Tailscale Cheatsheet¶

generieren

Tailscale ist eine moderne VPN-Lösung auf WireGuard, die sichere, verschlüsselte Netzwerke zwischen Geräten ohne die Komplexität traditioneller VPN-Setups schafft. Es bietet Null-Konfigurations-Netzwerke mit automatischer Schlüsselverwaltung, NAT-Traversal und nahtlose Verbindungen über verschiedene Netzwerke und Plattformen.

Überblick¶

Architektur und Design Philosophie¶

Tailscale arbeitet an einem Netznetzwerkmodell, bei dem jedes Gerät direkt mit anderen verbindet, wenn es möglich ist, zurück zu Relaisservern (DERP) fallen, wenn direkte Verbindungen nicht möglich sind. Der Service behandelt alle komplexen Netzwerke automatisch, einschließlich NAT-Traversal, Firewall-Konfiguration und Schlüsseldrehung.

Der Tailscale Koordinationsserver verwaltet Geräteauthentifizierung, Schlüsselverteilung und Netzwerktopologie, während der tatsächliche Datenverkehr direkt zwischen Geräten mit WireGuard-Verschlüsselung fließt. Dieser Ansatz bietet sowohl Sicherheit als auch Leistung bei gleichzeitiger einfacher Nutzung.

Schlüsselmerkmale¶

```bash

Core Tailscale Capabilities¶

WireGuard-based encryption and performance
Zero-configuration mesh networking
Automatic NAT traversal and firewall handling
Cross-platform support (Windows, macOS, Linux, iOS, Android)
Magic DNS for easy device discovery
Subnet routing and exit nodes
Access control lists (ACLs) for fine-grained permissions
SSO integration with major identity providers
Audit logging and network monitoring ```_

Installation und Inbetriebnahme¶

Linux Installation¶

```bash

Install on Ubuntu/Debian¶

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg|sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.list|sudo tee /etc/apt/sources.list.d/tailscale.list sudo apt update sudo apt install tailscale

Install on CentOS/RHEL/Fedora¶

sudo dnf config-manager --add-repo https://pkgs.tailscale.com/stable/centos/8/tailscale.repo sudo dnf install tailscale

Install on Arch Linux¶

sudo pacman -S tailscale

Start and enable Tailscale service¶

sudo systemctl enable --now tailscaled

Authenticate and connect to your network¶

sudo tailscale up

Check status¶

tailscale status

Get your device's Tailscale IP¶

tailscale ip -4 tailscale ip -6

View network map¶

tailscale netmap

Check connection quality¶

tailscale ping

Enable SSH access through Tailscale¶

sudo tailscale up --ssh

Set up as exit node¶

sudo tailscale up --advertise-exit-node

Accept routes from other devices¶

sudo tailscale up --accept-routes

Set custom hostname¶

sudo tailscale up --hostname=my-server ```_

Windows Installation¶

```powershell

Download and install Tailscale for Windows¶

$TailscaleUrl = "https://pkgs.tailscale.com/stable/tailscale-setup-latest.exe" $TailscaleInstaller = "$env:TEMP\tailscale-setup.exe"

Invoke-WebRequest -Uri $TailscaleUrl -OutFile $TailscaleInstaller Start-Process -FilePath $TailscaleInstaller -Wait

Connect to network (run as administrator)¶

tailscale up

Check status¶

tailscale status

Enable as exit node¶

tailscale up --advertise-exit-node

Configure Windows firewall for Tailscale¶

New-NetFirewallRule -DisplayName "Tailscale" -Direction Inbound -Protocol UDP -LocalPort 41641 -Action Allow New-NetFirewallRule -DisplayName "Tailscale" -Direction Outbound -Protocol UDP -LocalPort 41641 -Action Allow

Set up automatic startup¶

$TailscaleService = Get-Service -Name "Tailscale" Set-Service -Name "Tailscale" -StartupType Automatic

PowerShell script for automated deployment¶

$TailscaleConfig = @" \\\\{ "AuthKey": "$env:TAILSCALE_AUTHKEY", "Hostname": "$env:COMPUTERNAME-tailscale", "AdvertiseExitNode": false, "AcceptRoutes": true \\} "@

$TailscaleConfig|Out-File -FilePath "$env:ProgramData\Tailscale\config.json" ```_

macOS Installation¶

```bash

Install via Homebrew¶

brew install tailscale

Or download from Mac App Store¶

https://apps.apple.com/us/app/tailscale/id1475387142 ¶

Start Tailscale¶

sudo tailscale up

Check status¶

tailscale status

Configure as exit node¶

sudo tailscale up --advertise-exit-node

Enable SSH access¶

sudo tailscale up --ssh

macOS-specific network configuration¶

Allow Tailscale through macOS firewall¶

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /Applications/Tailscale.app/Contents/MacOS/Tailscale sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/Tailscale.app/Contents/MacOS/Tailscale

Configure launch daemon for automatic startup¶

sudo launchctl load /Library/LaunchDaemons/com.tailscale.tailscaled.plist ```_

Mobile Device Setup¶

```bash

iOS Setup¶

1. Download Tailscale from App Store¶

3. Device automatically appears in admin console¶

Android Setup¶

1. Download from Google Play Store¶

3. Grant VPN permissions when prompted¶

Generate auth keys for automated mobile deployment¶

tailscale up --authkey=tskey-auth-xxxxxx-xxxxxx

Create reusable auth key (admin console or API)¶

curl -X POST \ -H "Authorization: Bearer $TAILSCALE_API_KEY" \ -H "Content-Type: application/json" \ -d '\\\\{"capabilities": \\\\{"devices": \\\\{"create": \\\\{"reusable": true, "ephemeral": false\\\\}\\\\}\\\\}\\\\}' \ https://api.tailscale.com/api/v2/tailnet/$TAILNET/keys

Mobile device management via MDM¶

Example configuration for iOS/Android MDM systems¶

\\{ "authKey": "tskey-auth-xxxxxx-xxxxxx", "hostname": "mobile-device-001", "acceptRoutes": true, "exitNode": "exit-node-hostname" \\} ```_

Netzwerkkonfiguration¶

Subnet Routing¶

```bash

Advertise subnet routes¶

sudo tailscale up --advertise-routes=192.168.1.0/24,10.0.0.0/8

Accept subnet routes from other devices¶

sudo tailscale up --accept-routes

View available routes¶

tailscale status --peers

Enable IP forwarding (Linux)¶

echo 'net.ipv4.ip_forward = 1'|sudo tee -a /etc/sysctl.conf echo 'net.ipv6.conf.all.forwarding = 1'|sudo tee -a /etc/sysctl.conf sudo sysctl -p

Configure iptables for subnet routing¶

sudo iptables -t nat -A POSTROUTING -s 100.64.0.0/10 -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i tailscale0 -j ACCEPT sudo iptables -A FORWARD -o tailscale0 -j ACCEPT

Persistent iptables rules (Ubuntu/Debian)¶

sudo iptables-save|sudo tee /etc/iptables/rules.v4

Advanced routing configuration¶

Route specific traffic through Tailscale¶

sudo ip route add 192.168.100.0/24 dev tailscale0

Set up policy-based routing¶

sudo ip rule add from 100.64.0.0/10 table 100 sudo ip route add default dev tailscale0 table 100

Configure multiple subnet advertisements¶

cat > /etc/tailscale/subnet-config.sh << 'EOF'

!/bin/bash¶

SUBNETS="192.168.1.0/24,10.0.0.0/16,172.16.0.0/12" tailscale up --advertise-routes=$SUBNETS --accept-routes EOF

chmod +x /etc/tailscale/subnet-config.sh ```_

Exit Nodes¶

```bash

Set up device as exit node¶

sudo tailscale up --advertise-exit-node

Use another device as exit node¶

tailscale up --exit-node=exit-node-hostname

Use exit node with specific IP¶

tailscale up --exit-node=100.64.0.1

Disable exit node usage¶

tailscale up --exit-node=""

List available exit nodes¶

tailscale status --peers|grep "exit node"

Configure exit node with specific routes¶

sudo tailscale up --advertise-exit-node --advertise-routes=0.0.0.0/0,::/0

Exit node health monitoring¶

cat > /usr/local/bin/tailscale-exit-node-monitor.sh << 'EOF'

!/bin/bash¶

LOG_FILE="/var/log/tailscale-exit-node.log"

check_exit_node() \\{ if tailscale status|grep -q "exit node"; then echo "$(date): Exit node is active" >> $LOG_FILE return 0 else echo "$(date): Exit node is not active, restarting..." >> $LOG_FILE sudo tailscale up --advertise-exit-node return 1 fi \\}

check_connectivity() \\{ if ping -c 1 8.8.8.8 >/dev/null 2>&1; then echo "$(date): Internet connectivity OK" >> $LOG_FILE return 0 else echo "$(date): Internet connectivity failed" >> $LOG_FILE return 1 fi \\}

main() \\{ check_exit_node check_connectivity \\}

main EOF

chmod +x /usr/local/bin/tailscale-exit-node-monitor.sh

Add to crontab for monitoring¶

echo "*/5 * * * * /usr/local/bin/tailscale-exit-node-monitor.sh"|crontab - ```_

Magic DNS Konfiguration¶

```bash

Enable Magic DNS (usually enabled by default)¶

tailscale up --accept-dns

Disable Magic DNS¶

tailscale up --accept-dns=false

Configure custom DNS servers¶

tailscale up --accept-dns --dns=1.1.1.1,8.8.8.8

View DNS configuration¶

tailscale status --json|jq '.DNSConfig'

Test Magic DNS resolution¶

nslookup device-name.tailnet-name.ts.net dig device-name.tailnet-name.ts.net

Configure split DNS¶

Add to /etc/systemd/resolved.conf (Linux)¶

[Resolve] DNS=100.100.100.100 Domains=~tailnet-name.ts.net

Restart systemd-resolved¶

sudo systemctl restart systemd-resolved

Custom DNS configuration for specific domains¶

cat > /etc/tailscale/dns-config.json ``<< 'EOF' \{ "nameservers": ["1.1.1.1", "8.8.8.8"], "domains": ["company.local"], "routes": \{ "company.local": ["192.168.1.1"], "internal.corp": ["10.0.0.1"] \} \} EOF ```_

Zugriffskontrolle und Sicherheit¶

Zugangskontrolllisten (ACLs)¶

```json // Example ACL configuration (tailnet policy file) \{ "tagOwners": \{ "tag:server": ["user@company.com"], "tag:client": ["group:employees"], "tag:admin": ["user@company.com"] \},

"groups": \{ "group:employees": ["user1@company.com", "user2@company.com"], "group:admins": ["admin@company.com"], "group:servers": ["tag:server"] \},

"acls": [ \{ "action": "accept", "src": ["group:employees"], "dst": ["tag:server:22", "tag:server:80", "tag:server:443"] \}, \{ "action": "accept", "src": ["group:admins"], "dst": [":"] \}, \{ "action": "accept", "src": ["tag:server"], "dst": ["tag:server:*"] \} ],

"hosts": \{ "database-server": "100.64.0.10", "web-server": "100.64.0.20", "admin-workstation": "100.64.0.30" \},

"autoApprovers": \{ "routes": \{ "192.168.1.0/24": ["tag:server"], "10.0.0.0/8": ["group:admins"] \}, "exitNode": ["tag:server"] \} \} ```_

Authentifizierung und SSO¶

```bash

Configure SSO with Google Workspace¶

(Done through Tailscale admin console)¶

Settings >`` SSO > Add Identity Provider¶

Configure SAML SSO¶

Upload SAML metadata or configure manually:¶

- Entity ID: https://login.tailscale.com/saml/acs ¶

- ACS URL: https://login.tailscale.com/saml/acs ¶

- Attribute mapping: email, displayName¶

Configure OIDC/OAuth¶

Provider: Custom OIDC¶

Client ID: your-client-id¶

Client Secret: your-client-secret¶

Issuer URL: https://your-provider.com ¶

Force re-authentication¶

tailscale logout tailscale up

Configure device authorization¶

Require approval for new devices¶

Settings > Device Approval > Require approval¶

Set up device tags for automated approval¶

tailscale up --authkey=tskey-auth-xxxxxx --advertise-tags=tag:server

Configure session recording (enterprise feature)¶

Settings > Session Recording > Enable¶

Specify recording targets and retention policies¶

Multi-factor authentication¶

Configured at identity provider level¶

Tailscale inherits MFA requirements from SSO provider¶

```_

Schlüsselverwaltung¶

```bash

View device keys¶

tailscale status --json|jq '.Peer[].Key'

Rotate machine key¶

sudo tailscale up --force-reauth

Generate auth keys via API¶

curl -X POST \ -H "Authorization: Bearer $TAILSCALE_API_KEY" \ -H "Content-Type: application/json" \ -d '\\\\{ "capabilities": \\\\{ "devices": \\\\{ "create": \\\\{ "reusable": false, "ephemeral": true, "preauthorized": true, "tags": ["tag:server"] \\\\} \\\\} \\\\}, "expirySeconds": 3600 \\\\}' \ https://api.tailscale.com/api/v2/tailnet/$TAILNET/keys

Revoke auth key¶

curl -X DELETE \ -H "Authorization: Bearer $TAILSCALE_API_KEY" \ https://api.tailscale.com/api/v2/tailnet/$TAILNET/keys/$KEY_ID

Configure key expiry¶

tailscale up --authkey=tskey-auth-xxxxxx --timeout=24h

Backup and restore device configuration¶

Export device configuration¶

tailscale status --json > tailscale-backup.json

Key rotation automation script¶

cat > /usr/local/bin/tailscale-key-rotation.sh << 'EOF'

!/bin/bash¶

LOG_FILE="/var/log/tailscale-key-rotation.log" ROTATION_INTERVAL_DAYS=30

check_key_age() \\{ LAST_ROTATION=$(tailscale status --json|jq -r '.Self.LastSeen') CURRENT_TIME=$(date +%s) LAST_ROTATION_TIME=$(date -d "$LAST_ROTATION" +%s) AGE_DAYS=$(( (CURRENT_TIME - LAST_ROTATION_TIME) / 86400 ))

if [ $AGE_DAYS -gt $ROTATION_INTERVAL_DAYS ]; then
    echo "$(date): Key is $AGE_DAYS days old, rotating..." >> $LOG_FILE
    return 0
else
    echo "$(date): Key is $AGE_DAYS days old, no rotation needed" >> $LOG_FILE
    return 1
fi

\\}

rotate_key() \\{ echo "$(date): Starting key rotation" >> $LOG_FILE sudo tailscale up --force-reauth --authkey=$TAILSCALE_AUTHKEY if [ $? -eq 0 ]; then echo "$(date): Key rotation successful" >> $LOG_FILE else echo "$(date): Key rotation failed" >> $LOG_FILE fi \\}

if check_key_age; then rotate_key fi EOF

chmod +x /usr/local/bin/tailscale-key-rotation.sh ```_

Überwachung und Fehlerbehebung¶

Netzwerkdiagnose¶

```bash

Check Tailscale status¶

tailscale status

Detailed status with JSON output¶

tailscale status --json

Check connectivity to specific peer¶

tailscale ping device-name

Network map and topology¶

tailscale netmap

Debug connection issues¶

tailscale debug --help

Check DERP (relay) server connectivity¶

tailscale netcheck

View logs¶

sudo journalctl -u tailscaled -f

Debug specific peer connection¶

tailscale debug peer-status

Check NAT traversal¶

tailscale debug derp-map

Network performance testing¶

tailscale debug ping tailscale debug speedtest

Capture network traffic for debugging¶

sudo tcpdump -i tailscale0 -w tailscale-debug.pcap

Check firewall rules affecting Tailscale¶

sudo iptables -L|grep tailscale sudo ufw status|grep tailscale

DNS troubleshooting¶

tailscale debug dns-config nslookup device-name.tailnet.ts.net 100.100.100.100 ```_

Leistungsüberwachung¶

```bash

Monitor Tailscale interface statistics¶

watch -n 1 'cat /proc/net/dev|grep tailscale'

Bandwidth monitoring¶

iftop -i tailscale0 nethogs tailscale0

Connection quality monitoring¶

cat > /usr/local/bin/tailscale-monitor.sh << 'EOF'

!/bin/bash¶

LOG_FILE="/var/log/tailscale-monitor.log" PEERS_FILE="/tmp/tailscale-peers.txt"

Get list of peers¶

tailscale status --peers > $PEERS_FILE

Monitor each peer¶

while read -r line; do if [[ $line =~ ^([0-9.]+)[[:space:]]+([^[:space:]]+) ]]; then PEER_IP="$\\{BASH_REMATCH[1]\\}" PEER_NAME="$\\{BASH_REMATCH[2]\\}"

    # Ping test
    PING_RESULT=$(tailscale ping $PEER_NAME 2>/dev/null|head -1)

    # Log result
    echo "$(date): $PEER_NAME ($PEER_IP) - $PING_RESULT" >> $LOG_FILE
fi

done < $PEERS_FILE

Check overall network health¶

NETCHECK_RESULT=$(tailscale netcheck 2>/dev/null) echo "$(date): Network check - $NETCHECK_RESULT" >> $LOG_FILE EOF

chmod +x /usr/local/bin/tailscale-monitor.sh

Add to crontab for regular monitoring¶

echo "*/5 * * * * /usr/local/bin/tailscale-monitor.sh"|crontab -

Performance metrics collection¶

cat > /usr/local/bin/tailscale-metrics.sh << 'EOF'

!/bin/bash¶

METRICS_FILE="/var/log/tailscale-metrics.log"

Get interface statistics¶

RX_BYTES=$(cat /sys/class/net/tailscale0/statistics/rx_bytes) TX_BYTES=$(cat /sys/class/net/tailscale0/statistics/tx_bytes) RX_PACKETS=$(cat /sys/class/net/tailscale0/statistics/rx_packets) TX_PACKETS=$(cat /sys/class/net/tailscale0/statistics/tx_packets)

Get peer count¶

PEER_COUNT=$(tailscale status --peers|wc -l)

Log metrics¶

echo "$(date),$RX_BYTES,$TX_BYTES,$RX_PACKETS,$TX_PACKETS,$PEER_COUNT" >> $METRICS_FILE EOF

chmod +x /usr/local/bin/tailscale-metrics.sh ```_

Probleme bei der Fehlerbehebung¶

```bash

Connection issues troubleshooting¶

1. Check if tailscaled is running¶

sudo systemctl status tailscaled

2. Restart Tailscale service¶

sudo systemctl restart tailscaled

3. Re-authenticate¶

tailscale logout tailscale up

4. Check firewall rules¶

sudo ufw status sudo iptables -L

5. Verify network connectivity¶

ping 8.8.8.8 tailscale netcheck

DNS resolution issues¶

1. Check DNS configuration¶

tailscale status --json|jq '.DNSConfig'

2. Test Magic DNS¶

nslookup device-name.tailnet.ts.net

3. Reset DNS configuration¶

sudo tailscale up --accept-dns=false sudo tailscale up --accept-dns

4. Check system DNS settings¶

cat /etc/resolv.conf systemd-resolve --status

Performance issues¶

1. Check for direct connections vs DERP relay¶

tailscale status|grep "relay"

2. Test different DERP regions¶

tailscale netcheck

3. Check for packet loss¶

tailscale ping device-name

4. Monitor bandwidth usage¶

iftop -i tailscale0

Authentication issues¶

1. Check auth key validity¶

tailscale up --authkey=tskey-auth-xxxxxx

2. Verify SSO configuration¶

Check admin console for SSO errors¶

3. Clear cached credentials¶

rm -rf ~/.config/tailscale/ sudo rm -rf /var/lib/tailscale/

4. Force re-authentication¶

tailscale up --force-reauth

Subnet routing issues¶

1. Verify IP forwarding is enabled¶

cat /proc/sys/net/ipv4/ip_forward

2. Check iptables rules¶

sudo iptables -t nat -L

3. Verify route advertisement¶

tailscale status|grep "subnets"

4. Test connectivity to subnet¶

ping 192.168.1.1 # Replace with actual subnet IP

Complete reset procedure¶

sudo systemctl stop tailscaled sudo rm -rf /var/lib/tailscale/ sudo systemctl start tailscaled tailscale up ```_

API und Automatisierung¶

Tailscale API Verwendung¶

```bash

Set up API access¶

export TAILSCALE_API_KEY="tskey-api-xxxxxx" export TAILNET="your-tailnet.ts.net"

List devices¶

curl -H "Authorization: Bearer $TAILSCALE_API_KEY" \ https://api.tailscale.com/api/v2/tailnet/$TAILNET/devices

Get device details¶

curl -H "Authorization: Bearer $TAILSCALE_API_KEY" \ https://api.tailscale.com/api/v2/device/$DEVICE_ID

Update device settings¶

curl -X POST \ -H "Authorization: Bearer $TAILSCALE_API_KEY" \ -H "Content-Type: application/json" \ -d '\\\\{"name": "new-device-name"\\\\}' \ https://api.tailscale.com/api/v2/device/$DEVICE_ID

Delete device¶

curl -X DELETE \ -H "Authorization: Bearer $TAILSCALE_API_KEY" \ https://api.tailscale.com/api/v2/device/$DEVICE_ID

Create auth key¶

curl -X POST \ -H "Authorization: Bearer $TAILSCALE_API_KEY" \ -H "Content-Type: application/json" \ -d '\\\\{ "capabilities": \\\\{ "devices": \\\\{ "create": \\\\{ "reusable": true, "ephemeral": false, "preauthorized": true, "tags": ["tag:server"] \\\\} \\\\} \\\\}, "expirySeconds": 86400 \\\\}' \ https://api.tailscale.com/api/v2/tailnet/$TAILNET/keys

Get ACL policy¶

curl -H "Authorization: Bearer $TAILSCALE_API_KEY" \ https://api.tailscale.com/api/v2/tailnet/$TAILNET/acl

Update ACL policy¶

curl -X POST \ -H "Authorization: Bearer $TAILSCALE_API_KEY" \ -H "Content-Type: application/json" \ -d @acl-policy.json \ https://api.tailscale.com/api/v2/tailnet/$TAILNET/acl ```_

Infrastruktur als Code¶

```yaml

Terraform configuration for Tailscale¶

terraform \\{ required_providers \\{ tailscale = \\{ source = "tailscale/tailscale" version = "~> 0.13" \\} \\} \\}

provider "tailscale" \\{ api_key = var.tailscale_api_key tailnet = var.tailnet \\}

Create auth key¶

resource "tailscale_tailnet_key" "server_key" \\{ reusable = true ephemeral = false preauthorized = true expiry = 86400 description = "Server deployment key"

tags = [ "tag: server", "tag: production" ] \\}

ACL policy¶

resource "tailscale_acl" "main" \\{ acl = jsonencode(\\{ tagOwners = \\{ "tag: server" = ["user@company.com"] "tag: client" = ["group:employees"] \\}

groups = \\\\{
  "group: employees" = ["user1@company.com", "user2@company.com"]
  "group: admins"    = ["admin@company.com"]
\\\\}

acls = [
  \\\\{
    action = "accept"
    src    = ["group: employees"]
    dst    = ["tag: server:22", "tag:server:80", "tag:server:443"]
  \\\\},
  \\\\{
    action = "accept"
    src    = ["group: admins"]
    dst    = ["*: *"]
  \\\\}
]

\\}) \\}

DNS configuration¶

resource "tailscale_dns_nameservers" "main" \\{ nameservers = ["1.1.1.1", "8.8.8.8"] \\}

resource "tailscale_dns_search_paths" "main" \\{ search_paths = ["company.local", "internal.corp"] \\} ```_

Ansible Playbook¶

```yaml

Ansible playbook for Tailscale deployment¶

name: Deploy Tailscale hosts: all become: yes vars: tailscale_authkey: "\\{\\{ vault_tailscale_authkey \\}\\}" tailscale_hostname: "\\{\\{ inventory_hostname \\}\\}-tailscale"

tasks: - name: Add Tailscale repository (Ubuntu/Debian) block: - name: Add Tailscale GPG key apt_key: url: https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg state: present

    - name: Add Tailscale repository
      apt_repository:
        repo: "deb https://pkgs.tailscale.com/stable/ubuntu focal main"
        state: present

    - name: Update package cache
      apt:
        update_cache: yes
  when: ansible_os_family == "Debian"

- name: Add Tailscale repository (CentOS/RHEL)
  yum_repository:
    name: tailscale
    description: Tailscale repository
    baseurl: https://pkgs.tailscale.com/stable/centos/8/
    gpgcheck: yes
    gpgkey: https://pkgs.tailscale.com/stable/centos/8/repo.gpg
  when: ansible_os_family == "RedHat"

- name: Install Tailscale
  package:
    name: tailscale
    state: present

- name: Enable and start tailscaled service
  systemd:
    name: tailscaled
    enabled: yes
    state: started

- name: Connect to Tailscale network
  command: >
    tailscale up
    --authkey=\\\\{\\\\{ tailscale_authkey \\\\}\\\\}
    --hostname=\\\\{\\\\{ tailscale_hostname \\\\}\\\\}
    --accept-routes
    \\\\{% if tailscale_advertise_routes is defined %\\\\}
    --advertise-routes=\\\\{\\\\{ tailscale_advertise_routes \\\\}\\\\}
    \\\\{% endif %\\\\}
    \\\\{% if tailscale_exit_node is defined %\\\\}
    --advertise-exit-node
    \\\\{% endif %\\\\}
  register: tailscale_up_result
  changed_when: "'Success' in tailscale_up_result.stdout"

- name: Enable IP forwarding (if advertising routes)
  sysctl:
    name: "\\\\{\\\\{ item \\\\}\\\\}"
    value: "1"
    state: present
    reload: yes
  loop:
    - net.ipv4.ip_forward
    - net.ipv6.conf.all.forwarding
  when: tailscale_advertise_routes is defined or tailscale_exit_node is defined

- name: Configure iptables for subnet routing
  iptables:
    table: nat
    chain: POSTROUTING
    source: 100.64.0.0/10
    out_interface: "\\\\{\\\\{ ansible_default_ipv4.interface \\\\}\\\\}"
    jump: MASQUERADE
  when: tailscale_advertise_routes is defined or tailscale_exit_node is defined

- name: Save iptables rules
  shell: iptables-save > /etc/iptables/rules.v4
  when: tailscale_advertise_routes is defined or tailscale_exit_node is defined

```_

Docker Integration¶

```dockerfile

Dockerfile with Tailscale¶

FROM ubuntu:20.04

Install Tailscale¶

RUN apt-get update && apt-get install -y curl gnupg && \ curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg|apt-key add - && \ echo "deb https://pkgs.tailscale.com/stable/ubuntu focal main" > /etc/apt/sources.list.d/tailscale.list && \ apt-get update && apt-get install -y tailscale && \ rm -rf /var/lib/apt/lists/*

Copy startup script¶

COPY start-tailscale.sh /usr/local/bin/ RUN chmod +x /usr/local/bin/start-tailscale.sh

Expose Tailscale port¶

EXPOSE 41641/udp

CMD ["/usr/local/bin/start-tailscale.sh"] _bash

Docker startup script¶

!/bin/bash¶

start-tailscale.sh¶

Start tailscaled in background¶

tailscaled --state=/var/lib/tailscale/tailscaled.state &

Wait for tailscaled to start¶

sleep 5

Connect to Tailscale network¶

tailscale up --authkey=$TAILSCALE_AUTHKEY --hostname=$HOSTNAME

Keep container running¶

tail -f /dev/null _yaml

Docker Compose with Tailscale¶

version: '3.8'

services: app-with-tailscale: build: . environment: - TAILSCALE_AUTHKEY=$\\{TAILSCALE_AUTHKEY\\} - HOSTNAME=docker-app volumes: - tailscale-data:/var/lib/tailscale cap_add: - NET_ADMIN devices: - /dev/net/tun sysctls: - net.ipv4.ip_forward=1 - net.ipv6.conf.all.forwarding=1

volumes: tailscale-data: ```_

Ressourcen¶

[Tailscale Offizielle Website](LINK_5 -%20Schriftliche%20Dokumentation
Tailscale GitHub Repository
[WireGuard Protocol](LINK_5 -%20Nachhaltige%20API-Dokumentation

Tailscale Cheatsheet¶

Überblick¶

Architektur und Design Philosophie¶

Schlüsselmerkmale¶

Core Tailscale Capabilities¶

Installation und Inbetriebnahme¶

Linux Installation¶

Install on Ubuntu/Debian¶

Install on CentOS/RHEL/Fedora¶

Install on Arch Linux¶

Start and enable Tailscale service¶

Authenticate and connect to your network¶

Check status¶

Get your device's Tailscale IP¶

View network map¶

Check connection quality¶

Enable SSH access through Tailscale¶

Set up as exit node¶

Accept routes from other devices¶

Set custom hostname¶

Windows Installation¶

Download and install Tailscale for Windows¶

Connect to network (run as administrator)¶

Check status¶

Enable as exit node¶

Configure Windows firewall for Tailscale¶

Set up automatic startup¶

PowerShell script for automated deployment¶

macOS Installation¶

Install via Homebrew¶

Or download from Mac App Store¶

https://apps.apple.com/us/app/tailscale/id1475387142¶

Start Tailscale¶

Check status¶

Configure as exit node¶

Enable SSH access¶

macOS-specific network configuration¶

Allow Tailscale through macOS firewall¶

Configure launch daemon for automatic startup¶

Mobile Device Setup¶

iOS Setup¶

1. Download Tailscale from App Store¶

2. Sign in with your account¶

3. Device automatically appears in admin console¶

Android Setup¶

1. Download from Google Play Store¶

2. Sign in with your account¶

3. Grant VPN permissions when prompted¶

Generate auth keys for automated mobile deployment¶

Create reusable auth key (admin console or API)¶

Mobile device management via MDM¶

Example configuration for iOS/Android MDM systems¶

Netzwerkkonfiguration¶

Subnet Routing¶

Advertise subnet routes¶

Accept subnet routes from other devices¶

View available routes¶

Enable IP forwarding (Linux)¶

Configure iptables for subnet routing¶

Persistent iptables rules (Ubuntu/Debian)¶

Advanced routing configuration¶

Route specific traffic through Tailscale¶

Set up policy-based routing¶

Configure multiple subnet advertisements¶

!/bin/bash¶

Exit Nodes¶

Set up device as exit node¶

Use another device as exit node¶

Use exit node with specific IP¶

Disable exit node usage¶

List available exit nodes¶

Configure exit node with specific routes¶

Exit node health monitoring¶

!/bin/bash¶

Add to crontab for monitoring¶

Magic DNS Konfiguration¶

Enable Magic DNS (usually enabled by default)¶

Disable Magic DNS¶

Configure custom DNS servers¶

View DNS configuration¶

https://apps.apple.com/us/app/tailscale/id1475387142 ¶

- Entity ID: https://login.tailscale.com/saml/acs ¶

- ACS URL: https://login.tailscale.com/saml/acs ¶

Issuer URL: https://your-provider.com ¶