Stars
Forks
Watchers
Developer links
Tailscale
With over 34,000 GitHub stars and backing from a well-funded engineering team, Tailscale has fundamentally simplified how developers and system administrators think about secure networking. The client daemon establishes WireGuard tunnels directly between devices using sophisticated NAT traversal techniques, achieving direct peer-to-peer connections in the vast majority of network configurations without requiring port forwarding, firewall rules, or VPN concentrators. When direct connections prove impossible due to restrictive network environments, DERP relay servers provide encrypted fallback paths. MagicDNS assigns human-readable hostnames to every device on the network, eliminating the need to remember IP addresses across a tailnet. Subnet routing allows nodes to advertise access to entire local networks, enabling remote access to office resources, home labs, or cloud VPCs through a single gateway node. Exit node functionality routes all internet traffic through a designated device for privacy protection or geographic flexibility. Access control lists define granular policies for which devices and users can communicate with which services, enforced cryptographically at the network layer. The authentication layer integrates with identity providers including Google, Microsoft, GitHub, Apple, and OIDC-compliant systems for single sign-on access. Taildrop enables direct encrypted file transfers between devices without cloud intermediaries. The tailscale CLI provides complete network management from the terminal including status monitoring, route advertisement, and node configuration. Running Tailscale on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console provides a permanent, always-on node in your mesh network. BSD-3-Clause licensed with an active open-source community.
Benefits
- Zero-Configuration Mesh Networking
- Install the client, authenticate with SSO, and devices automatically discover and connect to each other through encrypted WireGuard tunnels without configuring firewalls, ports, or static IPs.
- Secure Peer-to-Peer Connections
- All traffic flows through direct WireGuard tunnels between devices with end-to-end encryption, minimizing latency and eliminating central bottleneck servers from the data path.
- Identity-Based Access Control
- Granular ACL policies define which users and devices can access which services, enforced cryptographically at the network layer with SSO integration for team authentication.
- Universal Platform Coverage
- Native clients for Linux, macOS, Windows, iOS, Android, FreeBSD, and OpenBSD ensure every device in your infrastructure joins the same encrypted mesh network seamlessly.
Features
- WireGuard Mesh VPN
- Automatic peer-to-peer encrypted tunnels between all devices using WireGuard protocol with NAT traversal and DERP relay fallback.
- MagicDNS Resolution
- Human-readable hostnames for every device on the network with automatic DNS configuration and split DNS for custom domains.
- Subnet Route Advertisement
- Nodes advertise access to local networks, enabling remote connectivity to home labs, office resources, or cloud VPCs through gateway nodes.
- Exit Node Routing
- Route all internet traffic through any designated node for privacy protection, geographic flexibility, or corporate network compliance.
- Taildrop File Transfer
- Direct encrypted file sharing between devices on the tailnet without cloud intermediaries, storage limits, or third-party services.