Create a practice tailnet

Signing in to Tailscale for the first time creates your tailnet. There is no separate “create network” step. Go to tailscale.com, pick an identity provider, log in, and the tailnet exists.

For this course, use an identity you control and devices you can throw away. A personal Google or GitHub account works. Do not practice on the tailnet your team uses for production.

Check the plan before you design around it

The Personal plan currently allows six users in one tailnet, more than enough for this course. Plan details change over time, so check the official pricing page before you design anything around a limit. It is easy to build a whole setup around a number that has already moved.

Learn the admin console

Open the admin console and find these pages: Machines, Users, DNS, Access controls, and Keys. We will use every one of them. Machines lists your devices. Users shows who can log in. DNS holds the MagicDNS settings. Access controls is where the policy file lives. Keys is where auth keys and OAuth clients are created.

Write down the tailnet name and the identity provider that controls who can join. That provider is your front door. Whoever can log in there can enroll a device.

One rule about notes: never store login tokens or screenshots containing secrets in your project notes. A tailnet name is fine. An auth key is not.

Enroll two disposable devices

Put Tailscale on two devices you do not mind wiping later. Your laptop and a cheap cloud VM is the setup I use. The next two lessons walk through each installation in detail, so if you prefer, do those first and come back here for the inventory check.

After signing in on two disposable devices, inspect their state:

tailscale status
tailscale ip -4
tailscale netcheck

Record each device name and Tailscale address. Confirm which identity enrolled it. Remove any old test device you no longer control. A clean inventory makes later policy tests understandable because every node has one known owner and purpose.