Meet the tailnet

A tailnet is the private network Tailscale creates for your account or organization. Every device you authenticate joins that network. That is it: one login, one network.

Think of it as a flat private network that follows your identity instead of a place. Your laptop at home, your phone on mobile data, and a server in a datacenter all sit on the same tailnet, as if they were plugged into the same switch.

What every device gets

Each device receives a stable Tailscale IPv4 address, an IPv6 address, and a private DNS name. The IPv4 address comes from the 100.64.0.0/10 range, a block reserved for carrier networks, so it never collides with your home or office addresses.

Run this on any enrolled device to see the whole tailnet:

tailscale status

100.87.12.44   flavio-mbp    flavio@   macOS   -
100.101.9.23   lab-server    flavio@   linux   active; direct 203.0.113.40:41641
100.114.3.7    pixel-9       flavio@   android offline

Each line is one device: its Tailscale address, its name, who owns it, its operating system, and its connection state. Those addresses do not change when a device moves between networks. That stability is what makes it safe to put them in SSH configs and connection strings.

Users, devices, and services

Users come from an identity provider, like Google or GitHub. A laptop belongs to a person, and that is the right model for it.

A production server should not belong to a person. You tag it instead, for example with tag:server, so its identity describes its role and not whoever happened to install Tailscale on it. When that person leaves, the server keeps working and keeps its policy identity.

The admin console coordinates membership, DNS, routes, and access policy for the whole tailnet. It is the one place where you see every device, who owns it, and when it was last seen. I check it often.

What stays outside

A tailnet is private by definition. Visitors to your public website never touch it. Only enrolled devices participate, and later lessons decide what each of them may reach.

Before moving on, write down the people, laptops, phones, servers, and private services that belong in a small practice tailnet. Leave public website visitors out. That list becomes your enrollment plan for the next lessons: each entry is either a person who logs in or a service that gets a tag.