Separate the control and data planes

Tailscale splits its work in two: coordination and packet transport. Understanding this split tells you how the system works and, more importantly, what you trust Tailscale with.

The control plane

The control plane is the coordination service Tailscale runs. It distributes identities, public keys, policies, routes, DNS settings, and endpoint information.

When your laptop joins, it tells the control plane “here is my public key, and here are the addresses where you can reach me”. In return it receives the same information about every peer it is allowed to see.

The coordination service never sits in the normal data path, and it never holds device private keys. Each device generates its own private key locally, and that key never leaves the machine.

The data plane

The data plane runs on your devices and carries the actual traffic, encrypted with WireGuard. When you SSH from your laptop to a server, the packets flow between those two machines. If a direct path fails, they go through a relay, which we cover in the next lesson. They never pass through Tailscale’s servers as readable traffic.

You can watch the data plane at work with tailscale ping:

tailscale ping lab-server

pong from lab-server (100.101.9.23) via 203.0.113.40:41641 in 12ms

That via 203.0.113.40:41641 is a direct UDP path between your two devices. The control plane helped them find each other, then stepped aside.

Why the split matters

If the coordination service becomes unreachable, your existing connections keep working. Devices already hold each other’s keys and endpoints. What breaks is change: new devices cannot join, and policy updates stop propagating until the service returns.

The split also defines your trust boundary. Tailscale can see which devices exist and which endpoints they use. It cannot read your traffic, because it never had the private keys that would decrypt it. This is a real, checkable property, not a marketing claim.

Here is a quick exercise. Take a file transfer between two devices and label each step as control-plane or data-plane work: key distribution, policy distribution, encryption, packet transport, and decryption. The first two belong to the control plane. Everything else happens on your own devices.