412 92.7818 12.6875 92.7818 16.6535C92.7818 20.9619 96.0342 24.5 100.685 24.5Z" fill="#232222"></path><path d="M113.495 24.5C115.635 24.5 117.061 23.7867 117.774 22.6739C117.831 23.159 118.003 23.8152 118.231 24.2147H121.826C121.626 23.5299 121.483 22.4456 121.483 21.7323V13.9144C121.483 10.6902 119.172 8.86412 115.264 8.86412C112.297 8.86412 109.986 9.9769 108.702 11.6033L110.984 13.8573C112.011 12.716 113.324 12.1168 114.921 12.1168C116.861 12.1168 117.717 12.7731 117.717 13.7432C117.717 14.5706 117.147 15.1413 114.065 15.1413C111.098 15.1413 108.103 16.3682 108.103 19.7921C108.103 22.9592 110.385 24.5 113.495 24.5ZM114.294 21.4755C112.753 21.4755 112.04 20.8193 112.04 19.6494C112.04 18.6223 112.896 17.9375 114.322 17.9375C116.605 17.9375 117.232 17.7948 117.717 17.3098V18.5367C117.717 20.163 116.348 21.4755 114.294 21.4755Z" fill="#232222"></path><path d="M123.831 24.2147H127.825V3.95652H123.831V24.2147Z" fill="#232222"></path><path d="M137.411 24.5C140.35 24.5 142.718 23.3301 144.03 21.2473L141.006 19.3071C140.207 20.5625 139.151 21.2473 137.411 21.2473C135.442 21.2473 134.016 20.163 133.645 18.0516H145V16.6535C145 12.6875 142.575 8.86412 137.382 8.86412C132.447 8.86412 129.765 12.716 129.765 16.6821C129.765 22.3315 134.016 24.5 137.411 24.5ZM133.788 14.913C134.415 13.0014 135.728 12.1168 137.468 12.1168C139.437 12.1168 140.635 13.2867 141.034 14.913H133.788Z" fill="#232222"></path></svg></a><div class="flex w-full items-center justify-end gap-3 xl-small:justify-between"><nav class="website-nav m-auto hidden xl-small:relative xl-small:block"><ul class="flex gap-x-[4px]"><li><button type="button" class="flex items-center gap-[4px] rounded-md px-3 py-2.5 text-sm font-medium hover:bg-gray-200">Platform<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></button><div class="pointer-events-none absolute left-1/2 top-full z-[100] mt-3 -translate-x-1/2 pt-4 opacity-0"><div class="overflow-hidden rounded-2xl border border-gray-200 shadow-8"><div class="grid auto-cols-[268px] grid-flow-col gap-4 border-b border-gray-200 bg-white p-8 shadow-2"><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Meet Tailscale</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1"><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "How Tailscale Works"}" href="/blog/how-tailscale-works">How Tailscale Works</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "WireGuard® for Enterprises"}" href="/wireguard-vpn">WireGuard® for Enterprises</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Features"}" href="/features">Features</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Integrations"}" href="/integrations">Integrations</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Docs"}" href="/docs">Docs</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Download"}" href="/download">Download</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Compare Tailscale"}" href="/compare">Compare Tailscale</a></li></ul></div><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Products</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1">
1<li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Business VPN"}" href="/use-cases/business-vpn">Business VPN</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Tailscale PAM"}" href="/use-cases/pam">Tailscale PAM</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "CI/CD Connectivity"}" href="/use-cases/ci-cd">CI/CD Connectivity</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Secure Access to AI"}" href="/use-cases/securing-ai">Secure Access to AI</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Workload Connectivity"}" href="/use-cases/workload-connectivity">Workload Connectivity</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Edge & IoT"}" href="/use-cases/edge-iot">Edge & IoT</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Homelab"}" href="/use-cases/homelab">Homelab</a></li></ul></div><a class="flex flex-col self-stretch overflow-hidden rounded-md border border-gray-200 bg-gray-100 shadow-2" href="https://tailscale.com/use-cases/securing-ai"><div class="relative flex flex-1 items-center"><img alt="aperture dashboard" loading="lazy" width="268" height="150" decoding="async" data-nimg="1" class="h-auto w-full rounded-none border-none object-cover" style="color:transparent" src="https://cdn.sanity.io/images/w77i7m8x/production-v2/a88cf9aad8777f4b0641202a5ed6c02bbb005d8c-266x342.svg"/></div><div class="bg-gray-50 p-8"><p class="mb-1 font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700">Aperture by Tailscale</p><p class="text-base text-gray-700/80">Unified AI governance for AI agents and users. </p></div></a></div><div class="bg-gray-50 p-8"><div class="flex items-center justify-between"><div class="flex flex-col gap-1"><p class="font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700">Bring Tailscale to work</p><p class="text-base text-gray-700/80">See how Tailscale fits the systems your team already runs.</p></div><a class="inline-flex h-9 shrink-0 items-center justify-center rounded-md border border-gray-800 bg-gray-800 px-3 text-base font-medium text-white shadow-2 transition-all duration-200 hover:opacity-80 hover:shadow-4" href="https://tailscale.com/bring-tailscale-to-work">Make the case</a></div></div></div></div></li><li><button type="button" class="flex items-center gap-[4px] rounded-md px-3 py-2.5 text-sm font-medium hover:bg-gray-200">Solutions<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></button><div class="pointer-events-none absolute left-1/2 top-full z-[100] mt-3 -translate-x-1/2 pt-4 opacity-0"><div class="overflow-hidden rounded-2xl border border-gray-200 shadow-8"><div class="grid auto-cols-[268px] grid-flow-col gap-4 border-b border-gray-200 bg-white p-8 shadow-2"><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Solutions</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1">
1<li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Cloud Connectivity"}" href="/use-cases/cloud-connectivity">Cloud Connectivity</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Infrastructure Access"}" href="/use-cases/infrastructure-access">Infrastructure Access</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Zero Trust Networking"}" href="/use-cases/zero-trust-networking">Zero Trust Networking</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Remote Access"}" href="/use-cases/remote-access">Remote Access</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Kubernetes Networking"}" href="/use-cases/kubernetes">Kubernetes Networking</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Secure SaaS"}" href="/use-cases/secure-saas">Secure SaaS</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Secure AI Agent Connectivity"}" href="/use-cases/secure-ai-agent-connectivity">Secure AI Agent Connectivity</a></li></ul></div></div></div></div></li><li><button type="button" class="flex items-center gap-[4px] rounded-md px-3 py-2.5 text-sm font-medium hover:bg-gray-200">Customers<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></button><div class="pointer-events-none absolute left-1/2 top-full z-[100] mt-3 -translate-x-1/2 pt-4 opacity-0"><div class="overflow-hidden rounded-2xl border border-gray-200 shadow-8"><div class="grid auto-cols-[268px] grid-flow-col gap-4 border-b border-gray-200 bg-white p-8 shadow-2"><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Customer Stories</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1"><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Instacart"}" href="/customers/instacart">Instacart</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Cribl"}" href="/customers/cribl">Cribl</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Mercury"}" href="/customers/mercury">Mercury</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "All Customer Stories"}" href="/customers">All Customer Stories</a></li></ul></div></div></div></div></li><li><button type="button" class="flex items-center gap-[4px] rounded-md px-3 py-2.5 text-sm font-medium hover:bg-gray-200">Community<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></button><div class="pointer-events-none absolute left-1/2 top-full z-[100] mt-3 -translate-x-1/2 pt-4 opacity-0"><div class="overflow-hidden rounded-2xl border border-gray-200 shadow-8"><div class="grid auto-cols-[268px] grid-flow-col gap-4 border-b border-gray-200 bg-white p-8 shadow-2"><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Join the Community</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1">
1<li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "About Community"}" href="/about-community">About Community</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Tailscale Insiders"}" href="/insiders-program">Tailscale Insiders</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Community Projects"}" href="/community/community-projects">Community Projects</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Bring Tailscale to Work"}" href="/bring-tailscale-to-work">Bring Tailscale to Work</a></li></ul></div><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Events</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1"><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Events"}" href="/events">Events</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Webinars"}" href="/webinars">Webinars</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "TailscaleUp"}" href="/tailscaleup">TailscaleUp</a></li></ul></div><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Learn more</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1"><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Docs"}" href="/docs">Docs</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Blog"}" href="/blog">Blog</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Changelog"}" href="/changelog">Changelog</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Press"}" href="/press">Press</a></li></ul></div></div><div class="bg-gray-50 p-8"><div class="flex items-center justify-between"><div class="flex flex-col gap-1"><p class="font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700">Bring Tailscale to work</p><p class="text-base text-gray-700/80">Start with your own devices. Bring the same simplicity to your team.</p></div><a class="inline-flex h-9 shrink-0 items-center justify-center rounded-md border border-gray-800 bg-gray-800 px-3 text-base font-medium text-white shadow-2 transition-all duration-200 hover:opacity-80 hover:shadow-4" href="https://tailscale.com/bring-tailscale-to-work">Make the case</a></div></div></div></div></li><li><button type="button" class="flex items-center gap-[4px] rounded-md px-3 py-2.5 text-sm font-medium hover:bg-gray-200">Partnerships<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></button><div class="pointer-events-none absolute left-1/2 top-full z-[100] mt-3 -translate-x-1/2 pt-4 opacity-0"><div class="overflow-hidden rounded-2xl border border-gray-200 shadow-8"><div class="grid auto-cols-[268px] grid-flow-col gap-4 border-b border-gray-200 bg-white p-8 shadow-2"><div class="flex flex-col gap-4"><div class="flex items-center gap-2.5 px-3"><p class="whitespace-nowrap font-mdio text-[14px] font-medium uppercase !tracking-[0.6px] text-gray-700/80">Partner Opportunities</p><div class="h-px w-full bg-gray-200"></div></div><ul class="flex flex-col gap-1">
1<li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Become a Partner"}" href="/partnerships">Become a Partner</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Our Partners"}" href="/partnerships/directory">Our Partners</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Integrations"}" href="/integrations">Integrations</a></li><li><a class="block rounded-md p-3 text-base font-medium text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Contact Partnerships Team"}" href="/contact/partnerships">Contact Partnerships Team</a></li></ul></div></div></div></div></li><li><a href="/pricing" class="flex items-center gap-4 roun
1ded-md px-3 py-2.5 text-sm font-medium hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Pricing"}">Pricing</a></li></ul></nav><nav class="hidden sm:ml-auto sm:block lg:ml-0"><ul class="flex items-center gap-x-[4px] font-medium"><li><a href="https://login.tailscale.com/welcome" class="block rounded-md px-3 py-2.5 text-sm hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Login"}">Login</a></li><li><a class="inline-flex h-9 items-center justify-center rounded-[0.5rem] border border-gray-800 bg-gray-800 px-3 text-base font-medium text-white shadow-2 transition-all duration-200 hover:opacity-80 hover:shadow-4" href="https://login.tailscale.com/start">Get started - itâs free!</a></li></ul></nav><button type="button" class="h-[36px] rounded-[0.5rem] bg-gray-800 px-[5px] xl-small:hidden"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M4 12H20" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M4 6H20" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M4 18H20" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path></svg></button></div></div></header><div class="pointer-events-none absolute left-0 top-full w-full bg-white opacity-0 transition-opacity duration-150 md:hidden"><div class="bg-gray-700"><nav><ul class="flex justify-center gap-6"><li><a class="block py-2.5 font-mdio text-xs uppercase !tracking-[0.6px] text-gray-0/80 hover:underline" data-track="Link Clicked" data-track-properties="{"label": "Blog"}" href="/blog">Blog</a></li><li><a class="block py-2.5 font-mdio text-xs uppercase !tracking-[0.6px] text-gray-0/80 hover:underline" data-track="Link Clicked" data-track-properties="{"label": "Docs"}" href="/docs">Docs</a></li><li><a class="block py-2.5 font-mdio text-xs uppercase !tracking-[0.6px] text-gray-0/80 hover:underline" data-track="Link Clicked" data-track-properties="{"label": "Download"}" href="/download">Download</a></li><li><a class="block py-2.5 font-mdio text-xs uppercase !tracking-[0.6px] text-gray-0/80 hover:underline" data-track="Link Clicked" data-track-properties="{"label": "Contact Sales"}" href="/contact/sales">Contact Sales</a></li></ul></nav></div><nav class="max-h-[60vh] overflow-auto rounded-b-md p-6"><details class="group"><summary class="flex items-center justify-between rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] hover:bg-gray-200 group-open:bg-gray-200">
1Platform<span class="relative"><span class="group-open:hidden"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span><span class="hidden group-open:block"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:0;transform:scaleY(0);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span></span></summary><div class="mb-4 border-b border-gray-200 py-4"><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Meet Tailscale</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "How Tailscale Works"}" href="/blog/how-tailscale-works">How Tailscale Works</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "WireGuard® for Enterprises"}" href="/wireguard-vpn">WireGuard® for Enterprises</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Features"}" href="/features">Features</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Integrations"}" href="/integrations">Integrations</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Docs"}" href="/docs">Docs</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Download"}" href="/download">Download</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Compare Tailscale"}" href="/compare">Compare Tailscale</a></li></ul></div><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Products</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Business VPN"}" href="/use-cases/business-vpn">Business VPN</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Tailscale PAM"}" href="/use-cases/pam">Tailscale PAM</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "CI/CD Connectivity"}" href="/use-cases/ci-cd">CI/CD Connectivity</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Secure Access to AI"}" href="/use-cases/securing-ai">Secure Access to AI</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Workload Connectivity"}" href="/use-cases/workload-connectivity">Workload Connectivity</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Edge & IoT"}" href="/use-cases/edge-iot">Edge & IoT</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Homelab"}" href="/use-cases/homelab">Homelab</a></li></ul></div></div></details>
1<details class="group"><summary class="flex items-center justify-between rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] hover:bg-gray-200 group-open:bg-gray-200">Solutions<span class="relative"><span class="group-open:hidden"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span><span class="hidden group-open:block"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:0;transform:scaleY(0);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span></span></summary><div class="mb-4 border-b border-gray-200 py-4"><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Solutions</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Cloud Connectivity"}" href="/use-cases/cloud-connectivity">Cloud Connectivity</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Infrastructure Access"}" href="/use-cases/infrastructure-access">Infrastructure Access</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Zero Trust Networking"}" href="/use-cases/zero-trust-networking">Zero Trust Networking</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Remote Access"}" href="/use-cases/remote-access">Remote Access</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Kubernetes Networking"}" href="/use-cases/kubernetes">Kubernetes Networking</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Secure SaaS"}" href="/use-cases/secure-saas">Secure SaaS</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Secure AI Agent Connectivity"}" href="/use-cases/secure-ai-agent-connectivity">Secure AI Agent Connectivity</a></li></ul></div></div></details><details class="group"><summary class="flex items-center justify-between rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] hover:bg-gray-200 group-open:bg-gray-200">Customers<span class="relative"><span class="group-open:hidden"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span><span class="hidden group-open:block"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:0;transform:scaleY(0);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span></span></summary><div class="mb-4 border-b border-gray-200 py-4"><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Customer Stories</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Instacart"}" href="/customers/instacart">Instacart</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Cribl"}" href="/customers/cribl">Cribl</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Mercury"}" href="/customers/mercury">Mercury</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "All Customer Stories"}" href="/customers">All Customer Stories</a></li></ul></div></div></details>
1<details class="group"><summary class="flex items-center justify-between rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] hover:bg-gray-200 group-open:bg-gray-200">Community<span class="relative"><span class="group-open:hidden"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span><span class="hidden group-open:block"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:0;transform:scaleY(0);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span></span></summary><div class="mb-4 border-b border-gray-200 py-4"><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Join the Community</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "About Community"}" href="/about-community">About Community</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Tailscale Insiders"}" href="/insiders-program">Tailscale Insiders</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Community Projects"}" href="/community/community-projects">Community Projects</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Bring Tailscale to Work"}" href="/bring-tailscale-to-work">Bring Tailscale to Work</a></li></ul></div><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Events</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Events"}" href="/events">Events</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Webinars"}" href="/webinars">Webinars</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "TailscaleUp"}" href="/tailscaleup">TailscaleUp</a></li></ul></div><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Learn more</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Docs"}" href="/docs">Docs</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Blog"}" href="/blog">Blog</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Changelog"}" href="/changelog">Changelog</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Press"}" href="/press">Press</a></li></ul></div></div></details>
1<details class="group"><summary class="flex items-center justify-between rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] hover:bg-gray-200 group-open:bg-gray-200">Partnerships<span class="relative"><span class="group-open:hidden"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:1;transform:scaleY(1);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span><span class="hidden group-open:block"><svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.91675 7H11.0834" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round"></path><path d="M7 2.9165V11.0832" stroke="#2E2D2D" stroke-width="1.16667" stroke-linecap="round" stroke-linejoin="round" style="opacity:0;transform:scaleY(0);transform-origin:center;transition:opacity 150ms ease-in-out, transform 150ms ease-in-out"></path></svg></span></span></summary><div class="mb-4 border-b border-gray-200 py-4"><div class="mb-6"><p class="mb-3 flex items-center gap-2.5 whitespace-nowrap px-2 font-mdio text-[12px] font-medium uppercase !tracking-[0.6px] text-gray-700/80 after:h-px after:w-full after:bg-gray-200 after:content-['']">Partner Opportunities</p><ul><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Become a Partner"}" href="/partnerships">Become a Partner</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Our Partners"}" href="/partnerships/directory">Our Partners</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Integrations"}" href="/integrations">Integrations</a></li><li class="space-y-1"><a class="block rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] text-gray-700 hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Contact Partnerships Team"}" href="/contact/partnerships">Contact Partnerships Team</a></li></ul></div></div></details><a class="flex justify-between rounded-md px-2 py-3 text-[14px] font-medium tracking-[-0.14px] hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Pricing"}" href="/pricing">Pricing</a></nav><nav class="mx-6 border-t border-gray-200 py-6"><ul class="flex items-center justify-between gap-x-4 font-medium"><li><a href="https://login.tailscale.com/welcome" class="block rounded-md px-3 py-2.5 text-sm hover:bg-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Login"}">Login</a></li><li><a class="inline-flex h-9 items-center justify-center rounded-md border border-gray-800 bg-gray-800 px-3 text-base font-medium text-white shadow-2 transition-all duration-200 hover:opacity-80 hover:shadow-4" href="https://login.tailscale.com/start">Get started - itâs free!</a></li></ul></nav></div></div><div class="website-nav-backdrop z-100 pointer-events-none fixed left-0 top-0 h-full w-full bg-gray-1000/25 opacity-0 transition-opacity duration-300"></div><main><section class="overflow-hidden bg-gray-50 pb-24 pt-16"><div class="container-new"><div class="flex w-full flex-row items-center justify-between gap-y-4 py-6"><h1 class="h1-new text-gray-700 lg:pl-8">Blog</h1><span class="caption-new flex items-center text-gray-500 lg:pr-8">Subscribe via <a aria-label="Newsletter" class="rounded-full bg-gray-700 p-2 text-white transition-colors duration-200 hover:bg-gray-300 hover:text-gray-1000 ml-1" href="/blog#blog-newsletter"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 13" class="h-4 w-4"><use href="/sprite.svg#mail"></use></svg></a><a href="https://tailscale.com/blog/index.xml" aria-label="RSS Feed" class="rounded-full bg-gray-700 p-2 text-white transition-colors duration-200 hover:bg-gray-300 hover:text-gray-1000 ml-1 mr-3"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 17 17" class="h-4 w-4"><use href="/sprite.svg#rss"></use></svg></a>Follow on <a aria-label="Tailscale on twitter" class="rounded-full bg-gray-700 p-2 text-white transition-colors duration-200 hover:bg-gray-300 hover:text-gray-1000 ml-1" href="https://twitter.com/tailscale"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 17 15" class="h-4 w-4"><use href="/sprite.svg#twitter-x"></use></svg></a></span></div><div class="mt-4 flex grid-flow-col flex-col gap-3 lg:grid"><a data-track="Link Clicked" class="flex flex-col rounded-2xl border border-gray-200 bg-white p-8 shadow-brand transition duration-300 hover:border-gray-300 hover:shadow-brand-hover group col-span-3 row-span-2" data-track-properties="{"label": "Weâre making Tailscale faster"}" href="/blog/making-tailscale-faster"><img alt="Two black app grids with 9 circular buttons each connected by a lightning bolt icon on an orange and brown gradient background, representing data transfer between devices." loading="lazy" width="1536" height="600" decoding="async" data-nimg="1" class="mb-8 w-full rounded-lg" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 1536 600'%3E%3Cfilter id='b' color-interpolation-filters='
1sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/e3b3d666d4cc44af8b4dd8786b0b4554162b58f9-1536x600.png?w=1920&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/e3b3d666d4cc44af8b4dd8786b0b4554162b58f9-1536x600.png?w=3840&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/e3b3d666d4cc44af8b4dd8786b0b4554162b58f9-1536x600.png?w=3840&q=75&fit=clip&auto=format"/><div class="flex items-center gap-2"><span class="inline-flex h-fit items-center gap-1 rounded-brand-sm p-brand-8 text-sm font-medium capitalize" style="color:#0B3733;background:#CBF4C9">product</span><span class="meta-new text-gray-500">September 22, 2026</span></div><h3 class="h3-new my-3 text-gray-700">Weâre making Tailscale faster</h3><p class="featured-body-new mb-3 line-clamp-2 text-gray-600">A deep dive into our ongoing commitment to fast and reliable connectivity.</p><div class="flex flex-wrap items-center gap-2"><div class="flex -space-x-2 saturate-0 transition duration-300 group-hover:saturate-100"><img alt="Kabir Sikand" loading="lazy" width="2555" height="2555" decoding="async" data-nimg="1" class="h-8 w-8 text-xs border-white rounded-full border-[1.5px]" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 2555 2555'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/98dbffb45d633f62722a93822a0404d78ac8b661-2555x2555.jpg?w=3840&q=75&fit=clip&auto=format 1x" src="https://cdn.sanity.io/images/w77i7m8x/production/98dbffb45d633f62722a93822a0404d78ac8b661-2555x2555.jpg?w=3840&q=75&fit=clip&auto=format"/><img alt="Headshot of Kevin Purdy" loading="lazy" width="512" height="512" decoding="async" data-nimg="1" class="h-8 w-8 text-xs border-white rounded-full border-[1.5px]" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 512 512'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'
1/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/88495251674b4b8245c44141cb7cf5e6db33475a-512x512.jpg?w=640&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/88495251674b4b8245c44141cb7cf5e6db33475a-512x512.jpg?w=1080&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/88495251674b4b8245c44141cb7cf5e6db33475a-512x512.jpg?w=1080&q=75&fit=clip&auto=format"/></div><div class="meta-new text-gray-500">Kabir Sikand<!-- --> and 1 more author</div></div></a><a data-track="Link Clicked" class="flex flex-col rounded-2xl border border-gray-200 bg-white p-8 shadow-brand transition duration-300 hover:border-gray-300 hover:shadow-brand-hover group col-span-1" data-track-properties="{"label": "Your built-in router VPN might be more trouble than itâs worth"}" href="/blog/built-in-router-nas-vpns"><div class="flex items-center gap-2"><span class="inline-flex h-fit items-center gap-1 rounded-brand-sm p-brand-8 text-sm font-medium capitalize" style="color:#571F0D;background:#F8E5B9">insights</span><span class="meta-new text-gray-500">September 11, 2026</span></div><h3 class="h4-new my-3 text-gray-700">Your built-in router VPN might be more trouble than itâs worth</h3><p class="body-new mb-4 line-clamp-3 text-gray-600">Built-in VPNs are easy to startâthen harder to live with.</p><div class="flex flex-wrap items-center gap-2"><div class="flex -space-x-2 saturate-0 transition duration-300 group-hover:saturate-100"><img alt="Andrew Cunningham, writer at Tailscale, wearing a black shirt on a white undershirt, against a black and white stairway and brick wall." loading="lazy" width="2307" height="1823" decoding="async" data-nimg="1" class="h-8 w-8 text-xs border-white rounded-full border-[1.5px]" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 2307 1823'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/1a0c78173c67f3467037b9beee7d399eb7a253b1-2307x1823.jpg?w=3840&q=75&fit=clip&auto=format 1x" src="https://cdn.sanity.io/images/w77i7m8x/production/1a0c78173c67f3467037b9beee7d399eb7a253b1-2307x1823.jpg?w=3840&q=75&fit=clip&auto=format"/></div><div class="meta-new text-gray-500">Andrew Cunningham</div></div></a><a data-track="Link Clicked" class="flex flex-col rounded-2xl border border-gray-200 bg-white p-8 shadow-brand transition duration-300 hover:border-gray-300 hover:shadow-brand-hover group col-span-1" data-track-properties="{"label": "Tailscale Kubernetes Operator 1.102: In-cluster Peer Relays, better IPv6, and optimized certificates"}" href="/blog/kubernetes-operator-1102"><div class="flex items-center gap-2"><span class="inline-flex h-fit items-center gap-1 rounded-brand-sm p-brand-8 text-sm font-medium capitalize" style="color:#0B3733;background:#CBF4C9">product</span><span class="meta-new text-gray-500">September 09, 2026</span></div><h3 class="h4-new my-3 text-gray-700">Tailscale Kubernetes Operator 1.102: In-cluster Peer Relays, better IPv6, and optimized certificates</h3><p class="body-new mb-4 line-clamp-3 text-gray-600">Faster cross-cluster connections, fewer IPv6 dead ends, less certificate churn.</p><div class="flex flex-wrap items-center gap-2">
1<div class="flex -space-x-2 saturate-0 transition duration-300 group-hover:saturate-100"><img alt="Image of author Mike Stefaniak" loading="lazy" width="512" height="512" decoding="async" data-nimg="1" class="h-8 w-8 text-xs border-white rounded-full border-[1.5px]" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 512 512'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/84b1a42778d620afcb6edba03cdf6f4ad7af7038-512x512.jpg?w=640&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/84b1a42778d620afcb6edba03cdf6f4ad7af7038-512x512.jpg?w=1080&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/84b1a42778d620afcb6edba03cdf6f4ad7af7038-512x512.jpg?w=1080&q=75&fit=clip&auto=format"/></div><div class="meta-new text-gray-500">Mike Stefaniak</div></div></a><a data-track="Link Clicked" class="flex flex-col rounded-2xl border border-gray-200 bg-white p-8 shadow-brand transition duration-300 hover:border-gray-300 hover:shadow-brand-hover group col-span-1" data-track-properties="{"label": "Tailcat: Tailscale without Tailscale, by Tailscale"}" href="/blog/tailcat"><div class="flex items-center gap-2"><span class="inline-flex h-fit items-center gap-1 rounded-brand-sm p-brand-8 text-sm font-medium capitalize" style="color:#0B3733;background:#CBF4C9">product</span><span class="meta-new text-gray-500">August 31, 2026</span></div><h3 class="h4-new my-3 text-gray-700">Tailcat: Tailscale without Tailscale, by Tailscale</h3><p class="body-new mb-4 line-clamp-3 text-gray-600">A netcat-ish way to use Tailscaleâs data plane without its control plane</p><div class="flex flex-wrap items-center gap-2"><div class="flex -space-x-2 saturate-0 transition duration-300 group-hover:saturate-100"><img alt="A man with a short well-groomed beard dressed in a white shirt, facing the camera with a calm demeanor." loading="lazy" width="945" height="945" decoding="async" data-nimg="1" class="h-8 w-8 text-xs border-white rounded-full border-[1.5px]" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 945 945'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/88e6bd3712877e26fef5093d3779ecd00c23ff6d-945x945.jpg?w=1080&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/88e6bd3712877e26fef5093d3779ecd00c23ff6d-945x945.jpg?w=1920&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/88e6bd3712877e26fef5093d3779ecd00c23ff6d-945x945.jpg?w=1920&q=75&fit=clip&auto=format"/></div><div class="meta-new text-gray-500">Brad Fitzpatrick</div></div></a><a data-track="Link Clicked" class="flex flex-col rounded-2xl border border-gray-200 bg-white p-8 shadow-brand transition duration-300 hover:border-gray-300 hover:shadow-brand-hover group col-span-1" data-track-properties="{"label": "Build with Tailscale. Build on Tailscale."}" href="/blog/easier-building-with-tailscale"><div class="flex items-center gap-2"><span class="inline-flex h-fit items-center gap-1 rounded-brand-sm p-brand-8 text-sm font-medium capitalize" style="color:#0B3733;background:#CBF4C9">product</span><span class="meta-new text-gray-500">August 31, 2026</span></div><h3 class="h4-new my-3 text-gray-700">Build with Tailscale. Build on Tailscale.</h3><p class="body-new mb-4 line-clamp-3 text-gray-600">Put secure networking inside what you build, then automate the rest.</p><div class="flex flex-wrap items-center gap-2">
1<div class="flex -space-x-2 saturate-0 transition duration-300 group-hover:saturate-100"><img alt="Headshot of Kevin Purdy" loading="lazy" width="512" height="512" decoding="async" data-nimg="1" class="h-8 w-8 text-xs border-white rounded-full border-[1.5px]" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 512 512'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/88495251674b4b8245c44141cb7cf5e6db33475a-512x512.jpg?w=640&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/88495251674b4b8245c44141cb7cf5e6db33475a-512x512.jpg?w=1080&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/88495251674b4b8245c44141cb7cf5e6db33475a-512x512.jpg?w=1080&q=75&fit=clip&auto=format"/></div><div class="meta-new text-gray-500">Kevin Purdy</div></div></a></div></div></section><section class="mt-32"><div class="container-new"><div class="flex w-full flex-col items-start rounded-2xl border border-gray-200 bg-white px-8 py-12 text-left text-white shadow-brand sm:items-center" id="blog-newsletter"><h2 class="h3-new text-gray-700">Subscribe to Tailscaleâs blog</h2><p class="featured-body-new mt-2 text-gray-600">We have a deep commitment to keeping your data safe.</p><div class="mt-8 w-full max-w-[342px] sm:mx-auto"><div id="hubspot-form-newsletter" class="hubspot-form-container"></div></div><div class="caption-new mt-3 flex items-center gap-3 text-gray-500"><span>Too much email?</span><span class="flex items-center gap-1"><a href="https://tailscale.com/blog/index.xml" aria-label="RSS Feed" class="rounded-full bg-gray-700 p-2 text-white transition-colors duration-200 hover:bg-gray-300 hover:text-gray-1000"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 17 17" class="h-4 w-4"><use href="/sprite.svg#rss"></use></svg></a>RSS</span><span class="flex items-center gap-1"><a aria-label="Tailscale on twitter" class="rounded-full bg-gray-700 p-2 text-white transition-colors duration-200 hover:bg-gray-300 hover:text-gray-1000" href="https://twitter.com/tailscale"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 17 15" class="h-4 w-4"><use href="/sprite.svg#twitter-x"></use></svg></a>Twitter</span></div></div></div></section></main><section class=" pb-[50px] pt-10 lg:pt-[175px] "><div class="is-wide container flex flex-col gap-6 md-large:flex-row"><div class="flex flex-1 flex-col justify-between rounded-[14px] bg-blue-900 overflow-hidden"><div class="relative z-10 flex-1 overflow-hidden px-[48px] py-[80px]"><div class="absolute -right-[1.5px] bottom-[0%] h-full w-auto opacity-25 xs:opacity-100 md:opacity-100 md-large:opacity-25 xl:opacity-100"><div class="flex h-full w-auto justify-end"><svg width="100%" height="100%" viewBox="0 0 264 394" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0.666016 262.667C0.666019 190.118 59.4508 131.333 131.999 131.333L131.999 262.667L0.666016 262.667Z" fill="#6294F1"/><path d="M132 394C59.4515 394 0.666676 335.215 0.666682 262.667L132 262.667L132 394Z" fill="#253570"/><path d="M263.332 394C190.783 394 131.999 335.215 131.999 262.667L263.332 262.667L263.332 394Z" fill="#6294F1"/><path d="M132 131.333C59.4515 131.333 0.666673 72.5485 0.666676 -8.08502e-05L132 -7.62939e-05L132 131.333Z" fill="#253570"/><rect x="263.332" y="131.333" width="131.333" height="131.333" rx="65.6667" transform="rotate(90 263.332 131.333)" fill="#253570"/><rect x="263.332" width="131.333" height="131.333" rx="65.6667" transform="rotate(90 263.332 0)" fill="#6294F1"/></svg></div></div><div class="text-left mx-0 relative z-10"><h2 class="t-h3 text-white mb-4 md:mb-8" style="max-width:292px;color:#6C94EC">Try Tailscale for <span class="text-white">free</span></h2><div class="w-full xs:w-auto flex justify-start"><div class="flex w-full !w-auto flex-col gap-y-4 xs:w-auto xs:flex-row xs:items-center xs:space-x-5 md:space-x-[30px]"><a target="" data-track="Link Clicked" data-track-properties="{"label": "Get started"}" href="https://login.tailscale.com/start"><div class="inline-flex shrink-0 border transition-colors duration-200 w-full xs:w-auto items-center justify-center text-center relative focus:outline-none group transition-all overflow-hidden font-body font-medium rounded-lg group gap-[11px] py-2 px-[17px] leading-[1.46] tracking-[-0.16px] bg-heading-white border-white text-heading-black hover:bg-gray-50 hover:border-gray-50"><div>Get started</div><div class="relative "><span class="block will-change-transform" style="opacity:1;transform:none"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 18" class="w-4"><use href="/sprite.svg#arrowRight"></use></svg></span><span class="absolute inset-0 block will-change-transform" style="opacity:0;transform:translateX(-15px) translateY(0px) translateZ(0)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 18" class="w-4"><use href="/sprite.svg#arrowRight"></use></svg></span></div></div></a></div></div></div></div><div class="relative w-full rounded-b-[14px] px-[48px] py-[60px] bg-blue-300" style="color:#232222"><div class="t-h5 !font-normal">Schedule a demo</div><a class="mt-3 block" data-track="Link Clicked" data-track-properties="{"label": "/contact/sales"}" href="/contact/sales"><div class="inline-flex shrink-0 border transition-colors duration-200 w-full xs:w-auto items-center justify-center text-center relative focus:outline-none group transition-all overflow-hidden font-body font-medium rounded-lg group gap-[11px] py-2 px-[17px] leading-[1.46] tracking-[-0.16px] !w-auto bg-heading-black border-heading-black text-white hover:bg-gray-900 hover:border-gray-900 "><div>Contact sales</div></div></a></div></div><div class="flex flex-1 items-end justify-center overflow-hidden rounded-[14px] bg-blue-900 pt-[50px]"><div class="px-5" style="transform:translateY(100px) translateZ(0)"><img _type="asset" alt="cta phone" loading="lazy" width="362" height="567" decoding="async" data-nimg="1" class="md:block mx-auto" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 362 567'%3E%3Cfilter id='b' color-interpolation-filters='
1sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/90e2ca60be7a63ed677b56ad293b23f1aae42baa-362x567.svg?w=384&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/90e2ca60be7a63ed677b56ad293b23f1aae42baa-362x567.svg?w=750&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/90e2ca60be7a63ed677b56ad293b23f1aae42baa-362x567.svg?w=750&q=75&fit=clip&auto=format"/></div></div></div><div class="container mt-[60px]"><div><div class="flex flex-wrap items-center justify-center gap-4 lg:justify-between"><div class="flex w-[calc(33%-16px)] flex-col items-center gap-2 sm:w-[calc(33%-16px)] md:w-auto">
1<img alt="mercury" loading="lazy" width="199" height="81" decoding="async" data-nimg="1" class="mx-auto undefined" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 199 81'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/4590b93f6cc3b4573e5cd5cefe90e62f935e5aa7-199x81.svg?w=256&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/4590b93f6cc3b4573e5cd5cefe90e62f935e5aa7-199x81.svg?w=640&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/4590b93f6cc3b4573e5cd5cefe90e62f935e5aa7-199x81.svg?w=640&q=75&fit=clip&auto=format"/></div><div class="flex w-[calc(33%-16px)] flex-col items-center gap-2 sm:w-[calc(33%-16px)] md:w-auto"><img alt="instacrt" loading="lazy" width="199" height="81" decoding="async" data-nimg="1" class="mx-auto undefined" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 199 81'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/698d5ead889b4e5a57f60549e74102b82ad7aae8-199x81.svg?w=256&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/698d5ead889b4e5a57f60549e74102b82ad7aae8-199x81.svg?w=640&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/698d5ead889b4e5a57f60549e74102b82ad7aae8-199x81.svg?w=640&q=75&fit=clip&auto=format"/></div><div class="flex w-[calc(33%-16px)] flex-col items-center gap-2 sm:w-[calc(33%-16px)] md:w-auto"><img alt="Retool" loading="lazy" width="199" height="82" decoding="async" data-nimg="1" class="mx-auto undefined" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 199 82'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'
1/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/258b299c38fba23800176525d02e7ce713f74820-199x82.svg?w=256&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/258b299c38fba23800176525d02e7ce713f74820-199x82.svg?w=640&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/258b299c38fba23800176525d02e7ce713f74820-199x82.svg?w=640&q=75&fit=clip&auto=format"/></div><div class="flex w-[calc(33%-16px)] flex-col items-center gap-2 sm:w-[calc(33%-16px)] md:w-auto"><img alt="duolingo" loading="lazy" width="199" height="81" decoding="async" data-nimg="1" class="mx-auto undefined" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 199 81'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/b74adcdab85e2515c997140d08827f084bccfa2a-199x81.svg?w=256&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/b74adcdab85e2515c997140d08827f084bccfa2a-199x81.svg?w=640&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/b74adcdab85e2515c997140d08827f084bccfa2a-199x81.svg?w=640&q=75&fit=clip&auto=format"/></div></div></div></div></section><footer class="mt-16 bg-white py-12"><div class="mx-auto w-full max-w-[1360px] px-6 md:max-w-[1440px] md:px-16"><div class="grid grid-cols-1 gap-4 sm:grid-cols-2 md:grid-cols-12"><div class="px-3 sm:col-span-2 md:col-span-4 md:px-8 md:py-8"><a class="block w-[110px]" title="Homepage" href="/"><svg width="48" height="48" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><path d="M3 15C4.65685 15 6 13.6569 6 12C6 10.3431 4.65685 9 3 9C1.34315 9 0 10.3431 0 12C0 13.6569 1.34315 15 3 15Z" fill="currentColor"></path><path d="M12 15C13.6569 15 15 13.6569 15 12C15 10.3431 13.6569 9 12 9C10.3431 9 9 10.3431 9 12C9 13.6569 10.3431 15 12 15Z" fill="currentColor"></path><path d="M12 24C13.6569 24 15 22.6569 15 21C15 19.3431 13.6569 18 12 18C10.3431 18 9 19.3431 9 21C9 22.6569 10.3431 24 12 24Z" fill="currentColor"></path><path d="M21 15C22.6569 15 24 13.6569 24 12C24 10.3431 22.6569 9 21 9C19.3431 9 18 10.3431 18 12C18 13.6569 19.3431 15 21 15Z" fill="currentColor"></path><path d="M3 24C4.65685 24 6 22.6569 6 21C6 19.3431 4.65685 18 3 18C1.34315 18 0 19.3431 0 21C0 22.6569 1.34315 24 3 24Z" fill="currentColor" fill-opacity="0.4"></path><path d="M21 24C22.6569 24 24 22.6569 24 21C24 19.3431 22.6569 18 21 18C19.3431 18 18 19.3431 18 21C18 22.6569 19.3431 24 21 24Z" fill="currentColor" fill-opacity="0.4"></path><path d="M3 6C4.65685 6 6 4.65685 6 3C6 1.34315 4.65685 0 3 0C1.34315 0 0 1.34315 0 3C0 4.65685 1.34315 6 3 6Z" fill="currentColor" fill-opacity="0.4"></path><path d="M12 6C13.6569 6 15 4.65685 15 3C15 1.34315 13.6569 0 12 0C10.3431 0 9 1.34315 9 3C9 4.65685 10.3431 6 12 6Z" fill="currentColor" fill-opacity="0.4"></path><path d="M21 6C22.6569 6 24 4.65685 24 3C24 1.34315 22.6569 0 21 0C19.3431 0 18 1.34315 18 3C18 4.65685 19.3431 6 21 6Z" fill="currentColor" fill-opacity="0.4"></path></svg></a></div><div class="py-3 sm:col-span-1 md:col-span-2 md:py-8"><h3 class="flex flex-row items-center gap-2.5 px-3 pb-3 font-mdio text-xs font-medium uppercase !tracking-[0.6px] text-gray-700/80"><span class="shrink-0">Company</span><hr class="flex-1 border-gray-200"/></h3><ul class="flex flex-col gap-1">
1<li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/company">About Tailscale</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/careers">Careers</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/press">Press</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/opensource">Open Source</a></li></ul></div><div class="py-3 sm:col-span-1 md:col-span-2 md:py-8"><h3 class="flex flex-row items-center gap-2.5 px-3 pb-3 font-mdio text-xs font-medium uppercase !tracking-[0.6px] text-gray-700/80"><span class="shrink-0">Help & Support</span><hr class="flex-1 border-gray-200"/></h3><ul class="flex flex-col gap-1"><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/contact/support">Support</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/contact/sales">Sales</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/partnerships">Partnerships</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/security">Security</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/changelog">Changelog</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://status.tailscale.com">Tailscale Status</a></li></ul></div><div class="py-3 sm:col-span-1 md:col-span-2 md:py-8"><h3 class="flex flex-row items-center gap-2.5 px-3 pb-3 font-mdio text-xs font-medium uppercase !tracking-[0.6px] text-gray-700/80"><span class="shrink-0">Legal</span><hr class="flex-1 border-gray-200"/></h3><ul class="flex flex-col gap-1"><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/terms">Terms of Service</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/privacy">Privacy Policy</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/privacy-policy#california-notice">California Notice</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/cookie-notice">Cookie Notice</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><button type="button" class="flex h-[20px] items-center gap-2 text-left text-sm font-medium text-gray-700">Your privacy choices<img alt="Check mark and x on a white and blue pill button" loading="lazy" width="30" height="14" decoding="async" data-nimg="1" style="color:transparent" src="https://cdn.sanity.io/images/w77i7m8x/production/07d853f507039b2489d9818cb6ee7442c1b60e2a-30x14.svg"/></button></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="/legal">All Legal</a></li></ul></div><div class="py-3 sm:col-span-1 md:col-span-2 md:py-8"><h3 class="flex flex-row items-center gap-2.5 px-3 pb-3 font-mdio text-xs font-medium uppercase !tracking-[0.6px] text-gray-700/80"><span class="shrink-0">Social</span><hr class="flex-1 border-gray-200"/></h3><ul class="flex flex-col gap-1">
1<li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://discord.gg/tailscale">Discord</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://github.com/tailscale">GitHub</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://www.linkedin.com/company/tailscale">LinkedIn</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://www.instagram.com/tailscale/">Instagram</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://www.reddit.com/r/Tailscale">Reddit</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://www.youtube.com/@Tailscale">YouTube</a></li><li class="rounded-md p-3 transition-colors duration-200 hover:bg-gray-200"><a target="_blank" rel="noopener noreferrer" class="flex h-[20px] items-center text-sm font-medium text-gray-700 no-underline" href="https://twitter.com/tailscale">X (Twitter)</a></li></ul></div></div><div class="mx-3 flex flex-col items-start gap-3 border-gray-200 sm:border-t sm:pt-6 md:mx-8 md:flex-row md:items-center md:border-t-0 md:pt-0"><span class="text-xs text-gray-500">© 2026 Tailscale Inc.</span><hr class="hidden flex-1 self-center border-gray-200 md:inline"/><span class="flex flex-col text-xs text-gray-500 md:block"><span>Tailscale is a registered trademark of Tailscale Inc.</span><span class="hidden md:inline"> | </span><span>WireGuard is a registered trademark of Jason A. Donenfeld</span></span></div></div></footer></div>
1<script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{"data":{"page":{"_id":"6ebebdd7-d862-4b40-b9aa-ce389f0471ca","_type":"page","cta":null,"ctaColor":"blue","footerStyle":"light","headerStyle":"dark","invertHeader":null,"overwriteCTAColor":true,"parent":null,"removeCTA":false,"removeFooter":null,"removeHeader":false,"sections":[{"_type":"landingPage","landingPageLayout":"blog","blog":{"_type":"blogLandingPage","featuredPosts":null,"masthead":{"heading":"Blog","slider":[{"_id":"f1590209-ad3e-478f-b52a-f16ae8811b14","authors":[{"_createdAt":"2023-10-23T13:51:13Z","_id":"d18c0348-ad84-47b7-bc16-150341cc5495","_rev":"JgNZwVoOE3fVRWVQtDlinn","_system":{"base":{"id":"d18c0348-ad84-47b7-bc16-150341cc5495","rev":"Kw7ZywWq2biwgCkntZOsLB"}},"_type":"teamMember","_updatedAt":"2026-04-28T20:49:14Z","member":{"image":{"_type":"sanityImage","alt":"Kabir Sikand","asset":{"_ref":"image-98dbffb45d633f62722a93822a0404d78ac8b661-2555x2555-jpg","_type":"reference"}},"jobTitle":"Product Manager","name":"Kabir Sikand"},"title":"Kabir Sikand"},{"_createdAt":"2025-07-03T13:19:40Z","_id":"ab416318-bc7c-4951-8d49-10f5402b8974","_rev":"PmlDDBV8ZhCyKPV7rW7JRy","_system":{"base":{"id":"ab416318-bc7c-4951-8d49-10f5402b8974","rev":"HCgnpdEWAXRsYEv1jmJJVd"}},"_type":"teamMember","_updatedAt":"2026-04-28T20:49:14Z","member":{"image":{"_type":"sanityImage","alt":"Headshot of Kevin Purdy","asset":{"_ref":"image-88495251674b4b8245c44141cb7cf5e6db33475a-512x512-jpg","_type":"reference"}},"jobTitle":"Technical Content Manager @Tailscale","name":"Kevin Purdy","socialLink":"https://thepurdman.com"},"title":"Kevin Purdy"}],"category":"product","excerpt":"A deep dive into our ongoing commitment to fast and reliable connectivity.","featuredImage":{"_type":"sanityImage","alt":"Two black app grids with 9 circular buttons each connected by a lightning bolt icon on an orange and brown gradient background, representing data transfer between devices.","asset":{"_ref":"image-e3b3d666d4cc44af8b4dd8786b0b4554162b58f9-1536x600-png","_type":"reference"}},"flexContent":[{"_key":"2d02f917fc41","_type":"block","children":[{"_key":"6102a4773d2e","_type":"span","marks":[],"text":"If youâve been following Tailscale at all, you know weâre really just a bunch of geeks who care a lot about internet connectivity. One thing we love to talk about is NAT Traversal. Thatâs one of the core value-adds with Tailscale: "},{"_key":"6ad88b763a5d","_type":"span","marks":["43ed4c73cfdf"],"text":"we tamed NAT"},{"_key":"b1332d93b0b1","_type":"span","marks":[],"text":". Not every network is friendly, but Tailscale can still find a path in a wide range of conditions. Thatâs not the only important thing for an internet protocol: the data plane also has to be performant."}],"markDefs":[{"_key":"43ed4c73cfdf","_type":"link","href":"https://tailscale.com/blog/nat-traversal-improvements-pt3-looking-ahead"}],"style":"normal"},{"_key":"63aae9e5effc","_type":"block","children":[{"_key":"93639e79c60b","_type":"span","marks":[],"text":"Over the years weâve been investing in making Tailscale fast. We started by "},{"_key":"a6f658d1db52","_type":"span","marks":["9d893a0f7b8d"],"text":"increasing TCP throughput on Linux devices"},{"_key":"3f78018a92b3","_type":"span","marks":[],"text":". Then we made significant breakthroughs in wireguard-go to "},{"_key":"92ae6a5a0ba2","_type":"span","marks":["52522c548c56"],"text":"surpass 10Gb/s"},{"_key":"1908ce6b36d9","_type":"span","marks":[],"text":" on bare metal. We later leveraged segmentation offloads to "},{"_key":"89d507ba0a31","_type":"span","marks":["98b48903e4ab"],"text":"increase throughput over 4x"},{"_key":"469c2886800e","_type":"span","marks":[],"text":" for UDP-based applications. Alongside these improvements to our data plane, we built primitives like "},{"_key":"d15bdbf42bab","_type":"span","marks":["fa40a390c327"],"text":"Tailscale Peer Relays"},{"_key":"f1f8d3c65075","_type":"span","marks":[],"text":", which can "},{"_key":"565e729e342c","_type":"span","marks":["f040369b6567"],"text":"improve network performance in tricky conditions"}
1,{"_key":"2867b592b59b","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"9d893a0f7b8d","_type":"link","href":"https://tailscale.com/blog/throughput-improvements"},{"_key":"52522c548c56","_type":"link","href":"https://tailscale.com/blog/more-throughput"},{"_key":"98b48903e4ab","_type":"link","href":"https://tailscale.com/blog/quic-udp-throughput"},{"_key":"fa40a390c327","_type":"link","href":"https://tailscale.com/blog/peer-relays-beta"},{"_key":"f040369b6567","_type":"link","href":"https://tailscale.com/blog/peer-relays-international-networks"}],"style":"normal"},{"_key":"f42bfaeab408","_type":"block","children":[{"_key":"b23b504d3ea2","_type":"span","marks":[],"text":"All of this has made Tailscale practical for more performance-sensitive workloads. It means you can use Tailscale for continuous integration, agentic workflows, remote development environments, robotic edge devices, heavy data and telemetry workloads, and more. Tailscale helps those devices connect across a wide range of network conditions."}],"markDefs":[],"style":"normal"},{"_key":"f74a54b4e1c6","_type":"block","children":[{"_key":"e58cca28075d","_type":"span","marks":[],"text":"So yeah, we think Tailscale is fast. But we also think we can make it faster."}],"markDefs":[],"style":"normal"},{"_key":"829a5af46f10","_type":"block","children":[{"_key":"250020385a96","_type":"span","marks":[],"text":"Today weâll detail how weâre boosting throughput for app connectors, subnet routers, and exit nodes, with some multi-queue technology (landing in the second half of 2026). Weâll also preview some throughput and memory overhead improvements weâre deploying in upcoming stable client releases. And weâll look at some performance tooling issues we want to solve for our customers."}],"markDefs":[],"style":"normal"},{"_key":"e53855198a2e","_type":"block","children":[{"_key":"eca9cbf2ba84","_type":"span","marks":[],"text":"Less memory overhead for small packets"}],"markDefs":[],"style":"h2"},{"_key":"88fc678224e5","_type":"block","children":[{"_key":"d6369860487f","_type":"span","marks":[],"text":"Most network packets are tiny, like 1 KiB. But to use Linuxâs most efficient throughput tools, like Generic Receive Offload (GRO), Tailscale has to be ready to accept 64 KiB of traffic at once. Itâs a bit like container shipping: the ports, ships, and trucks are built for one container shape, however full it happens to be."}],"markDefs":[],"style":"normal"},{"_key":"03d1a83ed2e0","_type":"block","children":[{"_key":"534c4384a453","_type":"span","marks":[],"text":"Tailscale has to unpack those containersâevery packet gets decrypted and delivered on its own. The wireguard-go implementation that informs Tailscaleâs cryptography and networking essentials, only offers one 64 KiB buffer size to unpack into. So a 1 KiB packet is copied into its own 64 KiB buffer, every time. Thatâs a rich optimization target."}],"markDefs":[],"style":"normal"},{"_key":"6dd2163af33d","_type":"block","children":[{"_key":"d39e6db5abbb","_type":"span","marks":[],"text":"On Linux and Android, Tailscale now leaves those packets where they landed. It identifies where each one starts and ends inside the single large read instead of copying it somewhere new. Small packets stay small in memory, many share one allocation, and they spend less time being copied. In itself, this led to a roughly 5% speed-up in many network configurations."}],"markDefs":[],"style":"normal"},{"_key":"9fdaff260c88","_type":"assetBlock","asset":{"_type":"asset","alignment":"center","image":{"_type":"sanityImage","alt":"Diagram comparing packet buffer allocation before and after optimization. Before: three packets each copied into separate 64 KiB buffers with unused space. After: three packets sized and tagged for destination, consolidated into a single buffer with dividers.","asset":{"_ref":"image-424a76b03245b737cf8e2c85567ba0e1eadb1b12-1920x1080-svg","_type":"reference"}},"mobileImage":{"_type":"sanityImage","alt":"Diagram comparing packet buffer allocation before and after optimization. Before: three packets each copied into separate 64 KiB buffers with unused space. After: three packets sized and tagged for destination, consolidated into a single buffer with dividers.","asset":{"_ref":"image-99f2ca48b479f5489015ec69c0b45d66c93a6666-1920x1080-png","_type":"reference"}},"placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":true,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"display":"block"},{"_key":"fbddd4486e83","_type":"block","children":[{"_key":"9ee3de77e0c5","_type":"span","marks":[],"text":"Separately, we shortened packet queuesâthe lines packets wait in between stages of the pipeline. The queues are there to absorb bursts of traffic. Testing showed that most of that depth went unused, while shorter queues meant less waiting time and less memory overhead."}],"markDefs":[],"style":"normal"},{"_key":"707f7e25d38c","_type":"block","children":[{"_key":"8ae83492dffd","_type":"span","marks":[],"text":"What do we do with all that freed-up memory space? We passed the savings on to some of the hardest-working nodes: subnet routers and app connectors."}],"markDefs":[],"style":"normal"},{"_key":"2e858c8e2de5","_type":"block","children":[{"_key":"73872bf6f68e","_type":"span","marks":[],"text":"Multi-queue for subnet routers, app connectors, and exit nodes"}],"markDefs":[],"style":"h2"},{"_key":"23c4c6180f13","_type":"block","children":[{"_key":"24b302a7d772","_type":"span","marks":["6e3e4bb444d8"],"text":"Subnet routers"},{"_key":"c03180e17131","_type":"span","marks":[],"text":" can look completely different across different tailnets. For someone running a small homelab network, a subnet router can easily handle a small set of "},{"_key":"53b318e573fc","_type":"span","marks":["code"],"text":"192.168.x.y"},{"_key":"df2fea2ca065","_type":"span","marks":[],"text":" non-Tailscale devices. A subnet router that fronts a cloud deployment, one with hundreds of peers, will carry substantially more traffic."}],"markDefs":[{"_key":"6e3e4bb444d8","_type":"link","href":"https://tailscale.com/docs/features/subnet-routers"}],"style":"normal"},{"_key":"dfec0660410f","_type":"block","children":[{"_key":"d2d5f751f18f","_type":"span","marks":[],"text":"Until recently, subnet routers, app connectors, and exit nodes processed packets for multiple independent streams in one ordered, single-thread pipeline. That meant a single lane was shared across many connections, because a receiving application must never see its own packets arrive out of order."}],"markDefs":[],"style":"normal"},{"_key":"ab022a62afbe","_type":"block","children":[{"_key":"d5a52e2df76b","_type":"span","marks":[],"text":"Having reduced our memory footprint, we had capacity to implement a multi-queue system: several lanes instead of one, scaled to the machineâs resources rather than the number of peers. Each stream of packets gets a lane and stays there, while the lanes run in parallel, allowing work to
1spread across CPU cores."}],"markDefs":[],"style":"normal"},{"_key":"981687845ace","_type":"assetBlock","asset":{"_type":"asset","alignment":"center","image":{"_type":"sanityImage","alt":"Diagram comparing single pipeline vs multi-queue processing architecture. Before: packets flow through one Reader to four Crypto stages then Writer to Devices. After: packets distributed across four parallel Reader-Crypto-Writer pipelines to Devices.","asset":{"_ref":"image-9949e454e4e84650f52821190d44aebd907262cf-1920x1080-svg","_type":"reference"}},"mobileImage":{"_type":"sanityImage","alt":"Diagram comparing single pipeline vs multi-queue processing architecture. Before: packets flow through one Reader to four Crypto stages then Writer to Devices. After: packets distributed across four parallel Reader-Crypto-Writer pipelines to Devices.","asset":{"_ref":"image-26080ff735d4c7c54f18f130d5e0fc5176b8dcda-3840x2160-png","_type":"reference"}},"placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":true,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"display":"block"},{"_key":"62bdbcea8ec3","_type":"block","children":[{"_key":"7ab956d965ba","_type":"span","marks":[],"text":"It results in higher aggregate capacity and lower delay between receiving and forwarding packets for subnet routers and app connectors. Hardware you already have gets used more efficiently. App connectors and exit nodes, typically serving many users with short-lived connections, get a particularly noticeable boost."}],"markDefs":[],"style":"normal"},{"_key":"29df581b6fe6","_type":"block","children":[{"_key":"72f6508b30af","_type":"span","marks":[],"text":"âThis translates into lower latency, essentially faster processing of data from the moment we read it off the wire to the moment we send it to the OS,â said Alex Valiushko, member of technical staff at Tailscale."}],"markDefs":[],"style":"normal"},{"_key":"82e618fbd65d","_type":"block","children":[{"_key":"b1f64c84cb88","_type":"span","marks":[],"text":"Throughput gains with "},{"_key":"6574c5d63ef7","_type":"span","marks":["code"],"text":"writev"}],"markDefs":[],"style":"h2"},{"_key":"cff07eba4acd","_type":"block","children":[{"_key":"7ac7fcb6463e","_type":"span","marks":[],"text":"Taking advantage of "},{"_key":"66c84ad39044","_type":"span","marks":["74e31c93f3eb"],"text":"Linuxâs "},{"_key":"fbed277c6b03","_type":"span","marks":["74e31c93f3eb","code"],"text":"writev"},{"_key":"c4861213cf5d","_type":"span","marks":["74e31c93f3eb"],"text":" capabilities"},{"_key":"9ff94fe9630a","_type":"span","marks":[],"text":" in the Tailscale client, Tailscale can pass multiple pieces of packet data to the Linux kernel in one operation, rather than having to copy and combine those pieces before passing them to the kernel. The v in "},{"_key":"b64406b39093","_type":"span","marks":["code"],"text":"writev"},{"_key":"93a3d83b883c","_type":"span","marks":[],"text":" stands for âvectorâ: Tailscale can describe separate pieces of data that need to be moved, without moving them. It means fewer copies of packet data in memory, fewer write operations, and higher throughput."}],"markDefs":[{"_key":"74e31c93f3eb","_type":"link","href":"https://linux.die.net/man/2/writev"}],"style":"normal"},{"_key":"27a39647e4dc","_type":"block","children":[{"_key":"a81b449cd000","_type":"span","marks":[],"text":"Faster startup with
1netmap caching"}],"markDefs":[],"style":"h2"},{"_key":"8a69d5fa6595","_type":"block","children":[{"_key":"d463d9e60462","_type":"span","marks":[],"text":"For now, these speed-ups are available only on Linux and, where applicable, Android systems. But weâve also been working on features that apply to other systems. Tailscale clients will soon be able to use "},{"_key":"fd6c94a649c4","_type":"span","marks":["strong"],"text":"netmap caching"},{"_key":"7c8aa5350dca","_type":"span","marks":[],"text":" to start more quickly in many conditions."}],"markDefs":[],"style":"normal"},{"_key":"8a49b0a54b4f","_type":"block","children":[{"_key":"571f24fa61d5","_type":"span","marks":[],"text":"A machine connecting to Tailscale usually starts by connecting to Tailscaleâs control plane, in something like 100 milliseconds on a typical network. The machine authenticates and gets a \"network map\" (netmap) describing the devices it can reach and how to reach them. This startup process should feel fast, maybe instantaneous, and with a good network connection, it typically does."}],"markDefs":[],"style":"normal"},{"_key":"7d0fb28527f8","_type":"block","children":[{"_key":"d97edadba6e6","_type":"span","marks":[],"text":"But when youâre on bad airplane Wi-Fi, or inside a hotel with aggressive filtering, or other not-great connectivity setups, it can take a while for the machine to reach the control planeâand sometimes you may not be able to reach it at all. Itâs often not obvious where the problem is, but the effect is that you canât reach other devices."}],"markDefs":[],"style":"normal"},{"_key":"444cce485d04","_type":"block","children":[{"_key":"a30423d0b290","_type":"span","marks":[],"text":"Even under ideal network conditions, 100 milliseconds of startup latency may be too much for some latency-sensitive workloads."}],"markDefs":[],"style":"normal"},{"_key":"525f0556e3ea","_type":"block","children":[{"_key":"c7f7e79db69d","_type":"span","marks":[],"text":"Netmap caching helps machines get connected when the control plane is not quickly reachable. When itâs enabled, each device on your tailnet stores a copy of the netmap on disk. When a device starts up, it can use that cached copy to establish connections with other devices on the tailnet, until itâs able to contact the control plane to get the latest info. (These connections are negotiated between the devices directly, and Tailscale does not see any of the traffic, as usual)."}],"markDefs":[],"style":"normal"},{"_key":"5b69bf77465f","_type":"block","children":[{"_key":"5d52ab5a9df2","_type":"span","marks":[],"text":"âBad network conditionsâthatâs really the space where people can get a lot of utility out of netmap caching,â said Claus Lensbøl, member of technical staff. â[A device client says], âYou know what? We havenât talked to control yet. Weâll probably get there soon. In the meantime, you can still start doing something.ââ"}],"markDefs":[],"style":"normal"},{"_key":"ee7519f633b0","_type":"block","children":[{"_key":"c55f7dce458b","_type":"span","marks":[],"text":"There are a few limitations. Caching can only work if the device has previously connected to the tailnet at least once, to fetch a network map from the control plane. In addition, netmap caching requires the device to have persistent disk space to store the cache. Weâve taken care to minimize unnecessary disk writes, but in some cases you may not want to enable it. For example, on exceptionally large tailnets, updating a cache may require a lot of disk traffic. Likewise, devices that use slow or wear-sensitive storage like SD cards may prefer not to enable netmap caching."}],"markDefs":[],"style":"normal"},{"_key":"9066b0dd3880","_type":"block","children":[{"_key":"2b4a3b05e21f","_type":"span","marks":[],"text":"For most devices on most tailnets, though, this feature can notably speed up how quickly devices can establish contact with each other at startup. Weâve seen tailnets with poor control plane reachability start sending through the data plane, on a âwarmâ cache start, one to two orders of magnitude faster than from a âcoldâ start. For devices facing variable startup latency, or far away from a DERP server or the control plane, the benefits are particularly tangible."}],"markDefs":[],"style":"normal"},{"_key":"bcf2fda47fc7","_type":"block","children":[{"_key":"22b136213dc0","_type":"span","marks":[],"text":"When you can see all these speed-ups"}],"markDefs":[],"style":"h2"},{"_key":"a0350c9b1df4","_type":"block","children":[{"_key":"096ef7cd96c7","_type":"span","marks":["strong"],"text":"Memory reduction"},{"_key":"71d7658e373d","_type":"span","marks":[],"text":" via buffer changes (Linux/Android) is expected in the v1.104 client."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"a8cc604847e0","_type":"block","children":[{"_key":"92beb3aa8762","_type":"span","marks":["strong"],"text":"Multi-queue "}
1,{"_key":"c66ada2d5dc0","_type":"span","marks":[],"text":"to benefit subnet routers and app connectors is planned for a release after v1.104."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"59ba2d715c0d","_type":"block","children":[{"_key":"22ffff90c91c","_type":"span","marks":["strong"],"text":"Throughput gains"},{"_key":"a13debfa1115","_type":"span","marks":[],"text":" (Linux/Android) were partially implemented in spring 2026; leveraging the additional gains in memory and throughput is planned for a release after v1.104."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"c239844c52d9","_type":"block","children":[{"_key":"e2c9f348048c","_type":"span","marks":["strong"],"text":"Netmap caching"},{"_key":"51d353b7423f","_type":"span","marks":[],"text":" is available as a feature flag in the current Tailscale client; it is expected to arrive by default in v1.104, following further testing. Mobile clients are expected to have the feature in a release after v1.104."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"cf3abef417e9","_type":"block","children":[{"_key":"eef87ffa51a4","_type":"span","marks":[],"text":"Performance is still difficult to diagnose and test"}],"markDefs":[],"style":"h2"},{"_key":"fb49a88fad4e","_type":"block","children":[{"_key":"290ae141cbb7","_type":"span","marks":[],"text":"Sure, we think Tailscale is fast. But you shouldnât have to trust us on that. Thatâs why weâre exploring a Tailscale-aware monitoring and testing toolkit. We want to give our customers the tooling they need to test, diagnose, and understand their network configuration, in a way thatâs Tailscale-native."}],"markDefs":[],"style":"normal"},{"_key":"9088b842f16f","_type":"block","children":[{"_key":"d46582fa1424","_type":"span","marks":[],"text":"Here are the gaps we see in modern performance testing:"}],"markDefs":[],"style":"normal"},{"_key":"5cc6909b89e8","_type":"block","children":[{"_key":"1e966137ccf7","_type":"span","marks":["strong"],"text":"Distribution tax:"},{"_key":"b401f7c2044f","_type":"span","marks":[],"text":" Most performance tooling is point-to-point, and requires you to install something on every endpoint."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"4b785acf82a4","_type":"block","children":[{"_key":"7c5edeb38ad1","_type":"span","marks":["strong"],"text":"Workflows are rigid:"},{"_key":"f28f0bf1ad83","_type":"span","marks":[],"text":" Itâs pretty easy to run the wrong test, get the wrong output, and chase a problem thatâs not there."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"b280cb850529","_type":"block","children":[{"_key":"adb5325c7b76","_type":"span","marks":["strong"],"text":"Protocol support:"},{"_key":"de11b1794865","_type":"span","marks":[],"text":" Many tools donât support newer protocols, such as QUIC and HTTP/3."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"4027d6ee734b","_type":"block","children":[{"_key":"3afbf33a9f36","_type":"span","marks":["strong"],"text":"Tailscale-awareness:"},{"_key":"bdc4dcc5e171","_type":"span","marks":[],"text":" General-purpose tooling is not Tailscale-native. It canât tell you if a connection is using DERP or is direct, whether a peer relay might help, or how the connection path changes over time."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"66dc4d63b8b1","_type":"block","children":[{"_key":"2bb1697c866f","_type":"span","marks":[],"text":"Existing tooling doesnât understand Tailscale-native paths and states. So weâre exploring tooling that does. "},{"_key":"9d24f4994faf","_type":"span","marks":["75d1b8a57690"],"text":"Help us shape the future"},{"_key":"5c7e7d8c220a","_type":"span","marks":[],"text":" of performance testing at Tailscale."}],"markDefs":[{"_key":"75d1b8a57690","_type":"link","href":"https://tailscale.typeform.com/performance"}],"style":"normal"}],"publishedAt":"2026-09-22T14:00:00.000Z","slug":{"_type":"slug","current":"making-tailscale-faster"},"title":"Weâre making Tailscale faster"},{"_id":"b5658952-36a7-4589-bb66-957fbe3a97c2","authors":[{"_createdAt":"2026-09-11T15:11:19Z","_id":"31846c4d-1b98-4a1f-abb6-4313d18e6ca7","_rev":"qMhYOtmktliqkMAkBB8fmN","_system":{"base":{"id":"31846c4d-1b98-4a1f-abb6-4313d18e6ca7","rev":"DDXnuH9MjhFVeQAXEhrWbN"}},"_type":"teamMember","_updatedAt":"2026-09-11T16:37:36Z","member":{"image":{"_type":"sanityImage","alt":"Andrew Cunningham, writer at Tailscale, wearing a black shirt on a white undershirt, against a black and white stairway and brick wall.","asset":{"_ref":"image-1a0c78173c67f3467037b9beee7d399eb7a253b1-2307x1823-jpg","_type":"reference"}},"jobTitle":"Content Marketing Specialist","name":"Andrew Cunningham"},"title":"Andrew Cunningham"}],"category":"insights","excerpt":"Built-in VPNs are easy to startâthen harder to live with.","featuredImage":{"_type":"sanityImage","alt":"WiFi router with four antennas in the center, connected to multiple devices on both sides: desktop computers, servers, tablets, and laptops shown as brown icons with white outlines against an orange circular background.","asset":{"_ref":"image-9fb2b752e1ffc9099058bc54bf6e2055008b22cc-1536x600-png","_type":"reference"}},"flexContent":[{"_key":"37fc5dd5223b","_type":"block","children":[{"_key":"62e404b05045","_type":"span","marks":[],"text":"Just about every home office, small business, or just-getting-on-its-feet startup is going to have at least one Wi-Fi router, and many will use some kind of network-attached storage (NAS) device for shared files. The latter is particularly useful if youâve got data you donât want to store with Google, Microsoft, Apple, Dropbox, or some other cloud storage provider that will charge you monthly for the privilege."}],"markDefs":[],"style":"normal"},{"_key":"f6bf7e96154a","_type":"block","children":[{"_key":"2c479db5fbf3","_type":"span","marks":[],"text":"Many of these networked devices offer additional features beyond the basic rout
1ing of network traffic or storage of bits and bytes. One of those is the ability to function as a VPN server. This allows devices outside of your network to access resources inside, and provides an additional layer of security on untrusted, unencrypted airport and coffee shop Wi-Fi networks."}],"markDefs":[],"style":"normal"},{"_key":"18d88f248d28","_type":"block","children":[{"_key":"08c0b875e35e","_type":"span","marks":[],"text":"These VPN services can be okay, for limited use. They donât require additional hardware purchases. And many recent models even support the same encrypted WireGuard® tunnels on which Tailscale is built. There was a time in my life where my Netgear router was providing VPN service for my home network; similar services are provided by routers from TP-Link and Asus, as well as NAS devices from Synology and QNAP. And it worked fine!"}],"markDefs":[],"style":"normal"},{"_key":"4e158ae73fae","_type":"block","children":[{"_key":"4a4701c5f196","_type":"span","marks":[],"text":"Except for the times when it didnât."}],"markDefs":[],"style":"normal"},{"_key":"b7a80ba53cee","_type":"block","children":[{"_key":"a9f3cc1213f5","_type":"span","marks":[],"text":"There are many individual reasons why I donât recommend a built-in router or NAS offering as a VPN server, but most of them fall under four headings: reliability, performance, security, and ease of use. Letâs look at these things one at a time, and talk about when and "},{"_key":"f722504235ad","_type":"span","marks":["679e8745dce8"],"text":"how Tailscale provides a better solution"},{"_key":"3611d98e93a7","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"679e8745dce8","_type":"link","href":"https://tailscale.com/contact/sales"}],"style":"normal"},{"_key":"46823f4f6f82","_type":"block","children":[{"_key":"59a752553ae4","_type":"span","marks":[],"text":"Reliability"}],"markDefs":[],"style":"h2"},{"_key":"c6e88b06b29b","_type":"block","children":[{"_key":"9e5f67fdcfe5","_type":"span","marks":[],"text":"Your router or NAS devices generally streamline most of the steps that make setting up your own VPN server a painâdownloading the right software packages and generating keys and so on. But they arenât doing anything to facilitate connections between devices. Even with everything configured properly on your VPN serverâs end, these OpenVPN or WireGuard-based solutions donât offer ways around a restrictive NAT."}],"markDefs":[],"style":"normal"},{"_key":"072443ad75e0","_type":"block","children":[{"_key":"30f61a806a0d","_type":"span","marks":[],"text":"My self-hosted VPN would frequently fail to connect on airplane Wi-Fi networks, or when I was using my phoneâs hotspot feature. Or it would appear to connect, but then struggle to load webpages until I turned it off."}],"markDefs":[],"style":"normal"},{"_key":"30d59faa768c","_type":"block","children":[{"_key":"a97d7ad19068","_type":"span","marks":[],"text":"And when my VPN client wouldnât connect, there wasnât a whole lot I could do about it. Assuming you and your users need to use the internet for something, theyâll likely just use the network without the VPN enabled, which defeats the purpose."}],"markDefs":[],"style":"normal"},{"_key":"e92822a2594b","_type":"block","children":[{"_key":"aed7ac46cdbd","_type":"span","marks":[],"text":"Hosting your VPN service on your router or NAS device also introduces what IT types call a âsingle point of failureââone thing that can knock out multiple services if something goes wrong. Did an automatic firmware update restart your router while you were in the middle of a file transfer? Is your NAS down for maintenance because a drive went bad? Well, now your VPN is down too."}],"markDefs":[],"style":"normal"},{"_key":"50cd18ebe16b","_type":"block","children":[{"_key":"7ff8eed8b80e","_type":"span","marks":[],"text":"Performance"}],"markDefs":[],"style":"h2"},{"_key":"0b66bdfd4de8","_type":"block","children":[{"_key":"5249da2b1036","_type":"span","marks":[],"text":"Dedicated router and NAS boxes have CPUs and memory, just like your computer or phone. But these components are usually exactly as fast as they need to be for the device to perform its core routing or drive-handling functionsâthey donât have much power to spare."}],"markDefs":[],"style":"normal"},{"_key":"0e69df9ec3f7","_type":"block","children":[{"_key":"70410bd15aa9","_type":"span","marks":[],"text":"A single VPN connection isnât hugely resource-intensive. But once you have multiple users and devices attempting to connect to your VPN server at the same time, the weak processor in your router or dedicated NAS box will struggle to keep up. Your users will notice more latency and slower speedsâweb pages that take longer to load, file transfers that take longer to complete, and frustrating inconsistency."}],"markDefs":[],"style":"normal"},{"_key":"803cd7bc8355","_type":"block","children":[{"_key":"30217993e9ff","_type":"span","marks":[],"text":"Another limitation is your actual internet connection. For home and business connections via cable providers like Comcast, the advertised connection speeds youâre paying for often only apply to your download speeds. Your upload speeds are typically a fraction of thatâa 2 Gbps Comcast Business plan in my area, for example, only offers 300 Mbps upload speeds."}],"markDefs":[],"style":"normal"},{"_key":"addb19bf2339","_type":"block","children":[{"_key":"a6cc8e485536","_type":"span","marks":[],"text":"Thatâs a problem if youâre trying to provide a VPN service, because all traffic is routed through the internet connection that router or NAS is using. In a best-case scenario, your bandwidth will be limited to that connectionâs upload speed. 300 Mbps isnât bad for a device or three, but if youâre splitting that bandwidth between more users or devices, youâre looking at another bottleneck. (Fiber internet plans like Verizon FIOS usually offer symmetrical download and upload speeds, something to consider if fiber is available in your area.)"}],"markDefs":[],"style":"normal"},{"_key":"4eaa3a387268","_type":"block","children":[{"_key":"cdfcbf35a1ea","_type":"span","marks":[],"text":"The last thing to consider: what kind of VPN server can your router or NAS device host? Is it OpenVPN? Because OpenVPN, for te
1chnical reasons we wonât get into, is generally slower than the WireGuard protocol that Tailscale uses."}],"markDefs":[],"style":"normal"},{"_key":"ad0913176984","_type":"assetBlock","asset":{"_type":"asset","alignment":"center","image":{"_type":"sanityImage","alt":"NETGEAR Nighthawk RAX20 router VPN Service configuration interface displaying OpenVPN setup options, TUN/TAP mode protocols, and client access settings for secure network connectivity on home and internet networks.","asset":{"_ref":"image-d463dc96da438038b5c75a893b7f051e3b494429-2784x2820-png","_type":"reference"}},"placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"display":"block"},{"_key":"68583431ad9e","_type":"block","children":[{"_key":"8ede861b73e6","_type":"span","marks":[],"text":"Security"}],"markDefs":[],"style":"h2"},{"_key":"dbc6e5d9025e","_type":"block","children":[{"_key":"e07e28ba6a68","_type":"span","marks":[],"text":"If your router or NAS device offers WireGuard compatibility, you can usually be confident that your VPN connections are securely encrypted. But the reality is that any internet-connected device is going to have security flaws. Addressing those flaws will require fixes, and being able to install those fixes will require your router or NAS manufacturer to release software and firmware updates that include them."}],"markDefs":[],"style":"normal"},{"_key":"1572e587510f","_type":"block","children":[{"_key":"2a6310107249","_type":"span","marks":[],"text":"There are networking companies that are pretty good about releasing security updates and communicating when you can expect security updates to stop. Synology, QNAP, and Amazonâs Eero maintain detailed support documentation that spells out exactly when users can expect security patches to dry up."}],"markDefs":[],"style":"normal"},{"_key":"5cb42a576828","_type":"block","children":[{"_key":"f25c2812d0a3","_type":"span","marks":[],"text":"But most router makers are less diligent. Ubiquiti maintains a list of âvintageâ products that are no longer being sold but are still getting updates, and âlegacyâ products that generally arenât being maintained. Asus also has an âend-of-life product listâ for routers that are no longer being updated. But neither makes any promises about how long devices have before they end up on those lists."}],"markDefs":[],"style":"normal"},{"_key":"d2c9902e9f5c","_type":"block","children":[{"_key":"17b11e2d3f03","_type":"span","marks":[],"text":"Both TP-Link and Netgear stop supporting routers three years after their âlast saleâ or âend-of-saleâ date. But Netgear in particular is noncommittal about this, saying only that these devices âmayâ receive âcritical bug fixes and security patches as determined by Netgear.â And TP-Link has a habit of selling multiple revisions of a router with the same model number, making it especially hard to tell whether youâre getting something thatâs actively supported or not."}],"markDefs":[],"style":"normal"},{"_key":"6962c56d3235","_type":"block","children":[{"_key":"44be164db88f","_type":"span","marks":[],"text":"All of this is to say that, for consumer routers in particular, youâre buying hardware that may receive critical security patches rarely and sporadically, and you wonât always know whether or when your support window has closed. For mission-critical infrastru
1cture, this is what people in IT call âless than ideal.â"}],"markDefs":[],"style":"normal"},{"_key":"24fbeeba6908","_type":"block","children":[{"_key":"0a7cada69b01","_type":"span","marks":[],"text":"Ease of use"}],"markDefs":[],"style":"h2"},{"_key":"dd07cd71a056","_type":"block","children":[{"_key":"b683711dd1ef","_type":"span","marks":[],"text":"Security isnât just about patches; itâs also about administration. If you arenât on top of changing or deleting profiles on the VPN server when people no longer need access, or limiting access to critical resources that not everyone needs to be able to use, youâre also opening yourself up to security breaches."}],"markDefs":[],"style":"normal"},{"_key":"f313788278f7","_type":"block","children":[{"_key":"940753860212","_type":"span","marks":[],"text":"Not every standalone VPN server works the same way, but hereâs what administration looks like if you have a WireGuard-based VPN server on your router or NAS. For every user or device you want to connect to your VPN, you have to create a profile. This profile tells the client system how to find the VPN server, and helps the VPN server identify which client itâs talking to. Users or administrators have to install these profiles on their devices, either manually or by scanning a QR code. If you want to restrict access to certain servers, apps, or other network resources, this is usually done by maintaining a list of allowed IP addresses for each profile youâre creating. You may also need to open ports on your router to allow VPN traffic through its firewall, depending on how itâs set up."}],"markDefs":[],"style":"normal"},{"_key":"a79d711d1904","_type":"block","children":[{"_key":"04b3366b1f17","_type":"span","marks":[],"text":"Once youâve done all of "},{"_key":"5daac824743f","_type":"span","marks":["em"],"text":"that"},{"_key":"558b4ca1711a","_type":"span","marks":[],"text":", youâve now got "},{"_key":"e88b8abab61d","_type":"span","marks":["d57911e4327f"],"text":"a new system to maintain"},{"_key":"0b789f8ec6f0","_type":"span","marks":[],"text":", totally separate from whatever other applications and accounts youâre using for communication or managing your devices or anything else. And as your business changes and grows, the work of adding and removing and distributing profiles, changing access permissions, and general troubleshooting is going to add up."}],"markDefs":[{"_key":"d57911e4327f","_type":"link","href":"https://tailscale.com/compare/build-it-yourself"}],"style":"normal"},{"_key":"15434865bb05","_type":"block","children":[{"_key":"8b59082963b5","_type":"span","marks":[],"text":"Itâs this kind of overhead and complexity that can lead to bad decisions, things like ânot removing profiles or revoking permissions when people donât need them anymoreâ or âjust giving out a couple of profiles for multiple people so you donât have to fiddle with things so much.â"}],"markDefs":[],"style":"normal"},{"_key":"531de1db47d3","_type":"block","children":[{"_key":"6c0a845a4039","_type":"span","marks":[],"text":"How Tailscale fixes it"}],"markDefs":[],"style":"h2"},{"_key":"cac3a5c4c7a0","_type":"block","children":[{"_key":"01f73c481639","_type":"span","marks":[],"text":"At this point Iâve either convinced you that itâs time to switch away from the VPN built into your router or NAS, or Iâve scared you away from trying it in the first place. Now what?"}],"markDefs":[],"style":"normal"},{"_key":"a9381d06cc9a","_type":"block","children":[{"_key":"49b60333ce78","_type":"span","marks":[],"text":"Tailscale VPN was designed to address the problems with these kinds of centralized, legacy VPN servers. For starters, thereâs no need to run a âserverâ in the first place. You install the Tailscale client on any two devices, sign in with your existing single-sign-on (SSO) identity provider (this can be Google, Microsoft, Apple, or many other kinds of accounts youâre already using), and youâve created your first âtailnet.â"}],"markDefs":[],"style":"normal"},{"_key":"8a3a1c1877fe","_type":"block","children":[{"_key":"7c02877bd5bc","_type":"span","marks":[],"text":"Tailscaleâs infrastru
1cture handles the control plane that allows these devices to find each other, and this establishes a direct peer-to-peer connection between devices for data transfers. Thereâs no underpowered CPU to overload, no software or firmware to patch, and no single internet connection to oversaturate with simultaneous requests. Our control planeâs "},{"_key":"20a11ea844fe","_type":"span","marks":["47e088e002de"],"text":"NAT traversal mechanisms"},{"_key":"ec7cb6dad9dc","_type":"span","marks":[],"text":" help get you a fast, reliable connection on many networks where traditional VPNs (especially basic self-hosted VPNs) donât work."}],"markDefs":[{"_key":"47e088e002de","_type":"link","href":"https://tailscale.com/blog/how-nat-traversal-works"}],"style":"normal"},{"_key":"4c1cc6084ad8","_type":"block","children":[{"_key":"7dfa1fa38f4d","_type":"span","marks":[],"text":"Those peer-to-peer connections also help performance in a couple ways. For one, direct connections are generally faster all-around than connections with a VPN server in the middleâyouâre limited only by the speed of both devicesâ internet connections and the physical distance between them. For the other, Tailscale creates a âsplit tunnelâ by default, which means that only data traveling between nodes on the tailnet actually uses those encrypted tunnels. The rest of your internet traffic flows as it normally would, so even a poor or slow connection on one side isnât going to slow normal downloads or webpage navigation to a crawl."}],"markDefs":[],"style":"normal"},{"_key":"fd3b6cb854c9","_type":"block","children":[{"_key":"6b49ae082298","_type":"span","marks":[],"text":"Because you and your users are signing in through your existing identity provider, it also means no more profiles to create, edit, distribute, or delete. Access to your tailnet is granted and disappears along with their user account. And permissions are managed in one central console, where you can assign privileges to individuals or groups of people, or restrict access to servers or other resources, using Tailscaleâs powerful and flexible grants and tags. Groups youâve already configured in your identity provider can be used as a starting point, if you have them."}],"markDefs":[],"style":"normal"},{"_key":"56bc78ab71c6","_type":"block","children":[{"_key":"4ab1a3972b40","_type":"span","marks":[],"text":"That kind of flexibility extends to other areas of Tailscale. Need to offer your users a way to encrypt all their traffic on public Wi-Fi networks in airports or coffee shops, not just their Tailscale connection? Use Tailscaleâs Mullvad VPN integration or configure an exit node, which can turn almost any node in your tailnet into a traditional VPN server, even the Apple TV box in the conference room. Need to connect to a printer, or some other simple networked appliance? Use a subnet router to get those devices in your tailnet without sacrificing security. Use MagicDNS to make resources available via human-readable URLs rather than hard-to-remember IP addresses."}],"markDefs":[],"style":"normal"},{"_key":"107565c092a2","_type":"block","children":[{"_key":"f8d6c54a019c","_type":"span","marks":[],"text":"The bottom line"}],"markDefs":[],"style":"h2"},{"_key":"f8cd23b3c68a","_type":"block","children":[{"_key":"c33844e8c07c","_type":"span","marks":[],"text":"It might be tempting to just use the VPN functionality that came with a thing you already paid for, but the theoretical convenience is easily outweighed by the real-world headaches. The feature will be a pain to administer, especially for quickly growing teams; you may leave yourself open to security vulnerabilities; youâll deal with hit-or-miss performance and you may be unable to connect on any networks that block VPNs (intentionally or otherwise)."}],"markDefs":[],"style":"normal"},{"_key":"cb9d677021d7","_type":"block","children":[{"_key":"674d79ee1921","_type":"span","marks":[],"text":"Tailscale simplifies or eliminates all of the most frustrating problems. Granting and restricting access is centrally managed, and your users can use the same accounts they already use for email or other services. There are fewer potential performance bottlenecks, and Tailscaleâs NAT traversal will help you get a connection on virtually any network. And setting up and rolling out Tailscale is easyâeven if you rely on an external
1contractor for IT support, or donât have any IT support at all."}],"markDefs":[],"style":"normal"},{"_key":"7f9cb7b7dbcf","_type":"block","children":[{"_key":"27fb42e9fd0b","_type":"span","marks":[],"text":"Tailscaleâs Personal plan supports up to six user accounts and unlimited devices, making it great for small teams or internal testing. And we offer a full range of paid plans with different features and usage limits so that your Tailscale setup can⦠scale, right alongside your business."}],"markDefs":[],"style":"normal"},{"_key":"bd2327a0d3e2","_type":"block","children":[{"_key":"38faa5bdafee","_type":"span","marks":[],"text":"\n"}],"markDefs":[],"style":"normal"}],"publishedAt":"2026-09-11T16:00:00.000Z","slug":{"_type":"slug","current":"built-in-router-nas-vpns"},"title":"Your built-in router VPN might be more trouble than itâs worth"},{"_id":"6dac3217-881e-4bc9-8dd7-6c07ecbbce34","authors":[{"_createdAt":"2026-02-19T18:20:06Z","_id":"086dd538-86db-4bf1-9e94-39bc343a6f60","_rev":"ziGi2Nuqopb4d4lMbsLaGw","_system":{"base":{"id":"086dd538-86db-4bf1-9e94-39bc343a6f60","rev":"PmlDDBV8ZhCyKPV7rW6ajy"}},"_type":"teamMember","_updatedAt":"2026-09-08T19:33:47Z","member":{"image":{"_type":"sanityImage","alt":"Image of author Mike Stefaniak","asset":{"_ref":"image-84b1a42778d620afcb6edba03cdf6f4ad7af7038-512x512-jpg","_type":"reference"}},"jobTitle":"Product Manager, Kubernetes","name":"Mike Stefaniak"},"title":"Mike Stefaniak"}],"category":"product","excerpt":"Faster cross-cluster connections, fewer IPv6 dead ends, less certificate churn.","featuredImage":{"_type":"sanityImage","alt":"Blue hexagonal logo with grid of nine circles, signifying Tailscale Kubernetes Operator 1.102 and its new features.","asset":{"_ref":"image-f4b28ad61933641311e5c47c801dc5a54adf8253-1536x600-png","_type":"reference"}},"flexContent":[{"_key":"79f7f78841fb","_type":"block","children":[{"_key":"d737a9ef747e","_type":"span","marks":[],"text":"Over the past few months, weâve chosen to tackle some of the most stubborn issues of the "},{"_key":"334730613ca8","_type":"span","marks":["439b9cf07195"],"text":"Tailscale Kubernetes Operator"},{"_key":"7d6dfa22b066","_type":"span","marks":[],"text":" to improve performance, connectivity, and scale:"}],"markDefs":[{"_key":"439b9cf07195","_type":"link","blank":true,"href":"https://tailscale.com/docs/kubernetes-operator"}],"style":"normal"},{"_key":"a3192148645d","_type":"block","children":[{"_key":"872e4e13447e","_type":"span","marks":[],"text":"Cross-cluster connections being routed through "},{"_key":"29b17bdc206a","_type":"span","marks":["d408c187590a"],"text":"DERP servers"}],"level":1,"listItem":"bullet","markDefs":[{"_key":"d408c187590a","_type":"link","href":"https://tailscale.com/docs/reference/derp-servers"}],"style":"normal"},{"_key":"1e41dccf08bb","_type":"block","children":[{"_key":"5f6f81baea80","_type":"span","marks":[],"text":"IPv6 connectivity"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"37ac7abda757","_type":"block","children":[{"_key":"1f5be5f5f5b7","_type":"span","marks":[],"text":"Letâs Encrypt rate limiting"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"c5449908466a","_type":"block","children":[{"_key":"7199ba214916","_type":"span","marks":[],"text":"While IPv4/IPv6 connectivity and Letâs Encrypt rate limits are not completely solved problems, our optimizations and fixes contained in the 1.102 release should significantly reduce how often users are blocked from connectivity and deployment. For multi-cluster environments, the new in-cluster peer relays will reduce the configuration burden of direct multi-cluster connectivity, even in difficult network scenarios such as VPCs."}],"markDefs":[],"style":"normal"},{"_key":"87bf4daa8cf1","_type":"block","children":[{"_key":"5b71a98cbf88","_type":"span","marks":[],"text":"In-cluster Tailscale Peer Relays"}],"markDefs":[],"style":"h2"},{"_key":"a9c1a8552949","_type":"block","children":[{"_key":"60bd5752c57e","_type":"span","marks":[],"text":"In many cases, Kubernetes clusters are deployed into virtual private cloud (VPC) networks and are unable to communicate directly with each other without setting up explicit rules in the network firewall. To enable communication regardless of firewall rules, Tailscale uses a "},{"_key":"2b560a08a03a","_type":"span","marks":["9e6938d006af"],"text":"DERP server"},{"_key":"bcf3733af2e5","_type":"span","marks":[],"text":" as a relay to establish a connection. Connection speeds are much lower than a direct connection, so you would typically set up a "},{"_key":"cddd7561b904","_type":"span","marks":["3b3d719b4a97"],"text":"Tailscale Peer Relay"},{"_key":"04f39d24fb43","_type":"span","marks":[],"text":" to help facilitate a direct connection to improve performance."}],"markDefs":[{"_key":"9e6938d006af","_type":"link","href":"https://tailscale.com/docs/reference/derp-servers"},{"_key":"3b3d719b4a97","_type":"link","href":"https://tailscale.com/docs/features/peer-relay"}],"style":"normal"},{"_key":"b0d033b288e5","_type":"block","children":[{"_key":"6bde5f09cba5","_type":"span","marks":[],"text":"Before 1.102, you could technically deploy a peer relay inside or outside your cluster to enable direct connections between clusters. However, we have heard from you that setting up a peer relay to work with Kubernetes clusters can be a headache, requiring manual configuration of a Tailscale client completely separate from the Operator."}],"markDefs":[],"style":"normal"},{"_key":"744348798003","_type":"block","children":[{"_key":"cd3a72b1144c","_type":"span","marks":[],"text":"With Tailscale Peer Relays In 1.102, you can now deploy peer relays in your cluster
1s using our new custom resource, "},{"_key":"41694b7b42b3","_type":"span","marks":["code"],"text":"PeerRelay"},{"_key":"ea26a4513f7b","_type":"span","marks":[],"text":", for the Kubernetes Operator. When defined, the Kubernetes Operator will deploy and maintain each peer relay for you, with little configuration:"}],"markDefs":[],"style":"normal"},{"_key":"ae26324d124f","_type":"code","code":"apiVersion: tailscale.com/v1alpha1\nkind: PeerRelay\nmetadata:\n name: my-relay\nspec:\n replicas: 2","language":"yaml"},{"_key":"6879f20e7c75","_type":"block","children":[{"_key":"0c9ff69d4ed7","_type":"span","marks":[],"text":"You can also supply additional configuration such as tags, "},{"_key":"79158e8337cc","_type":"span","marks":["code"],"text":"proxyClass"},{"_key":"bdd2039daafb","_type":"span","marks":[],"text":" inheritance, and tailnet by referencing our "},{"_key":"c89e8b8dfda6","_type":"span","marks":["058ffecbb1de"],"text":"custom resource API"},{"_key":"db1852adf1a9","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"058ffecbb1de","_type":"link","href":"https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#peerrelayspec"}],"style":"normal"},{"_key":"2bc0b83c6a3e","_type":"block","children":[{"_key":"b542f05d6320","_type":"span","marks":[],"text":"IPv6 connectivity"}],"markDefs":[],"style":"h2"},{"_key":"b1bff15862fe","_type":"block","children":[{"_key":"1769a0cf666c","_type":"span","marks":[],"text":"IPv6 connectivity, especially enabling connectivity between IPv4 clients and IPv6 workloads, can be tricky in Kubernetes. This has also been true of the Tailscale Kubernetes Operator, as we rely on "},{"_key":"d04b3df533be","_type":"span","marks":["code"],"text":"iptables"},{"_key":"d0c24180c20c","_type":"span","marks":[],"text":" and "},{"_key":"b97a93905173","_type":"span","marks":["code"],"text":"nftables"},{"_key":"183d338c0a1a","_type":"span","marks":[],"text":" to perform routing within the cluster. If you are not running a dual-stack cluster with both IPv4 and IPv6, you cannot route with the IP set you donât have, and connections from clients can never be established."}],"markDefs":[],"style":"normal"},{"_key":"8153740b382e","_type":"block","children":[{"_key":"9814c8c80236","_type":"span","marks":[],"text":"Even given those limitations, there was support missing around IPv6, which weâve included in this release. Firstly, we added support for the ProxyGroup Egress to egress to IPv6 destinations. Previously, only an IPv4 address was a valid destination, which included Tailscale servicesâ IPv4 address."}],"markDefs":[],"style":"normal"},{"_key":"d4abfcbc8670","_type":"block","children":[{"_key":"cd8d6d349949","_type":"span","marks":[],"text":"However, if you needed to connect to a destination that only supported IPv6 on incoming connections, such as our "},{"_key":"15b59be8ee41","_type":"span","marks":["f2654bae54d0"],"text":"4via6 subnet routers"},{"_key":"b8f03083b895","_type":"span","marks":[],"text":", you would not be able to establish a connection. Most of Tailscale is compatible with both IPv4 and IPv6, but on large networks with isolated sub-networks, you may run into cases where your IPv4 addresses overlap. In this case, a 4via6 subnet router can bridge that connection by exposing an IPv6 address for an IPv4 destination. As of 1.102, we now support this functionality in the Kubernetes Operator, enabling connections where IPv4 ranges overlap."}],"markDefs":[{"_key":"f2654bae54d0","_type":"link","href":"https://tailscale.com/docs/features/subnet-routers/4via6-subnets"}],"style":"normal"},{"_key":"61235845f462","_type":"block","children":[{"_key":"c960c7f2ca3c","_type":"span","marks":[],"text":"Letâs Encrypt rate limit optimizations"}],"markDefs":[],"style":"h2"},{"_key":"9910ae3c1bf1","_type":"block","children":[{"_key":"2127294227ed","_type":"span","marks":[],"text":"When you use Tailscale, every node in your Tailscale network (tailnet) is given a MagicDNS name. In order for those MagicDNS names to be used for TLS connections, each node needs its own certificate for the hostname it was assigned. These certificates are issued by the open Certificate Authority, "},{"_key":"a377bb2bb973","_type":"span","marks":["9670c7e1cc2f"],"text":"Letâs Encrypt"},{"_key":"313db171981d","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"9670c7e1cc2f","_type":"link","href":"https://letsencrypt.org/about/"}],"style":"normal"},{"_key":"e64f8b904af8","_type":"block","children":[{"_key":"eaaff706064b","_type":"span","marks":[],"text":"As a free public service run by the "},{"_key":"e75c19b79087","_type":"span","marks":["099e5087b8b8"],"text":"Internet Security Research Group (ISRG)"},{"_key":"62d14c6fbb9b","_type":"span","marks":[],"text":", there are various "},{"_key":"7f8ac32b590a","_type":"span","marks":["e2610679990c"],"text":"rate limits"},{"_key":"e13287967bef","_type":"span","marks":[],"text":" placed on its usage to ensure the service remains available for everyone. As tailnets become larger, and especially as large automated deployments become more common, itâs likely
1you may run into some of them. The most common is a 50-certificate per registered domain per week limit that is reset only after seven days. This issue can be crippling when trying to roll Tailscale out across a large network in a short time period."}],"markDefs":[{"_key":"099e5087b8b8","_type":"link","href":"https://www.abetterinternet.org/"},{"_key":"e2610679990c","_type":"link","href":"https://letsencrypt.org/docs/rate-limits/"}],"style":"normal"},{"_key":"c2533bb8ea22","_type":"block","children":[{"_key":"53680e479384","_type":"span","marks":[],"text":"While you can request a "},{"_key":"ef3c78927b40","_type":"span","marks":["b3acf5e0da53"],"text":"rate limit override"},{"_key":"1d907aeaa8d0","_type":"span","marks":[],"text":" from Letâs Encrypt, we wanted to provide a smoother experience before you need to increase your limit, while also being better citizens of the Letâs Encrypt platform. So weâve made a series of small optimizations to how we acquire certificates in the Kubernetes Operator:"}],"markDefs":[{"_key":"b3acf5e0da53","_type":"link","href":"https://isrg.formstack.com/forms/rate_limit_adjustment_request"}],"style":"normal"},{"_key":"f563f03f7258","_type":"block","children":[{"_key":"e06975ea11ee","_type":"span","marks":[],"text":"Certificate renewal retries now follow a backoff schedule instead of a fixed interval."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"d7ba611efbee","_type":"block","children":[{"_key":"28cdd82ba246","_type":"span","marks":[],"text":"When available, "},{"_key":"66a27a0797b3","_type":"span","marks":["code"],"text":"Retry-After"},{"_key":"8d4ba15977e6","_type":"span","marks":[],"text":" headers are now used, which avoids tight retry loops that made rate-limit backoffs worse."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"08ea8c610e76","_type":"block","children":[{"_key":"0fe5c2509706","_type":"span","marks":[],"text":"The per-attempt cert issuance timeout is increased to 30 minutes to avoid premature timeouts on ACME challenges."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"66e3dc7b6ecf","_type":"block","children":[{"_key":"e0cf8621c0e4","_type":"span","marks":[],"text":"Cert issuance for multiple domains now runs in parallel instead of one at a time, preventing the provisioning of many domains from stalling each cert behind the previous one."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"8f2fefcaf2c1","_type":"block","children":[{"_key":"fbb1c8e45ea9","_type":"span","marks":[],"text":"During Ingress deletion, VIPServices are now prevented from acquiring new certificates, avoiding wasting Letâs Encrypt rate-limit quota. This is especially prevalent in ephemeral deployments."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"c5914545d85c","_type":"block","children":[{"_key":"feb59d87314d","_type":"span","marks":[],"text":"We have one more optimization coming in 1.104 that will improve how certificate renewals are counted towards your rate limits. Even with all these optimizations, limits can still be encountered. We are also working on another solution that I hope to be able to share soon. In the meantime, if you are still running into rate limit issues with Letâs Encrypt, we recommend formally requesting a "},{"_key":"e74d8f13012a","_type":"span","marks":["2bdcb09b2766"],"text":"rate limit override"},{"_key":"3f4d4fa71937","_type":"span","marks":[],"text":" from Letâs Encrypt for your tailnet."}],"markDefs":[{"_key":"2bdcb09b2766","_type":"link","href":"https://isrg.formstack.com/forms/rate_limit_adjustment_request"}],"style":"normal"},{"_key":"5507f6ffb7c3","_type":"block","children":[{"_key":"cde4202e4c09","_type":"span","marks":[],"text":"Whatâs next?"}],"markDefs":[],"style":"h2"},{"_key":"15c68aef02d3","_type":"block","children":[{"_key":"540b65e0935e","_type":"span","marks":[],"text":"Our next release cycle for the Tailscale Kubernetes Operator will be primarily focused on improving our end-to-end testing infrastructure, Letâs Encrypt account key sharing, and fixing a few stubborn bugs. In the background, weâre working on longer-term solutions for Letâs Encrypt limits, installation for OpenShift and GKE, and planning our biggest improvement since the operatorâs inception."}],"markDefs":[],"style":"normal"},{"_key":"2f831fad0bc0","_type":"block","children":[{"_key":"508ff07579e3","_type":"span","marks":[],"text":"Today, we have a few common problems that the operator struggles with, primarily due to its architecture:"}],"markDefs":[],"style":"normal"},{"_key":"9024b84fc972","_type":"block","children":[{"_key":"a7c5e040545d","_type":"span","marks":[],"text":"Egress to any tailnet resource requires explicit setup, per endpoint and per namespace."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"cf553059316c","_type":"block","children":[{"_key":"81f5e6bd1de4","_type":"span","marks":[],"text":"Access controls can only target the ProxyGroup rather than the workload."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"56458ffd6c1d","_type":"block","children":[{"_key":"59e38f5733e7","_type":"span","marks":[],"text":"Using IPv4 and IPv6 interchangeably between clients and clusters is difficult."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"682fcf579187","_type":"block","children":[{"_key":"6d8f98a0960a","_type":"span","marks":[],"text":"Cluster workloads bypass connectors without a steering mechanism."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"ca78b71f6897","_type":"block","children":[{"_key":"4155e76026ba","_type":"span","marks":[],"text":"To solve these problems, we need a deeper way to route traffic, beyond what "}
1,{"_key":"6bc67cf6d3b0","_type":"span","marks":["code"],"text":"iptables"},{"_key":"278aa573853e","_type":"span","marks":[],"text":" and "},{"_key":"4bad40ab6eb3","_type":"span","marks":["code"],"text":"nftables"},{"_key":"10e139b89745","_type":"span","marks":[],"text":" are capable of. This means for ingress and egress, a Container Network Interface (CNI) is required. We also need a way to assign identities to workloads within the cluster without resorting to sidecars. All of this leads us to a new architecture: something between a traditional gateway proxy and a full sidecar mesh."}],"markDefs":[],"style":"normal"},{"_key":"6e5bd69c532d","_type":"block","children":[{"_key":"0dcd269b684c","_type":"span","marks":[],"text":"One problem we need to tackle first is the requirement to create a new tag in "},{"_key":"66117071ede6","_type":"span","marks":["code"],"text":"tagOwners"},{"_key":"a8cf75ae0622","_type":"span","marks":[],"text":" for every new tag created in the tailnet. Our goal is for every workload in Kubernetes to have its own identity for access controls. Today, that means tagging the workload with a Tailscale tag to grant access via the "},{"_key":"3ec01b7a0ea9","_type":"span","marks":["2d39fe5291de"],"text":"ACL"},{"_key":"f22d84529a82","_type":"span","marks":[],"text":". Typically for application teams, this requires a ticket to your Tailscale admin to create the new tag for you. That pattern becomes cumbersome when you have automated deployments, even outside of Kubernetes, constantly requiring new tags."}],"markDefs":[{"_key":"2d39fe5291de","_type":"link","href":"https://tailscale.com/docs/features/access-control/acls"}],"style":"normal"},{"_key":"f93571663e18","_type":"block","children":[{"_key":"623deebc6fde","_type":"span","marks":[],"text":"Thatâs why we are building pattern-based tag ownership into Tailscaleâs ACL. This will allow you to specify ownership for a pattern of tags, effectively granting ownership over a predetermined scope for application teams and operators. Once granted, the owner will be able to create as many tags as needed under the pattern specified in the "},{"_key":"5b80acea031f","_type":"span","marks":["code"],"text":"tagOwners"},{"_key":"218241b75017","_type":"span","marks":[],"text":" section. If you have ephemeral or automated infrastructure deployment as a service within your organization, even outside of Kubernetes, this change is for you."}],"markDefs":[],"style":"normal"},{"_key":"d6956e6719ce","_type":"block","children":[{"_key":"7333eaa8fa7f","_type":"span","marks":[],"text":"After pattern-based tag ownership, weâll be building a new architecture for the operator, aimed at solving all the problems outlined above. More details on what that looks like soon!"}],"markDefs":[],"style":"normal"},{"_key":"5dbfec5374b6","_type":"block","children":[{"_key":"f8d25fd1bae4","_type":"span","marks":[],"text":"Resources"}],"markDefs":[],"style":"h2"},{"_key":"2c06919e0fa8","_type":"block","children":[{"_key":"73c6fa1dd4f7","_type":"span","marks":[],"text":"For a complete list of changes in the Kubernetes Operator and Tailscale as a whole, see our "},{"_key":"7a3bc5d97b9e","_type":"span","marks":["8b55506a4a83"],"text":"changelog"},{"_key":"4ba64c195679","_type":"span","marks":[],"text":". If youâre looking to get started with Tailscaleâs Kubernetes Operator, check out our "},{"_key":"bca1e336231e","_type":"span","marks":["e8a1244447c9"],"text":"installation guide"},{"_key":"aba4f8532d79","_type":"span","marks":[],"text":" or the more complete "},{"_key":"6cff009f69e7","_type":"span","marks":["ded0538c76f1"],"text":"quickstart guide"},{"_key":"5363b4fa9808","_type":"span","marks":[],"text":" for a deeper look."}],"markDefs":[{"_key":"8b55506a4a83","_type":"link","href":"https://tailscale.com/changelog"},{"_key":"e8a1244447c9","_type":"link","href":"https://tailscale.com/docs/kubernetes-operator/install-operator"},{"_key":"ded0538c76f1","_type":"link","href":"https://tailscale.com/docs/kubernetes-operator/quickstart"}],"style":"normal"},{"_key":"9cd27c6984fe","_type":"block","children":[{"_key":"10779e892610","_type":"span","marks":[],"text":"If youâre looking to report an issue you have, log a feature request, or get involved with helping us build Tailscale for everyone, check out our repository on "},{"_key":"21eceb31313a","_type":"span","marks":["c9a6833662f5"],"text":"GitHub"},{"_key":"62096fa45717","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"c9a6833662f5","_type":"link","href":"https://github.com/tailscale/tailscale"}],"style":"normal"}],"publishedAt":"2026-09-09T14:00:00.000Z","slug":{"_type":"slug","current":"kubernetes-operator-1102"},"title":"Tailscale Kubernetes Operator 1.102: In-cluster Peer Relays, better IPv6, and optimized certificates"},{"_id":"6985d4b1-8dbd-4a3b-9688-5ecb7efa03c3","authors":[{"_createdAt":"2023-10-23T14:25:08Z","_id":"8760a920-b245-43df-aec5-865c4e2e845e","_rev":"JgNZwVoOE3fVRWVQtDlu6H","_type":"teamMember","_updatedAt":"2026-04-28T20:49:27Z","member":{"bio":[{"_key":"04ee9c3bf8ff","_type":"block","children":[{"_key":"8e38e4379f2a","_type":"span","marks":[],"text":"Brad is a pioneering software engineer best known for creating LiveJournal, memcached, and OpenID. After over a decade at Google working on Go and distributed systems, he joined Tailscale in 2020 to make networking fun and simple. Based in Seattle, he spends his time building backend systems, wrangling his homelab, and parenting three many children."}],"markDefs":[],"style":"normal"}],"image":{"_type":"sanityImage","alt":"A man with a short well-groomed beard dressed in a white shirt, facing the camera with a calm demeanor.","asset":{"_ref":"image-88e6bd3712877e26fef5093d3779ecd00c23ff6d-945x945-jpg","_type":"reference"}},"jobTitle":"Chief Engineer","name":"Brad Fitzpatrick","socialLink":"https://twitter.com/bradfitz"},"title":"Brad Fitzpatrick"}],"category":"product","excerpt":"A netcat-ish way to use Tailscaleâs data plane without its control plane","featuredImage":{"_type":"sanityImage","alt":"Pixel art black cat with pink ears on green background next to terminal window showing 'tailcat' command and server listening message with red, yellow, and green status dots.","asset":{"_ref":"image-eef54ecd512da2ac27bdc67068f6845f8107a43c-1536x600-png","_type":"reference"}},"flexContent":[{"_key":"24fc0d5cc1e7","_type":"block","children":[{"_key":"fe44f01158f0","_type":"span","marks":[],"text":"Today
1weâre releasing "},{"_key":"86f63c344516","_type":"span","marks":["8c093fe67bc7","strong"],"text":"tailcat"},{"_key":"40f93aba9086","_type":"span","marks":["strong"],"text":", "},{"_key":"66afa485edab","_type":"span","marks":[],"text":"a remix of pieces of Tailscale that gives you a way to use the open-source Tailscale data plane (WireGuard® + NAT traversal + DERP) without the Tailscale control plane, written by the people who made Tailscale. Itâs Tailscale without Tailscale, by Tailscale."}],"markDefs":[{"_key":"8c093fe67bc7","_type":"link","href":"http://tailscale.com/tailcat"}],"style":"normal"},{"_key":"8cc59e626685","_type":"block","children":[{"_key":"3489547a9743","_type":"span","marks":[],"text":"Specifically, "},{"_key":"14d6010341af","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"df7eedfafa3c","_type":"span","marks":[],"text":" is both an open-source Go package and a CLI tool using that package. It lets you run a server-side listener and a client to connect to that server, moving bidirectional bytes back and forth."}],"markDefs":[],"style":"normal"},{"_key":"0ade7b543ecd","_type":"block","children":[{"_key":"5ce70120e7fa","_type":"span","marks":[],"text":"That is, itâs like "},{"_key":"bc0be61525c1","_type":"span","marks":["72de285eaa54"],"text":"netcat"},{"_key":"970d662968b1","_type":"span","marks":[],"text":" but flowing over Tailscaleâs magicsock (WireGuard encryption + "},{"_key":"15f262c64969","_type":"span","marks":["d4d13ac6baf7"],"text":"NAT traversal"},{"_key":"febee31ed826","_type":"span","marks":[],"text":" + "},{"_key":"32d75e662df8","_type":"span","marks":["edd9500156e0"],"text":"DERP"},{"_key":"7545b8c9a2b3","_type":"span","marks":[],"text":" rendezvous/fallback relay)."}],"markDefs":[{"_key":"72de285eaa54","_type":"link","href":"https://en.wikipedia.org/wiki/Netcat"},{"_key":"d4d13ac6baf7","_type":"link","href":"https://tailscale.com/blog/how-nat-traversal-works"},{"_key":"edd9500156e0","_type":"link","href":"https://tailscale.com/docs/reference/derp-servers"}],"style":"normal"},{"_key":"faeb6e316eb1","_type":"block","children":[{"_key":"63fd05679ff4","_type":"span","marks":[],"text":"Notably, "},{"_key":"53763b7b59fb","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"2360e5d0f28a","_type":"span","marks":[],"text":" has:"}],"markDefs":[],"style":"normal"},{"_key":"967ca18d6114","_type":"block","children":[{"_key":"f6a5d304e131","_type":"span","marks":[],"text":"no IP addresses"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"b9d2b3f047cf","_type":"block","children":[{"_key":"355dd9631db9","_type":"span","marks":[],"text":"no accounts (no logins, no passwords, no SSO)"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"2cf8d395d532","_type":"block","children":[{"_key":"9558ac55b575","_type":"span","marks":[],"text":"no control plane"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"1939fcf50fd5","_type":"block","children":[{"_key":"ef8f51d0951e","_type":"span","marks":[],"text":"no users"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"ffe88155e4de","_type":"block","children":[{"_key":"88babd8f89be","_type":"span","marks":[],"text":"no admins"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"bab55f60ebe5","_type":"block","children":[{"_key":"f6901b788a9e","_type":"span","marks":[],"text":"no administrative controls"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"5a7b06c7e7a7","_type":"block","children":[{"_key":"2a251a3827c9","_type":"span","marks":[],"text":"no root or admin OS access requirement"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"6d694092e5ca","_type":"block","children":[{"_key":"1318b724fb12","_type":"span","marks":[],"text":"no relationship with or dependence on Tailscale as a company (if you run your own "},{"_key":"92b0c98f8eb9","_type":"span","marks":["code"],"text":"cmd/derper"},{"_key":"990754de099e","_type":"span","marks":[],"text":" DERP server, at least)"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"fe7eefa6f517","_type":"block","children":[{"_key":"fce40a2f40ab","_type":"span","marks":[],"text":"What does âTailscaleâ even mean?"}],"markDefs":[],"style":"h1"},{"_key":"93e9b00c841a","_type":"block","children":[{"_key":"58e0092df86f","_type":"span","marks":[],"text":"When you watch people describe Tailscale to each other online, you see very different interpretations of what âTailscaleâ means to them."}],"markDefs":[],"style":"normal"},{"_key":"f70c634c5227","_type":"block","children":[{"_key":"92b662af10f8","_type":"span","marks":[],"text":"One group of people, often seen saying things like âIâll just run WireGuard myself,â focuses on the WireGuard part and doesn't consider (or care about) parts like NAT traversal, DERP fallbacks, centrally managed firewall (ACL) rules, SSO login, tagging, MDM policies, audit logging, etc. Maybe they only want or need the WireGuard part on a public IP. Thatâs fine."}],"markDefs":[],"style":"normal"},{"_key":"e04481a49eab","_type":"block","children":[{"_key":"a32438e63eff","_type":"span","marks":[],"text":"Another group of people talks more about the company, corporate structure, long-term viability, founders, funding stage, pricing, certifications, reliability, responsible handling of security disclosures, etc."}],"markDefs":[],"style":"normal"},{"_key":"768b270056f2","_type":"block","children":[{"_key":"f898988595e2","_type":"span","marks":[],"text":"Another group of people talk about whether Tailscale is o
1pen source or not. As a reminder: our core is "},{"_key":"a75f7f351142","_type":"span","marks":["8842503000f4"],"text":"open source"},{"_key":"1975831656a2","_type":"span","marks":[],"text":" (with a real "},{"_key":"298b873b7b22","_type":"span","marks":["dad0d425d963"],"text":"OSI-approved"},{"_key":"6f4d50edb226","_type":"span","marks":[],"text":" license!), our DERP server is open source, and our clients are open source on platforms that are themselves open source: Linux and Android. Our server-side control plane is not. A lot of people in this audience appreciate that "},{"_key":"9be2129445ed","_type":"span","marks":["720bfe10bfc4"],"text":"Headscale"},{"_key":"ad3dd0356e48","_type":"span","marks":[],"text":" (which we love and partially fund development of) exists, either to use today, or use in the future, as a fallback plan."}],"markDefs":[{"_key":"8842503000f4","_type":"link","href":"https://github.com/tailscale/tailscale/blob/main/LICENSE"},{"_key":"dad0d425d963","_type":"link","href":"https://opensource.org/licenses"},{"_key":"720bfe10bfc4","_type":"link","href":"https://headscale.net/stable/"}],"style":"normal"},{"_key":"8abf83171972","_type":"block","children":[{"_key":"4f49f7bdaa25","_type":"span","marks":[],"text":"All of those interpretations are fine. Whether youâre using our official GUI client wrappers around our official control plane, with a corporate SSO identity provider, or youâre at the other extreme, using only "},{"_key":"57007b3196d9","_type":"span","marks":["dc38d6b65e25"],"text":"tsnet"},{"_key":"e7c2ae951bb7","_type":"span","marks":[],"text":" on Linux nodes against your self-hosted Headscale server, there are many ways to wire up and use Tailscale and its many pieces:"}],"markDefs":[{"_key":"dc38d6b65e25","_type":"link","href":"https://tailscale.com/docs/features/tsnet"}],"style":"normal"},{"_key":"b2372c06af63","_type":"block","children":[{"_key":"2f3eef73ee73","_type":"span","marks":[],"text":"Its WireGuard + NAT traversal + DERP fallback "},{"_key":"b9fef306d9a6","_type":"span","marks":["strong"],"text":"data plane"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"8fadd0862c15","_type":"block","children":[{"_key":"6be67cd0663c","_type":"span","marks":[],"text":"Its control plane"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"7ca81d1866f5","_type":"block","children":[{"_key":"a4e102fcb373","_type":"span","marks":[],"text":"Its company (paying us to run and support things for you)"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"c24aa5e8e5e2","_type":"block","children":[{"_key":"bb349250e914","_type":"span","marks":[],"text":"Its open source code"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"f0c9d458971c","_type":"block","children":[{"_key":"004563dbd76f","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"3699c4040d0f","_type":"span","marks":[],"text":" gives you another way to use a subset of Tailscale."}],"markDefs":[],"style":"normal"},{"_key":"8d2116660efc","_type":"block","children":[{"_key":"a26b3147bede","_type":"span","marks":[],"text":"How it works"}],"markDefs":[],"style":"h1"},{"_key":"05cbe2476f43","_type":"block","children":[{"_key":"92cac04b2bc6","_type":"span","marks":[],"text":"Letâs say you want to run a "},{"_key":"580f2061b111","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"4a6a55871bab","_type":"span","marks":[],"text":" server. Hereâs what it does:"}],"markDefs":[],"style":"normal"},{"_key":"184f577b7681","_type":"block","children":[{"_key":"c6abacb7edc1","_type":"span","marks":[],"text":"generates a keypair (either ephemeral or named \u0026 reused)"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"46656e8d32df","_type":"block","children":[{"_key":"e98408d59078","_type":"span","marks":[],"text":"picks a DERP server (either one you specify, or an auto-selected bandwidth-limited Tailscale-run one)"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"7ec63000ef6d","_type":"block","children":[{"_key":"b700955b4ca6","_type":"span","marks":[],"text":"generates a "},{"_key":"bfd3208cfd62","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"172bedbd1ddd","_type":"span","marks":[],"text":" address, which is a string of the form: tc + base64(CBOR( public key + DERP bootstrap info ))"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"f782d03046de","_type":"block","children":[{"_key":"23ddd9b91194","_type":"span","marks":[],"text":"you then share that address string with somebody out of band, either directly, or by putting it in a DNS TXT record, and sharing that DNS hostname out of band"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"8d50bb66b415","_type":"block","children":[{"_key":"d0a11a249a8d","_type":"span","marks":[],"text":"The client side is about the same:"}],"markDefs":[],"style":"normal"},{"_key":"b5335994ad5e","_type":"block","children":[{"_key":"26705fafa826","_type":"span","marks":[],"text":"pick a key (ephemeral or locally named \u0026 reused)"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"a6fb7422ee19","_type":"block","children":[{"_key":"6a83e79c5c49","_type":"span","marks":[],"text":"connect to the rendezvous DERP server specified in the "},{"_key":"48de44f4be61","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"8b28d6bb948d","_type":"span","marks":[],"text":" address"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"8d9ec81a0a53","_type":"block","children":[{"_key":"3dd8cb663e72","_type":"span","marks":[],"text":"send a "},{"_key":"d434cde09916","_type":"span","marks":["code"],"text":"MEOW"},{"_key":"9f2187bbe42f","_type":"span","marks":[],"text":" message to the serverâs public key over DERP to add yourself to the netmap"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"b01a7fce86a4","_type":"block","children":[{"_key":"bbbaab1bd852","_type":"span","marks":[],"text":"At that point, if the server is cool with that clientâs public key (it can be optionally locked down), then it replies with a happy "},{"_key":"48a8cc117939","_type":"span","marks":["code"],"text":"MEOW"},{"_key":"14fe1e799789","_type":"span","marks":[],"text":" reply."}],"markDefs":[],"style":"normal"},{"_key":"eee21823a1e2","_type":"block","children":[{"_key":"bb177e60f5c0","_type":"span","marks":[],"text":"The client then proceeds to make a TCP connection to the other side using an embedded userspace TCP stack atop WireGuard. There are actual IP addresses on the wire (IPv6 ones derived from your public key), but theyâre never visible to users. Your operating system is never involved at the TCP layer and never sees the synthetic "},{"_key":"bc16b67d9cc4","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"4d70bee7b6b2","_type":"span","marks":[],"text":" IPs. All your operating system does is send the DERP TCP messages and/or NAT-punched UDP WireGuard messages."}],"markDefs":[],"style":"normal"},{"_key":"cb22ef00b9a0","_type":"assetBlock","asset":{"_type":"asset","alignment":"center","image":{"_type":"sanityImage","alt":"Two terminal windows. On top, Brad's sandbox runs a tailcat listener, piping the output to a tar command to extract any incoming content. The output shows a tailcat listener responding with a tailcat address and bootstrapped from a New York City relay server, and the directory llms and the files CODEX.md and CLAUDE.md being unrolled. The terminal at the bottom shows Kabir's macbook compressing the local llms directory with the tar command and sending the resulting content over a tailcat pipe using Brad's tailcat address.","asset":{"_ref":"image-b887de8d30894c58023558aa9c2afa930b37c7bf-1177x629-svg","_type":"reference"}},"mobileImage":{"_type":"sanityImage","alt":"Two terminal windows. On top, Brad's sandbox runs a tailcat listener, piping the output to a tar command to extract any incoming content. The output shows a tailcat listener responding with a tailcat address and bootstrapped from a New York City relay server, and the directory llms and the files CODEX.md and CLAUDE.md being unrolled. The terminal at the bottom shows Kabir's macbook compressing the local llms directory with the tar command and sending the resulting content over a tailcat pipe using Brad's tailcat address.","asset":{"_ref":"image-4823461b668d4edfe57e055a5c8b5815543d5837-2354x1258-png","_type":"reference"}},"placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":true,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"display":"block"},{"_key":"72a39cc68487","_type":"block","children":[{"_key":"a6116bc89ae0","_type":"span","marks":[],"text":"Because it goes over Tailscaleâs magicsock data plane, NAT traversal automatically kicks in and tries to get a direct connection, so data transfer (WireGuard UDP packets) ends up going directly between the client and server, without a DERP relay involved. But if both sides are behind a hard NAT without any port mapping services available, the data packets are relayed over DERP as a fallback. If you use Tailscale-hosted DERP servers, those are rate-limited (bandwidth costs us money). But if you run your own DERP server, you can control any rate limiting."}],"markDefs":[],"style":"normal"},{"_key":"e09d790b401d","_type":"block","children":[{"_key":"2a1d6679ed2b","_type":"span","marks":[],"text":"In the default mode where you donât specify a port number on the "},{"_key":"b7ad715d8857","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"6253e055fa54","_type":"span","marks":[],"text":" server, the default is to just pipe the received data to the serverâs stdout, like "},{"_key":"880a70f6e18f","_type":"span","marks":["code"],"text":"netcat"},{"_key":"75b56050258b","_type":"span","marks":[],"text":". But it can also run in a client mode, where it runs a SOCKS server on an ephemeral local port and then runs a provided child process (e.g. "},{"_key":"3e5dbf5acac3","_type":"span","marks":["code"],"text":"curl"},{"_key":"8e1a7b5af424","_type":"span","marks":[],"text":" or whatever) with an environment variable set to use said SOCKS server, letting "},{"_key":"26489dd15b5b","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"b2843fd48010","_type":"span","marks":[],"text":"-oblivious programs use "},{"_key":"4481b568947a","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"0e76f6a7456c","_type":"span","marks":[],"text":" transparently. ("},{"_key":"6cd17ac2e3a3","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"30a9b42f7073","_type":"span","marks":[],"text":" is currently always userspace-only, never reconfiguring your systemâs networking stack ⦠no TUN devices, no routing table changes, etc.)"}],"markDefs":[],"style":"normal"},{"_key":"098587f4d329","_type":"block","children":[{"_key":"978ec99ee4ff","_type":"span","marks":[],"text":"Why?"}],"markDefs":[],"style":"h1"},{"_key":"4a78bf7a6d7b","_type":"block","children":[{"_key":"a799a263b29f","_type":"span","marks":[],"text":"I wrote "},{"_key":"dd9751c9091d","_type":"span","marks":["code"],"text":"tailcat"}
1,{"_key":"1204af2f0f65","_type":"span","marks":[],"text":" in September 2023 on a long ten-hour flight while catching up on bad movies. At the time, "},{"_key":"6ca0bf6b0320","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"0b9e4d965150","_type":"span","marks":[],"text":" was mostly a fun novelty. I presented it internally, and Iâd use it occasionally myself, but I mostly forgot about it. But then a number of customers approached us with use cases where it was a perfect fit, so we gave them copies of it, with arrangements where weâd host the DERP fallback relays for them in cases where tailcatâs use of Tailscaleâs magicsock fails to get a direct connection."}],"markDefs":[],"style":"normal"},{"_key":"8953a53cdab5","_type":"block","children":[{"_key":"c252ac9a3329","_type":"span","marks":[],"text":"Fast-forward to a few months ago, when all this AI agentic coding stuff was in full swing. Itâs been really powerful to just give my sandboxed AI agents access to make their own also-untrusted nested VMs and give them tailcat. With access to exotic hardware in faraway places, I let the AI go wild wiring things up to each other and running experiments. Off the top of my head, I can recall:"}],"markDefs":[],"style":"normal"},{"_key":"7f6e4278f897","_type":"block","children":[{"_key":"e6dadff4d1e2","_type":"span","marks":[],"text":"giving an agent access to a fleet of every Raspberry Pi generation"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"aca444e12152","_type":"block","children":[{"_key":"094cd43af332","_type":"span","marks":[],"text":"giving an agent access to a sandboxed EC2 instance that had ambient access to control a nearby EC2 instance and "},{"_key":"daec565ea905","_type":"span","marks":["code"],"text":"kexec"},{"_key":"ce9462f0ea1c","_type":"span","marks":[],"text":" reboot it repeatedly, while porting Tailscale to run in EC2âs UEFI environment, including porting the Amazon Nitro ENA network driver to pure Go (under "},{"_key":"78c1c7a2a93f","_type":"span","marks":["fe9cee86c8af"],"text":"Tamago"},{"_key":"f7eddf68fd1f","_type":"span","marks":[],"text":")"}],"level":1,"listItem":"bullet","markDefs":[{"_key":"fe9cee86c8af","_type":"link","href":"https://github.com/usbarmory/tamago"}],"style":"normal"},{"_key":"6397626b17a4","_type":"block","children":[{"_key":"a1180ce486ec","_type":"span","marks":[],"text":"giving an agent access to a Windows host to repeatedly create and destroy Hyper-V VMs to debug and fix a stack corruption bug in the Go runtime and standard library"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"28d4fad38234","_type":"block","children":[{"_key":"fa421ae078e9","_type":"span","marks":[],"text":"In most of these cases, I probably "},{"_key":"d692a2a5c64f","_type":"span","marks":["em"],"text":"technically"},{"_key":"9b1426c3d671","_type":"span","marks":[],"text":" couldâve just used Tailscale proper, but it wouldâve been more tedious to the point that I probably wouldnât have even done it, and wouldâve just set up a few port forwards instead, or opened up some ports on a firewall somewhere. I find that "},{"_key":"aac31c8522a2","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"c05432c0a261","_type":"span","marks":[],"text":" is often the perfect tool when I already have two shells open on two machines in two very different worlds and I just want to connect the two together, for a quick file copy, or port forward, or letting one SSH to the other. Especially when one side is untrusted or ephemeral or Iâm afraid to touch its system configuration."}],"markDefs":[],"style":"normal"},{"_key":"a577c35b448b","_type":"block","children":[{"_key":"37e88004e24e","_type":"span","marks":[],"text":"When we "},{"_key":"89b9b889caa0","_type":"span","marks":["28080860dba5"],"text":"launched Taildrop"},{"_key":"b98310d04979","_type":"span","marks":[],"text":" in 2021, one of the first requests was for netcat-like sharing between nodes. "},{"_key":"9e097dcefa2c","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"39330f725903","_type":"span","marks":[],"text":" now provides that, and more. Weâd still like to do something "},{"_key":"eb9f874948cb","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"a9b91bc5faf1","_type":"span","marks":[],"text":"-like in the main Tailscale client too, but weâll have to figure out how that fits into the rest of the Tailscale product."}],"markDefs":[{"_key":"28080860dba5","_type":"link","href":"https://tailscale.com/blog/2021-06-taildrop-was-easy"}],"style":"normal"},{"_key":"f099ae6fab24","_type":"block","children":[{"_key":"d301fad45ecc","_type":"span","marks":[],"text":"Another reason to open source "},{"_key":"8b5ee10723b5","_type":"span","marks":["code"],"text":"tailcat"},{"_key":"ee358a15d45b","_type":"span","marks":[],"text":" is that itâs kinda obvious and inevitable. Weâd selfishly rather people be using, improving, and filing bugs against our data plane, which then makes the rest of the Tailscale product better."}],"markDefs":[],"style":"normal"},{"_key":"63407c16bdba","_type":"block","children":[{"_key":"56be60c99811","_type":"span","marks":[],"text":"âContact Salesâ"}],"markDefs":[],"style":"h2"},{"_key":"6b67e9e8e9e5","_type":"block","children":[{"_key":"aad5a68391c2","_type":"span","marks":[],"text":"I would be remiss if I didnât mention that you should contact us if you have fun use cases where tailcat might help you, and where we can help you integrate tailcat or run a global fleet of DERP relays for you. (e.g. IoT, P2P games, distributed GPUs, etc.)"}],"markDefs":[],"style":"normal"},{"_key":"8b8dc95b0229","_type":"block","children":[{"_key":"2d113ce8f86a","_type":"span","marks":[],"text":"The DERP server fleet weâre running for tailcat is throttled and only available in a handful of regions around the world. The idea is that, most of the time, our magicsock NAT traversal will do its thing and DERP isnât relevant, with tailcat getting a direct UDP WireGuard connection between the two peers. But in cases where that fails, weâd be happy to exchange money for goods and services."}],"markDefs":[],"style":"normal"},{"_key":"df2022f0d53d","_type":"block","children":[{"_key":"ce93d7c00b58","_type":"span","marks":[],"text":"Or, hey, run your own DERP fleet or single server. "},{"_key":"0d3b96437527","_type":"span","marks":["2fb3f71d8d8c"],"text":"Itâs open source too"},{"_key":"92ef6dc23e2f","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"2fb3f71d8d8c","_type":"link","href":"https://github.com/tailscale/tailscale/tree/main/cmd/derper"}],"style":"normal"},{"_key":"03996a3997a5","_type":"block","children":[{"_key":"590e44263f8d","_type":"span","marks":[],"text":"Enjoy!"}],"markDefs":[],"style":"h2"},{"_key":"ead924de84d4","_type":"block","children":[{"_key":"31e0e6ae64fc","_type":"span","marks":[],"text":"We look forward to seeing what you build and how you use this. Give tailcat a spin "},{"_key":"7b460718850f","_type":"span","marks":["6bf66555007d"],"text":"here"},{"_key":"6545c3669e98","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"6bf66555007d","_type":"link","href":"http://tailscale.com/tailcat"}],"style":"normal"},{"_key":"90291675170f","_type":"html","code":"\u003ca href=\"http://tailscale.com/webinars/tailscaleup-2026-recap\"\u003e\u003cimg src=\"https://cdn.sanity.io/images/w77i7m8x/production/e6e0c7dd2caa33efe5cf8cc4ccc5045f80a4760a-1500x750.png\"/\u003e\u003c/a\u003e"}],"publishedAt":"2026-08-31T14:00:00.000Z","slug":{"_type":"slug","current":"tailcat"},"title":"Tailcat: Tailscale without Tailscale, by Tailscale"},{"_id":"b02be7c5-ea56-4288-aa7c-a8c4636c0060","authors":[{"_createdAt":"2025-07-03T13:19:40Z","_id":"ab416318-bc7c-4951-8d49-10f5402b8974","_rev":"PmlDDBV8ZhCyKPV7rW7JRy","_system":{"base":{"id":"ab416318-bc7c-4951-8d49-10f5402b8974","rev":"HCgnpdEWAXRsYEv1jmJJVd"}},"_type":"teamMember","_updatedAt":"2026-04-28T20:49:14Z","member":{"image":{"_type":"sanityImage","alt":"Headshot of Kevin Purdy","asset":{"_ref":"image-88495251674b4b8245c44141cb7cf5e6db33475a-
1512x512-jpg","_type":"reference"}},"jobTitle":"Technical Content Manager @Tailscale","name":"Kevin Purdy","socialLink":"https://thepurdman.com"},"title":"Kevin Purdy"}],"category":"product","excerpt":"Put secure networking inside what you build, then automate the rest.","featuredImage":{"_type":"sanityImage","alt":"Tailscale Machines management dashboard displays a table of 6 connected network devices with their IP addresses, operating system versions, and last seen timestamps. This admin console interface allows users to manage and monitor all devices connected to their Tailscale virtual private network for secure remote access.","asset":{"_ref":"image-4f06d2f34459f066f0f053eea407bc19d61bbaa2-1536x600-png","_type":"reference"}},"flexContent":[{"_key":"cbd78b2698c8","_type":"block","children":[{"_key":"a5496189fe84","_type":"span","marks":[],"text":"Networking: itâs the thing you bolt on last. You write an application or spin up an instance, and then you work out how anyone actually reaches it. Opening ports, standing up proxies, grabbing certificates and checking the ACLsâthe project is âdone,â yet the on-call work is just starting."}],"markDefs":[],"style":"normal"},{"_key":"49766e5c0269","_type":"block","children":[{"_key":"5a6b896609c2","_type":"span","marks":[],"text":"That separation is something we want to change. Over the last few releases, Tailscale has been growing: from something you only configure "},{"_key":"b6b2202a9efb","_type":"span","marks":["em"],"text":"for"},{"_key":"340d099dd007","_type":"span","marks":[],"text":" your software, into something you build "},{"_key":"b4e33d70d1c0","_type":"span","marks":["em"],"text":"with"},{"_key":"0c022f115b41","_type":"span","marks":[],"text":" and "},{"_key":"27705a945ec7","_type":"span","marks":["em"],"text":"on"},{"_key":"542c9813a93c","_type":"span","marks":[],"text":". And you never give up admin console control, or the ease of making direct, encrypted connections."}],"markDefs":[],"style":"normal"},{"_key":"667a47f21d7d","_type":"block","children":[{"_key":"233940d7a1c5","_type":"span","marks":[],"text":"Hereâs what we mean:"}],"markDefs":[],"style":"normal"},{"_key":"097f19ae36d2","_type":"block","children":[{"_key":"41c53b6df9a2","_type":"span","marks":[],"text":"You can "},{"_key":"99b4c20890ac","_type":"span","marks":["strong"],"text":"build with "},{"_key":"83a13ee9f285","_type":"span","marks":[],"text":"Tailscale: embed secure connectivity directly into applications, so the things you build join your Tailscale network (tailnet) with their own identity."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"af2be0a59909","_type":"block","children":[{"_key":"d5a33205872f","_type":"span","marks":[],"text":"You can "},{"_key":"371ebdfb70f2","_type":"span","marks":["strong"],"text":"build on "},{"_key":"368dfd6afb8c","_type":"span","marks":[],"text":"Tailscale: automate how tailnets are created, shared, and managed, using the same APIs that power the admin console."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"72d82cc737cd","_type":"block","children":[{"_key":"5e3d3f1d3b5e","_type":"span","marks":[],"text":"My colleague Reza walks through these options in a video on our YouTube channel, and has provided "},{"_key":"cb203e4c71b2","_type":"span","marks":["e831139bfaea"],"text":"code examples in our tailscale-dev repository"},{"_key":"4a3d754c560e","_type":"span","marks":[],"text":". Hereâs a bit more on how they work, and where you can read about them."}],"markDefs":[{"_key":"e831139bfaea","_type":"link","blank":true,"href":"https://github.com/tailscale-dev/summer-with-tailscale"}],"style":"normal"},{"_key":"ab1ea5cb583e","_type":"assetBlock","asset":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"video","useMobileAlternativeImage":false,"video":{"aspect":"16-9","clickType":"watchVideoCaption","embed":"\u003ciframe width=\"100%\" height=\"100%\" src=\"https://www.youtube.com/embed/vkzCLB7wkJg?si=jLmLA_nC9sRNCJc_\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen\u003e\u003c/iframe\u003e","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false,"videoType":"embed"}},"display":"block"},{"_key":"be176f93f0b4","_type":"block","children":[{"_key":"371f300a134c","_type":"span","marks":[],"text":"Build with Tailscale"}],"markDefs":[],"style":"h2"},{"_key":"a3769399c361","_type":"block","children":[{"_key":"e6acaff97f9e","_type":"span","marks":[],"text":"Embedding the network in an app with "},{"_key":"3f9d028f74fa","_type":"span","marks":["code"],"text":"tsnet"}],"markDefs":[],"style":"h3"},{"_key":"f34c9e4ca939","_type":"block","children":[{"_key":"873d95f30565","_type":"span","marks":[],"text":"Letâs start with a small, âfunâ version of a problem. You have a local AI server, like Ollama, running on a box at your desk. Ollama offers a server, which is handy for providing an endpoint, or working away from your desk. But that server must never become a public endpoint."}],"markDefs":[],"style":"normal"},{"_key":"8976fd064ca8","_type":"block","children":[{"_key":"f520d1477a7c","_type":"span","marks":[],"text":"The usual ways to fix this: open an inbou
1nd port, stand up a reverse proxy with custom certificates, and spend a lot of time either pasting in variables yourself, or walking an agent through doing it. And then checking in again, when the certificates stop working."}],"markDefs":[],"style":"normal"},{"_key":"92a675473832","_type":"block","children":[{"_key":"019590a2c8bd","_type":"span","marks":[],"text":"Using"},{"_key":"73ed28d6672b","_type":"span","marks":["strong"],"text":" tsnet "},{"_key":"22fc5c082017","_type":"span","marks":[],"text":"gets you away from the usual. Import it as a Go library, and each Ollama server joins the tailnet as its own node, with their own identity, a MagicDNS name, and a place already set in your ACLs. No host daemon, public port, or firewalls to trip over. The certificates are also handled, if you need to serve something up over HTTPS."}],"markDefs":[],"style":"normal"},{"_key":"4ee89b915dd5","_type":"block","children":[{"_key":"c7e1653c537d","_type":"span","marks":[],"text":"âBut Iâm already running Tailscale on these machines!â you might say. The distinction is that "},{"_key":"fbd0e8331281","_type":"span","marks":["code"],"text":"tsnet"},{"_key":"edce84a966e0","_type":"span","marks":[],"text":" gives an identity to each "},{"_key":"63990d169e03","_type":"span","marks":["em"],"text":"application"},{"_key":"781c113d50dd","_type":"span","marks":[],"text":", separate from hosts. So the box can switch between tailnets, or the host can be a sandbox with a contained blast radius. You can give everyone on the tailnet their own Ollama, and those Ollama instances get their own scopes, access, and connections."}],"markDefs":[],"style":"normal"},{"_key":"ca366646388d","_type":"block","children":[{"_key":"fcb7a91d42ff","_type":"span","marks":[],"text":"This is what it looks like, in pseudocode, when "},{"_key":"33d8371b1194","_type":"span","marks":["code"],"text":"tsnet"},{"_key":"8c96095354c0","_type":"span","marks":[],"text":" gives a Go application Tailscale powers:"}],"markDefs":[],"style":"normal"},{"_key":"7db1126f0ba5","_type":"code","code":"\tsrv := \u0026tsnet.Server{\n\t\tHostname: hostname,\n\t\tDir: stateDir,\n\t\tAuthKey: authKey,\n\t\tClientID: clientID,\n\t\tClientSecret: clientSecret,\n\t\tEphemeral: false,\n\t}\n\tdefer srv.Close()\n\n\tif _, err := srv.Up(context.Background()); err != nil {\n\t\tlog.Fatalf(\"tsnet up: %v\", err)\n\t}\n\n\t// srv.Listen(\"tcp\", \":80\") also works if you don't need TLS.\n\tln, err := srv.ListenTLS(\"tcp\", \":443\")\n\tif err != nil {\n\t\tlog.Fatalf(\"listen :443: %v\", err)\n\t}\n\tdefer ln.Close()\n\n\thttp.HandleFunc(\"/\", func(w http.ResponseWriter, r *http.Request) {\n\t\tfmt.Fprintln(w, \"Hello from tsnet\")\n\t})\n\n\tlog.Printf(\"serving https://%s.\u003ctailnet\u003e.ts.net\", hostname)\n\tlog.Fatal(http.Serve(ln, nil))\n}","language":"golang"},{"_key":"088d5ec47085","_type":"block","children":[{"_key":"a74ba88f2a52","_type":"span","marks":[],"text":"This service would come up at "},{"_key":"c2ce5c79ae95","_type":"span","marks":["code"],"text":"https://ollama.\u003cyour-tailnet\u003e.ts.net"},{"_key":"87ad55213432","_type":"span","marks":[],"text":", valid certificate and all. "},{"_key":"e99ceca561bc","_type":"span","marks":["code"],"text":"ListenTLS"},{"_key":"d3ec2355328d","_type":"span","marks":[],"text":" will mint a certificate if youâve "},{"_key":"226af55f4ba6","_type":"span","marks":["aaf06df4e41e"],"text":"turned on HTTPS for your tailnet"},{"_key":"a5a0a280a4e6","_type":"span","marks":[],"text":". Youâll note, in Rezaâs video and repository, that Ollama only binds to "},{"_key":"3245d85c30bf","_type":"span","marks":["code"],"text":"127.0.0.1:11434"},{"_key":"2d866ef0b6a0","_type":"span","marks":[],"text":". The tailnet is the only way in, whether or not you remember to close the port later."}],"markDefs":[{"_key":"aaf06df4e41e","_type":"link","href":"https://tailscale.com/docs/how-to/set-up-https-certificates"}],"style":"normal"},{"_key":"c891019c0330","_type":"block","children":[{"_key":"5f6248bef691","_type":"span","marks":[],"text":"âSounds great,â you might say, âexcept weâre not a Go shop.â Watch this spaceâor, more specifically, watch "},{"_key":"6e60ba0a2aaf","_type":"span","marks":["8e500d098348"],"text":"tailscale-rs"},{"_key":"0cf209ed44a8","_type":"span","marks":[],"text":". It brings this embedded Tailscale model to Rust, and opens up bindings in Python, Elixir, and C, with more to come. Right now itâs experimental (pre-alpha), so itâs definitely more direction than production code. But itâs a promise of options to come."}],"markDefs":[{"_key":"8e500d098348","_type":"link","href":"https://tailscale.com/blog/tailscale-rs-rust-tsnet-library-preview"}],"style":"normal"},{"_key":"c614781d2341","_type":"block","children":[{"_key":"7104ec5cf23a","_type":"span","marks":[],"text":"Build on Tailscale"}],"markDefs":[],"style":"h2"},{"_key":"8e5a8fe5fd7c","_type":"block","children":[{"_key":"1b5549e17e42","_type":"span","marks":[],"text":"Provision isolated tailnets with the Tailnets API"}],"markDefs":[],"style":"h3"},{"_key":"d8168b1102a5","_type":"block","children":[{"_key":"8b1151427362","_type":"span","marks":[],"text":"Embedding with "},{"_key":"91992c719e6e","_type":"span","marks":["code"],"text":"tsnet"},{"_key":"c77ad6944e3c","_type":"span","marks":[],"text":" gets the app you trust on your tailnet. The "},{"_key":"bbb829d34ee7","_type":"span","marks":["ab877be23f88"],"text":"Tailnets API"},{"_key":"8433460bde0a","_type":"span","marks":[],"text":" gives you something else: a whole network you bring up on demand, as part of a product or provisioning workflow, rather than editing by hand."}],"markDefs":[{"_key":"ab877be23f88","_type":"link","href":"https://tailscale.com/docs/features/tailnet-creation-api"}],"style":"normal"},{"_key":"431565aec400","_type":"block","children":[{"_key":"15b7bfc0164c","_type":"span","marks":[],"text":"Itâs useful for isolation: one tailnet per customer, environment, or short-lived test. Itâs also a way to run code you donât entirely trust yet. Hand an agent a throwaway tailnet and see what it builds inside a walled space. Then, just as easily, take it down when itâs done (or tell the agent to tear itself down)."}],"markDefs":[],"style":"normal"},{"_key":"41b2c50f53cf","_type":"block","children":[{"_key":"945dfa1b59b1","_type":"span","marks":[],"text":"Hereâs what it "},{"_key":"2de484ae3594","_type":"span","marks":["b02cb5ca0a1e"],"text":"looks like in action"},{"_key":"2b0c2cc75750","_type":"span","marks":[],"text":": provisioning isolated tailnets through the API. You could then go on to enable HTTPS certficates for your tailnets, provision them with tags, and more."}],"markDefs":[{"_key":"b02cb5ca0a1e","_type":"link","blank":true,"href":"https://github.com/tailscale-dev/summer-with-tailscale/tree/main/04-api-is-the-way"}],"style":"normal"},{"_key":"7509b8b55b25","_type":"code","code":"create_tailnet() {\n local label=\"$1\" token=\"$2\"\n curl -sS \"https://api.tailscale.com/api/v2/organizations/-/tailnets\" \\\n --request POST \\\n --header 'Content-Type: application/json' \\\n --header \"Authorization: Bearer $token\" \\\n --data \"{\\\"displayName\\\": \\\"e2e-sandbox-$label\\\"}\"\n}\n\ntailnet_access_token() {\n local client_id=\"$1\" client_secret=\"$2\"\n curl -sS -X POST \"https://api.tailscale.com/api/v2/oauth/token\" \\\n -d \"client_id=$client_id\" \\\n -d \"client_secret=$client_secret\" \\\n | jq -r '.access_token'\n}","language":"bash"},{"_key":"473fffb1cc6e","_type":"block","children":[{"_key":"3484d02b1f5c","_type":"span","marks":[],"text":"So weâve put a good deal of connectivity "},{"_key":"ebdcc219dec5","_type":"span","marks":["em"],"text":"inside"},{"_key":"7186715608e1","_type":"span","marks":[],"text":" the things you test and ship. Next up: automating parts of Tailscale itself, smoothing out even more friction from the network."}],"markDefs":[],"style":"normal"},{"_key":"3b89fe1744f4","_type":"block","children":[{"_key":"e937cadc8f44","_type":"span","marks":[],"text":"Managing sharing without the clicks"}],"markDefs":[],"style":"h3"},{"_key":"e6bca0ec8844","_type":"block","children":[{"_key":"f67a1691973e","_type":"span","marks":[],"text":"Sharing across tailnets typically requires multiple human-effort steps: creating the share, sending it over, and accepting it. Thatâs fine for a web app on your NAS, but across a suite of tailnets, it becomes a ClickOps dependency."}],"markDefs":[],"style":"normal"},{"_key":"fea63e5834ff","_type":"block","children":[{"_key":"d28bc890226f","_type":"span","marks":["strong"],"text":"Declarative Node Sharing "},{"_key":"ac84aba5ec3f","_type":"span","marks":[],"text":"takes those manual actions and turns them into policy. You declare what should be shared with whom, commit it, and let a GitOps workflow apply itâthe same way you manage the rest of your infrastru
1cture. No manual clicking and checking, and no relying on someoneâs memory of what is shared with whom."}],"markDefs":[],"style":"normal"},{"_key":"8341c4ab05ad","_type":"assetBlock","asset":{"_type":"asset","alignment":"center","image":{"_type":"sanityImage","alt":"Tailscale admin console showing Personal Settings with feature options including Regional Routing (Premium), HTTPS certificate provisioning, Feature previews, Declarative Node Sharing (Alpha Waitlist), Mullvad VPN (Beta, Paid add-on), and Send Files (Alpha) with toggle switch enabled.","asset":{"_ref":"image-93a68d6c7718db2320d54d13ad17a594bcd62256-1055x630-svg","_type":"reference"}},"mobileImage":{"_type":"sanityImage","alt":"Tailscale admin console showing Personal Settings with feature options including Regional Routing (Premium), HTTPS certificate provisioning, Feature previews, Declarative Node Sharing (Alpha Waitlist), Mullvad VPN (Beta, Paid add-on), and Send Files (Alpha) with toggle switch enabled.","asset":{"_ref":"image-ee6463817f2c64ed4a75722e09966edac8c10c3e-2110x1259-png","_type":"reference"}},"placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":true,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"display":"block"},{"_key":"03397480584a","_type":"block","children":[{"_key":"fa722ed77107","_type":"span","marks":[],"text":"Declarative Node Sharing is currently available by joining a waitlist. You can find the join link in "},{"_key":"e81483ad3a0b","_type":"span","marks":["strong"],"text":"Settings \u003e General"},{"_key":"8a4099edc808","_type":"span","marks":[],"text":" in your admin console."}],"markDefs":[],"style":"normal"},{"_key":"e316f21ee7d4","_type":"block","children":[{"_key":"7d94a2751841","_type":"span","marks":[],"text":"Automate all the admin console actions"}],"markDefs":[],"style":"h3"},{"_key":"c65ced59db48","_type":"block","children":[{"_key":"6edc3fcf2c59","_type":"span","marks":[],"text":"Have you noticed Tailscaleâs "},{"_key":"3a5507c1aa34","_type":"span","marks":["9d0b84de9f94"],"text":"new admin console"},{"_key":"30eaae389602","_type":"span","marks":[],"text":"? Itâs built on the same APIs available to your tailnet. Anything you can click on the console, you can drive programmatically: ACL updates, key rotation, ACL fleet management, and all the tailnet provisioning we mentioned earlier in this post."}],"markDefs":[{"_key":"9d0b84de9f94","_type":"link","blank":true,"href":"https://console.tailscale.com/admin/machines"}],"style":"normal"},{"_key":"790edefd09bd","_type":"assetBlock","asset":{"_type":"asset","alignment":"center","image":{"_type":"sanityImage","alt":"Tailscale network management dashboard displaying the Machines page where users can manage and monitor multiple connected devices across their tailnet, showing device names, IP addresses, operating system versions, and connection status.","asset":{"_ref":"image-27434b34621e597740b9d25da9ce74b85be55f9b-1055x630-svg","_type":"reference"}},"mobileImage":{"_type":"sanityImage","alt":"Tailscale network management dashboard displaying the Machines page where users can manage and monitor multiple connected devices across their tailnet, showing device names, IP addresses, operating system versions, and connection status.","asset":{"_ref":"image-9b6499696dbc39d4bc1812e9ff2ad83d1fd71060-2110x1259-png","_type":"reference"}},"placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":true,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","mobileStaticAlt":{"_type":"asset","alignment":"center","placeholderColor":{"_type":"colors","color":"none"},"type":"image","useMobileAlternativeImage":false,"video":{"clickType":"watchVideoCaption","playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"playType":"click","useMobileStaticAlt":false}},"display":"block"},{"_key":"98381cb82057","_type":"block","children":[{"_key":"68d7de0968a4","_type":"span","marks":[],"text":"Platform and security team
1s can build their own automations, internal tools, and custom interfaces, on top of Tailscaleâs standard admin console. Network operations that used to require clicks are now code that can be reviewed, tested, and automated."}],"markDefs":[],"style":"normal"},{"_key":"285677093375","_type":"block","children":[{"_key":"c57d16ee538d","_type":"span","marks":[],"text":"One platform, two ways in"}],"markDefs":[],"style":"h2"},{"_key":"6dafe4292a7f","_type":"block","children":[{"_key":"e4835010efba","_type":"span","marks":[],"text":"Weâve been working to make Tailscale a more useful tool for multiple audiences inside any organization:"}],"markDefs":[],"style":"normal"},{"_key":"47c0b9c5bc26","_type":"block","children":[{"_key":"36ebc19a5ef9","_type":"span","marks":["strong"],"text":"Developers"},{"_key":"036389a7542f","_type":"span","marks":[],"text":" can embed secure connectivity into shipped products, with "},{"_key":"825d0956681c","_type":"span","marks":["code"],"text":"tsnet"},{"_key":"5f2ea385f407","_type":"span","marks":[],"text":" today and "},{"_key":"0961e8b9049b","_type":"span","marks":["code"],"text":"tailscale-rs"},{"_key":"ba4d51cea828","_type":"span","marks":[],"text":" in the future. Bring up network layers faster, and provision isolated tailnets from inside their products or agentic workflows."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"c3ca9df3e25b","_type":"block","children":[{"_key":"8ccf18af1de2","_type":"span","marks":["strong"],"text":"Infrastructure, IT, and security teams"},{"_key":"adafd7e8d884","_type":"span","marks":[],"text":" can now manage sharing through policy and automated operations, so that large-scale tailnets, and multiple tailnets, have far fewer manual steps."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"60fbeff6363c","_type":"block","children":[{"_key":"2ec40f132d66","_type":"span","marks":[],"text":"Whether youâre building with Tailscale, on it, or both, we want secure networking to no longer be the last hurdle to shipping products or sealing up systems. Tailscale can help make networking part of what you build, not the work you do after you thought you were done."}],"markDefs":[],"style":"normal"},{"_key":"f1e2245b5baa","_type":"block","children":[{"_key":"ec03d77e4e82","_type":"span","marks":[],"text":"Learn more"}],"markDefs":[],"style":"h2"},{"_key":"973ed951b00d","_type":"block","children":[{"_key":"70a38d389b8b","_type":"span","marks":[],"text":"Read more on the "},{"_key":"4ac9b30df174","_type":"span","marks":["60fa0bf47074"],"text":"Tailnets API"}],"level":1,"listItem":"bullet","markDefs":[{"_key":"60fa0bf47074","_type":"link","href":"https://tailscale.com/docs/features/tailnet-creation-api"}],"style":"normal"},{"_key":"767c39be4f24","_type":"block","children":[{"_key":"41f4eb1473e0","_type":"span","marks":[],"text":"Join the Declarative Node Sharing waitlist "},{"_key":"8f0086d7fc10","_type":"span","marks":["db24c2219221"],"text":"in the admin console"},{"_key":"f4ae567bea93","_type":"span","marks":[],"text":"."}],"level":1,"listItem":"bullet","markDefs":[{"_key":"db24c2219221","_type":"link","blank":true,"href":"https://console.tailscale.com/admin/settings/general"}],"style":"normal"},{"_key":"3f7c864da527","_type":"block","children":[{"_key":"fa5e9451ce6a","_type":"span","marks":[],"text":"Explore "},{"_key":"5a6b375580dc","_type":"span","marks":["acacc3e6c647"],"text":"tsnet"},{"_key":"b904ac24f081","_type":"span","marks":[],"text":", and see whatâs possible soon with "},{"_key":"d9db57f20d11","_type":"span","marks":["499812a7257d"],"text":"our Rust work"}],"level":1,"listItem":"bullet","markDefs":[{"_key":"acacc3e6c647","_type":"link","href":"https://tailscale.com/docs/features/tsnet"},{"_key":"499812a7257d","_type":"link","href":"https://tailscale.com/blog/tailscale-rs-rust-tsnet-library-preview"}],"style":"normal"},{"_key":"394e887a6cb2","_type":"block","children":[{"_key":"467bded21920","_type":"span","marks":[],"text":"Check out code examples in "},{"_key":"f189c8193592","_type":"span","marks":["82debd5ddf73"],"text":"our dev repository"}],"level":1,"listItem":"bullet","markDefs":[{"_key":"82debd5ddf73","_type":"link","blank":true,"href":"https://github.com/tailscale-dev/summer-with-tailscale"}],"style":"normal"},{"_key":"14b114aba0c1","_type":"block","children":[{"_key":"7e9f284ae814","_type":"span","marks":[],"text":"See what you can automate now with the "},{"_key":"0b9816383576","_type":"span","marks":["0e86593a5628"],"text":"Tailscale"},{"_key":"2a6cd7cd3561","_type":"span","marks":[],"text":" API and API docs"}],"level":1,"listItem":"bullet","markDefs":[{"_key":"0e86593a5628","_type":"link","blank":false,"href":"https://tailscale.com/api"}],"style":"normal"},{"_key":"61f571b46cdc","_type":"html","code":"\u003ca href=\"http://tailscale.com/webinars/tailscaleup-2026-recap\"\u003e\u003cimg src=\"https://cdn.sanity.io/images/w77i7m8x/production/e6e0c7dd2caa33efe5cf8cc4ccc5045f80a4760a-1500x750.png\"/\u003e\u003c/a\u003e"}],"publishedAt":"2026-08-31T14:00:00.000Z","slug":{"_type":"slug","current":"easier-building-with-tailscale"},"title":"Build with Tailscale. Build on Tailscale."}],"textCard":{"_type":"textCard","options":{"contentFontColor":"body-black","contentFontSize":"b20","contentMarginBottom":"0","contentMaxWidth":510,"hasMobileTextAlignment":false,"headingFontColor":"black","headingFontSize":"80","headingMarginBottom":"24","headingTag":"h2","highlightColor":"black","subheadingColor":"subheading-black","subheadingFontSize":"subheading","subheadingMarginBottom":"20"},"richContent":[{"_key":"be9d879c92a0","_type":"block","children":[{"_key":"4c5838a309f00","_type":"span","marks":[],"text":"A combination of our newsletter and other posts, where we talk about Tailscale, WireGuard®, two-factor auth, and other networking-related topics.\n"},{"_key":"08fd108669b2","_type":"span","marks":["mobileLineBreak"],"text":"Subscribe via "},{"_key":"2e870b86e9f0","_type":"span","marks":["29dc5d628858","mobileLineBreak"],"text":"email"},{"_key":"3af21c2b06e3","_type":"span","marks":["mobileLineBreak"],"text":", "},{"_key":"76fe941a117d","_type":"span","marks":["236e004fb1e7","mobileLineBreak"],"text":"RSS"},{"_key":"88fb05615717","_type":"span","marks":["mobileLineBreak"],"text":" or "},{"_key":"51da88c5a04b","_type":"span","marks":["18af382634ca","mobileLineBreak"],"text":"follow us on Twitter"},{"_key":"8ad6d6ba95f9","_type":"span","marks":["mobileLineBreak"],"text":"."}],"markDefs":[{"_key":"29dc5d628858","_type":"link","href":"#blog-newsletter"},{"_key":"236e004fb1e7","_type":"link","href":"https://tailscale.com/blog/index.xml"},{"_key":"18af382634ca","_type":"link","href":"https://twitter.com/tailscale"}],"style":"normal"}]}},"title":"Blog Index Page"}}],"seo":{"indexable":true,"seoCanonicalURL":"https://tailscale.com/blog","seoDescription":"Updates on innovations and the state of virtual private networks - globally, as well as Tailscale product and company news.","seoTitle":"Blog | Tailscale"},"slug":{"_type":"slug","current":"blog"},"themeColor":null,"title":null},"global":{"announcement":{"link":{"label":"Read the announcement to see what it means for you. â","url":"https://tailscale.com/blog/border0-joins-tailscale/?utm_source=announcement-bar\u0026utm_medium=content\u0026utm_campaign=border0-announcement"},"text":"Border0 has joined Tailscale!"},"footer":{"_createdAt":"2023-10-06T14:44:29Z","_id":"422b4abf-6e3f-4213-ab94-a03dd444be3d","_rev":"Dj7mvL0PPUTDs4i5zHw2yZ","_system":{"base":{"id":"422b4abf-6e3f-4213-ab94-a03dd444be3d","rev":"UhQG1jCdoCqTZDHLXbfgtb"}},"_type":"footer","_updatedAt":"2026-08-17T14:58:08Z","copyrightContent":"Tailscale Inc. All rights reserved. Tailscale is a registered trademark of Tailscale Inc.","cta":{"asset":{"_type":"asset","image":{"_type":"sanityImage","alt":"cta phone","asset":{"_ref":"image-90e2ca60be7a63ed677b56ad293b23f1aae42baa-362x567-svg","_type":"reference"}},"type":"image"},"ctaButton":{"_type":"button","buttonOptions":{"color":"white"},"link":{"title":"Get started","url":"/get-started"}},"darkLogoGrid":[{"_key":"fb360d1bc6c4","logo":{"_type":"sanityImage","alt":"mercur
1y","asset":{"_ref":"image-7dfc2f1ef3cc6eafeee143c3e7118d563f87e744-199x81-svg","_type":"reference"}}},{"_key":"a24139987731","logo":{"_type":"sanityImage","alt":"instacart","asset":{"_ref":"image-f8d8890fb95865d1ffb39df26e827b7e768a7e17-199x81-svg","_type":"reference"}}},{"_key":"0fa57e2eebee","logo":{"_type":"sanityImage","alt":"Retool","asset":{"_ref":"image-29af7cda4ae0ac0698a9de4daac73e0ad4c78f39-199x82-svg","_type":"reference"}}},{"_key":"b47251ca28bd","logo":{"_type":"sanityImage","alt":"duolingo","asset":{"_ref":"image-4a3db2857abb3613ead0308c5ce6ce1f7ba71932-199x81-svg","_type":"reference"}}}],"heading":"Try Tailscale for |free|","logoGrid":[{"_key":"a3a9b2012378","logo":{"_type":"sanityImage","alt":"mercury","asset":{"_ref":"image-4590b93f6cc3b4573e5cd5cefe90e62f935e5aa7-199x81-svg","_type":"reference"}}},{"_key":"993b75d39e13","logo":{"_type":"sanityImage","alt":"instacrt","asset":{"_ref":"image-698d5ead889b4e5a57f60549e74102b82ad7aae8-199x81-svg","_type":"reference"}}},{"_key":"8449f10eb5c7","logo":{"_type":"sanityImage","alt":"Retool","asset":{"_ref":"image-258b299c38fba23800176525d02e7ce713f74820-199x82-svg","_type":"reference"}}},{"_key":"3ab303288a39","logo":{"_type":"sanityImage","alt":"duolingo","asset":{"_ref":"image-b74adcdab85e2515c997140d08827f084bccfa2a-199x81-svg","_type":"reference"}}}],"secondaryCta":{"heading":"Schedule a demo","link":{"title":"Contact sales","url":"/contact/sales"}},"textCard":{"_type":"textCard","heading":"Try Tailscale for |free|","links":[{"_key":"dc04d805f7e0","button":{"_type":"button","buttonOptions":{"color":"white"},"link":{"title":"Get started","url":"https://login.tailscale.com/start"}},"textLink":{"_type":"textLink","textLinkOptions":{"arrowColor":"black","underlineColor":"black"}},"type":"button"}],"options":{"contentFontColor":"white","hasMobileTextAlignment":false,"headingFontColor":"white","headingFontSize":"h3","headingMarginBottom":"30","headingMaxWidth":292,"highlightColor":"blue-3","sectionAlignment":"left"}}},"footerNav":[{"_key":"05f3fa61c972","heading":"Product","links":[{"_key":"30386cf08177","title":"How it works","url":"/blog/how-tailscale-works/"},{"_key":"45dec9531713","title":"Pricing","url":"/pricing"},{"_key":"e6f4d8daff21","title":"Integrations","url":"/integrations"},{"_key":"d4f7875a767f","title":"Features","url":"/features"},{"_key":"64846fcdaf3b","title":"Compare Tailscale","url":"/compare"}]},{"_key":"7870d03d9802","heading":"Use Cases","links":[{"_key":"7b4858603fc7","title":"Business VPN","url":"/use-cases/business-vpn"},{"_key":"06fbf46e9354","title":"CI/CD","url":"/use-cases/ci-cd"},{"_key":"602f747f5b2a","title":"Infra Access","url":"/use-cases/infrastructure-access"},{"_key":"8660f39ec574","title":"Cloud Connectivity","url":"/use-cases/cloud-connectivity"},{"_key":"ab3e69241df2","title":"Zero Trust Networking","url":"/use-cases/zero-trust-networking"},{"_key":"b79f544a8266","title":"Homelab","url":"/use-cases/homelab"}]},{"_key":"2e262725243d","heading":"Resources","links":[{"_key":"b5ad8866742c","title":"Blog","url":"/blog"},{"_key":"21869f26f11b","title":"Events \u0026 Webinars","url":"/events-webinars"},{"_key":"c844ea072844","title":"Partnerships","url":"/partnerships"}]},{"_key":"a1e16018d519","heading":"Company","links":[{"_key":"8cc3fedb5b31","title":"Company","url":"/company"},{"_key":"e69d139c2c7c","title":"Careers","url":"/careers"},{"_key":"ad370d7ab2c1","title":"Press","url":"/press"}]},{"_key":"b25bd2c7203e","heading":"Help \u0026 Support","links":[{"_key":"f7d6ef6a99c6","title":"Support","url":"/contact/support"},{"_key":"18077954da8f455140153a58c74e53ba","title":"Sales","url":"/contact/sales"},{"_key":"3b91a6bb3d6b","title":"Security","url":"/security"},{"_key":"9d3e837341e2","title":"Legal","url":"/legal"},{"_key":"a69304fe5b80","title":"Open Source","url":"/opensource"}
1,{"_key":"a02943ca7fdd","title":"Changelog","url":"/changelog"},{"_key":"94a676559b98","title":"Tailscale Status","url":"https://status.tailscale.com/"}]},{"_key":"0bdaf34fbe61","heading":"Learn","links":[{"_key":"6c45141fcc65","title":"SSH keys","url":"/learn/generate-ssh-keys/"},{"_key":"86c070f995c4","title":"Docker SSH","url":"/learn/ssh-into-docker-container/"},{"_key":"22e6d051e763","title":"NAT Traversal","url":"/blog/how-nat-traversal-works/"},{"_key":"4e51a8a4f0a7","title":"MagicDNS","url":"/blog/2021-09-private-dns-with-magicdns/"},{"_key":"f8f8893085b3","title":"PAM","url":"/learn/privileged-access-management/"},{"_key":"e7fdb19bd312","title":"All articles","url":"/learn"}]}],"legalContent":"WireGuard is a registered trademark of Jason A. Donenfeld.","legalNav":[{"_key":"b3b1d8dfddea","title":"Terms of Service","url":"/terms"},{"_key":"3e22b7802445","title":"Privacy Policy","url":"/privacy-policy"},{"_key":"78a1108d49e9","title":"California Notice","url":"https://tailscale.com/privacy-policy#california-notice"},{"_key":"9d3370545d40","title":"Cookie Notice","url":"https://tailscale.com/cookie-notice"}],"title":"Production Footer"},"globalOptions":null,"header":{"_createdAt":"2023-10-06T12:21:23Z","_id":"7797109d-2dc4-4a75-b5a3-b1019c33212f","_rev":"JgNZwVoOE3fVRWVQtDlthq","_system":{"base":{"id":"7797109d-2dc4-4a75-b5a3-b1019c33212f","rev":"5FsRtrxmPymeiFerrOYlEk"}},"_type":"header","_updatedAt":"2026-04-28T20:49:26Z","button":{"_type":"button","buttonOptions":{"color":"black"},"link":{"title":"Get started - it's free!","url":"https://login.tailscale.com/start"}},"links":[{"_key":"157b4ad1150d","title":"Download","url":"/download"},{"_key":"f00209e74f6b","title":"Log in","url":"https://login.tailscale.com/welcome"}],"menu":[{"_key":"95381f81d527","hasSubmenu":true,"submenu":{"product":{"leftCol":{"topNav":{"heading":"Meet Tailscale","links":[{"_key":"5495d201056a","icon":{"_type":"sanityImage","alt":"icon"},"link":"/blog/how-tailscale-works/","title":"How it works"},{"_key":"dc9cde7ff83cb94cfc98ff29bdcd0997","icon":{"_type":"sanityImage","alt":"icon"},"link":"/why-tailscale","title":"Why Tailscale"},{"_key":"5d88e3ffcc6b","icon":{"_type":"sanityImage","alt":"WireGuard®"},"link":"/wireguard-vpn","title":"WireGuard® for Enterprises"},{"_key":"435de37ddd5f","icon":{"_type":"sanityImage","alt":"Bring Tailscale to Work"},"link":"/bring-tailscale-to-work","title":"Bring Tailscale to Work"}]}},"rightCol":{"nav":{"heading":"Explore","links":[{"_key":"c653da519dfb","link":"/integrations","title":"Integrations"},{"_key":"a878da5fa54c","link":"/features","title":"Features"},{"_key":"adda698ed879","link":"/compare","title":"Compare Tailscale"},{"_key":"3341bd9805df","link":"/community/community-projects","title":"Community Projects"},{"_key":"b57369965809","link":"/partnerships","title":"Partnerships"}]}}},"submenuType":"product"},"title":"Product"},{"_key":"a7062f1924df","hasSubmenu":true,"submenu":{"product":{"leftCol":{"topNav":{"heading":"By use-case","links":[{"_key":"6fc65e9fe1c6","link":"/use-cases/business-vpn","title":"Business VPN"},{"_key":"193eaaa0cef8","link":"/use-cases/ci-cd","title":"CI/CD"},{"_key":"c59997229dde","link":"/use-cases/infrastructure-access","title":"Infra Access"},{"_key":"05cadfcf3e65b04708a9d88060f68f9e","link":"/use-cases/cloud-connectivity","title":"Cloud Connectivity"},{"_key":"6a363d694952","link":"/use-cases/zero-trust-networking","title":"Zero Trust Networking"},{"_key":"d99d14013ab3","link":"/use-cases/homelab","title":"Homelab"},{"_key":"b049143e7a1c","link":"/use-cases/securing-ai","title":"Securing AI"}]}},"rightCol":{"nav":{"heading":"By role","links":[{"_key":"502a00f49baf","link":"/solutions/devops","title":"DevOps"},{"_key":"0fe4c0d6fa83","link":"/solutions/it","title":"IT"},{"_key":"026f30b876a7","link":"/solutions/security","title":"Security"}]}}},"submenuType":"product"},"title":"Solutions"},{"_key":"fd055b16290df04c6012d0d33c2fad13","hasSubmenu":false,"link":"/enterprise","submenu":{"submenuType":"product"},"title":"Enterprise"},{"_key":"b595975539c7407a7ed4510edd549223","hasSubmenu":false,"link":"/customers","submenu":{"product":{"leftCol":{"topNav":{"heading":"Nav heading here","links":[{"_key":"2d22491d8262","description":"How Cribl Enables Secure Work From Anywhere with Tailscale","icon":{"_type":"sanityImage","alt":"Alt text ","asset":{"_ref":"image-a06dc612b1e3e4f4df53a72030002600639a8738-300x120-png","_type":"reference"}},"link":"https://tailscale.com/customers","title":"Title here"}]}}},"resources":{"topNav":[{"_key":"61d0f0cb130e","description":"How Cribl Enables Secure Work From Anywhere with Tailscale","heading":"Cribl"},{"_key":"712684d509a6a6ea07ab9401bdb23f8f","description":"How Cribl Enables Secure Work From Anywhere with Tailscale","heading":"Cribl"},{"_key":"ceac3f234a3a6923a671af91772b7e8b","description":"How Cribl Enables Secure Work From Anywhere with Tailscale","heading":"Cribl"}]},"submenuType":"product"},"title":"Customers"},{"_key":"f06fabeb084c","hasSubmenu":false,"link":"/docs","submenu":{"submenuType":"product"},"title":"Docs"},{"_key":"f2537b6fa068","hasSubmenu":false,"link":"/blog","submenu":{"submenuType":"product"},"title":"Blog"},{"_key":"e1b7b44dc091","hasSubmenu":false,"link":"/pricing","submenu":{"submenuType":"product"},"title":"Pricing"}],"title":"Production Header"},"legal":null,"newsBar":null,"redirects":[{"_key":"8b0a3ebcf822","destination":"/wireguard-vpn","source":"/wireguard"}],"seo":{"ogImage":{"_type":"image","asset":{"_ref":"image-8e0455b2d9b33c6151016afdf2ea81d7623c2f04-1200x628-png","_type":"reference"}}},"socials":null,"newHeader":{"links":[{"feature":{"buttons":[{"_key":"eda43f90569a","_type":"buttonsMember","openInNewTab":false,"text":"Click here","url":"https://tailscale.com/use-cases/securing-ai"}],"contentText":"Unified AI governance for AI agents and users. ","image":{"alt":"aperture dashboard","asset":{"_createdAt":"2026-04-10T14:17:26Z","_id":"image-a88cf9aad8777f4b0641202a5ed6c02bbb005d8c-266x342-svg","_rev":"v1HLz1pJ8t2rE6sWIKe7CE","_type":"sanity.imageAsset","_updatedAt":"2026-04-10T14:17:26Z","assetId":"a88cf9aad8777f4b0641202a5ed6c02bbb005d8c","extension":"svg","metadata":{"_type":"sanity.imageMetadata","blurHash":"d,Ju7Txuxu%2t7RkWBay~qRjRjWBM{s:ofj[xuocWBWB","dimensions":{"_type":"sanity.imageDimensions","aspectRatio":0.7777777777777778,"height":342,"width":266},"hasAlpha":true,"isOpaque":true,"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAaABQDASIAAhEBAxEB/8QAGQABAQADAQAAAAAAAAAAAAAABwACBQgG/8QAKBAAAQIEBAYDAQAAAAAAAAAAAQIDAAQFBhESIVQHFRdxk9FBQnOS/8QAFgEBAQEAAAAAAAAAAAAAAAAAAAEC/8QAGBEAAwEBAAAAAAAAAAAAAAAAAAERAjH/2gAMAwEAAhEDEQA/AECsVe1KS661NtS6XGyApOTXWNjILtWZYC3HqWyT9VLTAXxvxavibSsHDKnQHD4g8ClBOYZ8O8a08viCq6dflu0t7SP7TFHIALhGIz4d4ozC0eOMnDW57ivKZnqPJIdllpSEqKwNQI8L0YvoN5eWt4foIXRUZ3eTPlV7jI1Gd3kz5Ve4gB7ozfQ05c35BFC8ajO7yZ8qvcUKD//Z","palette":{"_type":"sanity.imagePalette","darkMuted":{"_type":"sanity.imagePaletteSwatch","background":"#2f3550","foreground":"#fff","population":0.3,"title":"#fff"},"darkVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#2c3a6f","foreground":"#fff","population":0.59,"title":"#fff"},"dominant":{"_type":"sanity.imagePaletteSwatch","background":"#7d7d7d","foreground":"#fff","population":1.59,"title":"#fff"},"lightMuted":{"_type":"sanity.imagePaletteSwatch","background":"#a9b4d4","foreground":"#000","population":0.1,"title":"#fff"},"lightVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#7b9dcc","foreground":"#000","population":0.38,"title":"#fff"},"muted":{"_type":"sanity.imagePaletteSwatch","background":"#7d7d7d","foreground":"#fff","population":1.59,"title":"#fff"},"vibrant":{"_type":"sanity.imagePaletteSwatch","background":"#6591ea","foreground":"#fff","population":1.15,"title":"#fff"}},"thumbHash":"4geaBAAPmZl393eGCRaicBZ+cHB4eHiHBw=="},"mimeType":"image/svg+xml","originalFilename":"nav-platform-cta-aperture.svg","path":"images/w77i7m8x/production-v2/a88cf9aad8777f4b0641202a5ed6c02bbb005d8c-266x342.svg","sha1
1hash":"a88cf9aad8777f4b0641202a5ed6c02bbb005d8c","size":1123481,"uploadId":"hcqthI445Uju66Y2TYlMRwwG2aXIeXYC","url":"https://cdn.sanity.io/images/w77i7m8x/production-v2/a88cf9aad8777f4b0641202a5ed6c02bbb005d8c-266x342.svg"}},"title":"Aperture by Tailscale"},"label":"Platform","tray":{"buttons":[{"_key":"3388b94d369d","_type":"buttonsMember","openInNewTab":true,"text":"Make the case","url":"https://tailscale.com/bring-tailscale-to-work"}],"contentText":"See how Tailscale fits the systems your team already runs.","title":"Bring Tailscale to work"}},{"feature":null,"label":"Customer Stories","tray":null},{"feature":null,"label":"Community","tray":{"buttons":[{"_key":"06c200585c0f","_type":"buttonsMember","openInNewTab":true,"text":"Make the case","url":"https://tailscale.com/bring-tailscale-to-work"}],"contentText":"Start with your own devices. Bring the same simplicity to your team.","title":"Bring Tailscale to work"}},{"feature":null,"label":"Partnerships","tray":null}],"title":"Production Header"},"newAnnouncement":{"icon":"sparkles","link":{"label":"Read the recap â","url":"https://tailscale.com/tailscaleup-date-week-26"},"text":"See everything you missed at TailscaleUp.","themeColor":"purple","title":"Production Announcement"}},"post":null,"customerStory":null,"comparison":null,"eventsWebinars":null,"learn":null,"securityPolicy":null}},"__N_SSG":true},"page":"/blog","query":{},"buildId":"Nt7ie1oVhelppcz9-73LX","isFallback":false,"isExperimentalCompile":false,"gsp":true,"scriptLoader":[]}</script>
1</body></html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.