.. /Tailscale
Star

Install
Access

Tailscale is a commercial overlay VPN built on WireGuard that connects devices into a private network (tailnet). The control server is closed source; the client code (tailscale/tailscaled) is open source under a BSD-3 license with a separate patents file. Can be abused for persistent remote access, SSH access to hosts, egress via exit nodes, and exposing internal services to the public internet via Tailscale Funnel.

Paths:

Resources:

Acknowledgements:

Detections:

Install

  1. Connects the device to the user's tailnet and authenticates if needed.

    tailscale up
    Use case
    Enroll a host into a private overlay network.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

  1. Enables Tailscale SSH on the device, intercepting port 22 traffic from the tailnet and permitting access per the tailnet ACL policy.

    tailscale up --ssh
    Use case
    Remote shell access to a host without traditional SSH keys/password.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

Access

  1. Shares a local service (e.g. a web server on port 3000) with other devices on the tailnet over HTTPS.

    tailscale serve 3000
    Use case
    Expose an internal service to the private tailnet.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

  2. Exposes a local service to the public internet with a generated HTTPS URL via Tailscale Funnel.

    tailscale funnel 3000
    Use case
    Publish an internal service publicly, bypassing firewalls/NAT.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD