{"slug":"share-your-machines-with-other-users","title":"Share your machines with other users","tags":["tailscale"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Share your machines with other users\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nSharingis currently [in beta](https://tailscale.com/docs/reference/tailscale-release-stages#beta). To try it, follow the steps below to enable it for your network using Tailscale v1.4 or later.\r\n\r\nSharingis available for [all plans](https://tailscale.com/pricing).\r\n\r\nYou can share access to specific machines with people outside your Tailscale network (known as a tailnet) without exposing them to the public internet. Sharing gives the recipient access to only the shared machine in your tailnet, and nothing else.\r\n\r\nUsers in your tailnet can access all machines as governed by [access control policies](https://tailscale.com/docs/features/access-control); sharing a machine is only required for allowing external users to access a machine.\r\n\r\nSharing respects the access control policies and [MagicDNS](https://tailscale.com/docs/features/sharing#sharing-and-magicdns) settings of both your tailnet and the recipient's tailnet. Sharing strips [tags](https://tailscale.com/docs/features/tags), [groups](https://tailscale.com/docs/reference/syntax/policy-file#groups), and [subnet](https://tailscale.com/docs/features/sharing#sharing--subnets-subnet-routers) information from the recipient tailnet. A shared machine is visible only to the individual recipient user—it is not visible to the recipient user's entire tailnet.\r\n\r\n## [Share a machine with another user](https://tailscale.com/docs/features/sharing\\#share-a-machine-with-another-user)\r\n\r\nYou need to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to share a machine.\r\n\r\nTo share a machine:\r\n\r\n1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console and find the machine you'd like to share.\r\n2. Send invites [by email](https://tailscale.com/docs/features/sharing#share-using-email) or [manually by using links](https://tailscale.com/docs/features/sharing#share-using-a-link).\r\n3. [Wait for the recipient to accept](https://tailscale.com/docs/features/sharing#wait-for-the-recipient-to-accept).\r\n\r\nAfter the recipient accepts the invite, they can access the shared machine from their Tailscale clients and admin console, as if it was on their own tailnet. For example, the macOS app will display it in the menu bar, and Linux apps will find it from `tailscale status`.\r\n\r\nNotes about shared machines:\r\n\r\n- Tailscale [quarantines](https://tailscale.com/docs/features/sharing#quarantine) shared machines by default. A shared machine can receive incoming connections (from the other user's tailnet) but cannot start connections. This means users can accept shares without exposing their tailnet to risks.\r\n- As of Tailscale v1.4, shared machines appear in the other tailnet as the sharer, not the owner of the machine. If Ross shares his co-worker Dave's machine to another tailnet, it will appear to be owned by Ross in the new tailnet.\r\n- Unused invite links expire after 30 days.\r\n\r\nA machine cannot be shared with a tag or accessed by tagged machines on another tailnet, as only users can accept machine shares.\r\n\r\n### [Share using email](https://tailscale.com/docs/features/sharing\\#share-using-email)\r\n\r\nWhen you send invites by email, each specified recipient receives a single-use invite link to your machine. The recipient does not need to have a Tailscale account with the same email address. They can log in and accept the share from any Tailscale account.\r\n\r\n1. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu, then select **Share** to open the **Share** dialog.\r\n2. Select the **Share by email** tab.\r\n3. Add the email address for each user that you want to send invite links.\r\n4. Select **Share** to send email invitations to each listed email address.\r\n\r\n### [Share using a link](https://tailscale.com/docs/features/sharing\\#share-using-a-link)\r\n\r\nFor invite links you plan to share manually, you can choose to make a single-use or reusable invite link. A single-use invite link is a one-time use link. A reusable invite link can be used up to 1,000 times. Unused links expire in 30 days for both single-use and reusable invite links.\r\n\r\n1. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu, then select **Share** to open the **Share** dialog.\r\n2. Select **Copy invite link** tab.\r\n3. (Optional): Toggle on **Reusable link** for a link that can be accepted more than once.\r\n4. Select **Copy share link** to create the link and copy it to your clipboard.\r\n5. Share the copied invite link to your intended recipient. Treat the invite link the way you would a password. It provides the ability to connect to a machine within your tailnet.\r\n\r\n### [Wait for the recipient to accept](https://tailscale.com/docs/features/sharing\\#wait-for-the-recipient-to-accept)\r\n\r\nA recipient needs to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to accept a shared machine invitation.\r\n\r\nThe recipient can visit the invite link to review your invitation. After they accept, you can find their profile picture and email address in the **Share** dialog. You'll also find an indicator in the **Machines** list on the admin console showing which machines have been shared to external users.\r\n\r\nUnused invite links expire after 30 days.\r\n\r\n## [Revoke an invite](https://tailscale.com/docs/features/sharing\\#revoke-an-invite)\r\n\r\nYou need to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to revoke a share or share invite.\r\n\r\nYou can revoke a share or share invite from the [Machines](https://login.tailscale.com/admin/machines) page of the admin console. After you revoke an invite, the recipient user can no longer access the shared machine. To restore access, you must create a new invite and the recipient must accept that new invite.\r\n\r\nTo revoke an invite:\r\n\r\n1. Go to the [Machines](https://login.tailscale.com/admin/machines) page of the admin console.\r\n2. Select the **Share** option for the machine.\r\n3. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu > **Revoke invite**.\r\n\r\n## [How sharing works](https://tailscale.com/docs/features/sharing\\#how-sharing-works)\r\n\r\nSharing a machine exposes that machine to a user on another tailnet. Only that user is able to access your machine. It is invisible to other users on that tailnet.\r\n\r\n![In this example, only the shared machine from tailnet A and the share recipient's machines in tailnet B can talk across tailnet boundaries.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsharing-access.91254a95.png&w=3840&q=75)\r\n\r\nIn this example, only the shared machine from tailnet A and the share recipient's machines in tailnet B can talk across tailnet boundaries.\r\n\r\nWhen you accept an invite, Tailscale exposes the minimum set of information possible about your tailnet to that machine. Accepting an invite exposes:\r\n\r\n- The email and avatar of the recipient (required to help confirm invites)\r\n- Physical machine IPs of machines from your tailnet (required for connections)\r\n\r\n### [Quarantine](https://tailscale.com/docs/features/sharing\\#quarantine)\r\n\r\nShared machines are quarantined by default. They can respond to incoming connections from the tailnet they're shared to, but cannot start connections on their own. Quarantining helps sharing be \"secure by default\", since you can accept shares with no risk of exposing your tailnet.\r\n\r\n### [Sharing and MagicDNS](https://tailscale.com/docs/features/sharing\\#sharing-and-magicdns)\r\n\r\n[MagicDNS](https://tailscale.com/docs/features/magicdns) is a per-tailnet setting. If your tailnet has MagicDNS enabled, you can access machines over MagicDNS regardless of the other tailnet's settings.\r\n\r\nShared machines support MagicDNS in Tailscale v1.4 or later. Shared machines can only be reached by using their fully qualified domain name, which looks like `..ts.net`.\r\n\r\n- `` is the name of a machine.\r\n- `` is the [tailnet name](https://tailscale.com/docs/concepts/tailnet-name) of a tailnet.\r\n\r\nFor example, if your friend shares a machine named `minecraft-server` on the `yak-bebop` tailnet to your tailnet, you can reach it at `minecraft-server.yak-bebop.ts.net`. However, you can't reach it at `minecraft-server` from your tailnet.\r\n\r\nPreviously, you might have used a tailnet DNS name ending in `.beta.tailscale.net`. If so, migrate to the new tailnet DNS name that ends in `.ts.net`. Support for the `beta.tailscale.net` name ended on **September 13, 2024**.\r\n\r\nThese restrictions are necessary to prevent MagicDNS names from changing unexpectedly, and to support future features on top of sharing.\r\n\r\n### [Sharing and access control policies](https://tailscale.com/docs/features/sharing\\#sharing-and-access-control-policies)\r\n\r\nWhen a user accepts a share, the user can make outbound requests to the shared machine, which will adhere to any [access control policies](https://tailscale.com/docs/features/access-control) defined in the tailnet that owns the shared machine.\r\n\r\nBy default, the shared machine is quarantined and cannot make outbound requests to the user's machines. However, it's possible to \"mutually share\" machines, allowing the machines to make outbound connections to each other.\r\n\r\nFor example, if you have `workstation-1` (owned by `example-company-tailnet`) and `workstation-2` (owned by `sam@example.com`) and you want `workstation-1` and `workstation-2` to have access to each other, you would:\r\n\r\n1. Share workstation-1 with `alice@example.com`.\r\n2. Share workstation-2 with `alice@example-company.com`.\r\n\r\nIf you're [having trouble connecting to a shared machine](https://tailscale.com/docs/features/sharing#troubleshooting), review your tailnet policy file for rules that might be blocking access.\r\n\r\nTo write [access rules](https://tailscale.com/docs/reference/syntax/policy-file#acls) that apply to a shared machine, you can use the email address of the recipient. For example, if you invite `alice@example.com` to share a machine at `100.74.78.2`, you can give Alice access to a particular host.\r\n\r\n```json\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"group:admins\"],\\\r\n \"dst\": [\"*\"],\\\r\n \"ip\": [\"*\"]\\\r\n },\\\r\n {\\\r\n \"src\": [\"alice@example.com\"],\\\r\n \"dst\": [\"100.74.78.2\"],\\\r\n \"ip\": [\"*\"]\\\r\n }\\\r\n]\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\nBe careful of rules like `\"src\": [\"*\"]`, which apply to everyone who has access to your tailnet, including invited users. Consider making a group that includes all your tailnet users instead of `*`.\r\n\r\nYou can also write access rules by using the special `autogroup:shared` group. This group automatically includes all users invited to your tailnet, and lets you write rules without knowing email addresses in advance.\r\n\r\nFor example, to restrict invited users to only access web server ports `80` and `443`, you can write a rule like:\r\n\r\n```json\r\n\"grants\": [\\\r\n // Admins can access everything in the tailnet.\\\r\n {\\\r\n \"src\": [\"group:admins\"],\\\r\n \"dst\": [\"*\"],\\\r\n \"ip\": [\"*\"]\\\r\n },\\\r\n // Shared users can only access port 80 and 443 of machines they are invited to.\\\r\n {\\\r\n \"src\": [\"autogroup:shared\"],\\\r\n \"dst\": [\"*\"],\\\r\n \"ip\": [\"80\", \"443\"]\\\r\n }\\\r\n]\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\nRemember: invited users are only able to access machines you've invited them to share. Access rules further limit what they can access. Although the rule `*:80,443` seems like it lets users access all machines, it only further restricts their access to the ports we've specified.\r\n\r\nSharing does not expose [tag](https://tailscale.com/docs/features/tags) to the other tailnet. All tag information is stripped and cannot be used in the tailnet policy file of the other tailnet.\r\n\r\n### [Sharing and Subnets (subnet routers)](https://tailscale.com/docs/features/sharing\\#sharing-and-subnets-subnet-routers)\r\n\r\nShared machines do not advertise [subnets](https://tailscale.com/docs/features/subnet-routers) to the tailnets they're shared into, while [inviting](https://tailscale.com/docs/features/sharing/how-to/invite-any-user) external users into your tailnet will give them access to subnet routers.\r\n\r\n### [Sharing and Exit Nodes](https://tailscale.com/docs/features/sharing\\#sharing-and-exit-nodes)\r\n\r\nSharing an [exit node](https://tailscale.com/docs/features/exit-nodes) exposes it to the other tailnet.\r\n\r\nTo share an exit node, use the following sequence:\r\n\r\n1. [Advertise the machine as an exit node](https://tailscale.com/docs/features/exit-nodes#advertise-a-device-as-an-exit-node).\r\n\r\n2. If you are not using [`autoApprovers`](https://tailscale.com/docs/reference/syntax/policy-file#autoapprovers), [allow the exit node from the admin console](https://tailscale.com/docs/features/exit-nodes#allow-the-exit-node-from-the-admin-console).\r\n\r\n3. Share the machine per the instructions above, allowing the recipient to use it as an exit node. Ensure the **Allow use as an exit node** option is checked.\r\n\r\n\r\nIf a [user is deleted](https://tailscale.com/docs/features/sharing/how-to/remove-team-members), the shared machines they manage will be deleted. If a user is suspended, the shared machines they manage will not be able to connect to other machines.\r\n\r\n### [Sharing and suspended or deleted users](https://tailscale.com/docs/features/sharing\\#sharing-and-suspended-or-deleted-users)\r\n\r\nWhen you [delete a user](https://tailscale.com/docs/features/sharing/how-to/remove-team-members), it also deletes the shared machines they manage. If you suspend a user, Tailscale prevents the shared machines they manage from connecting to other machines.\r\n\r\n### [Sharing and Tailnet Lock](https://tailscale.com/docs/features/sharing\\#sharing-and-tailnet-lock)\r\n\r\nA node shared into a tailnet with [Tailnet Lock](https://tailscale.com/docs/features/tailnet-lock) requires a signature before it is accessible.\r\n\r\nTo share nodes out of a tailnet with Tailnet Lock, the user who accepts the share invite needs to have their nodes signed in the locked tailnet before they can access the shared node.\r\n\r\n### [Sharing and rewards](https://tailscale.com/docs/features/sharing\\#sharing-and-rewards)\r\n\r\nEvery time you share a machine with a unique user, and they accept the invitation, Tailscale increases the device limit on both accounts by two. This applies to every unique domain that accepts a machine you shared. The rewards apply automatically when a user accepts an invitation, and the increased device limit shows on device limits on the [Billing](https://login.tailscale.com/admin/settings/billing) page of the admin console.\r\n\r\n### [Troubleshooting](https://tailscale.com/docs/features/sharing\\#troubleshooting)\r\n\r\nIf you can find a machine that was shared with you, but you can't connect to it:\r\n\r\n- If you're trying to access the machine by [machine name](https://tailscale.com/docs/concepts/machine-names) (and not [100.x.y.z](https://tailscale.com/docs/concepts/tailscale-ip-addresses) address), ensure you have [MagicDNS enabled](https://tailscale.com/docs/features/magicdns). You can enable MagicDNS from the [DNS](https://login.tailscale.com/admin/dns) page of the admin console.\r\n- Review your tailnet's [access control policies](https://tailscale.com/docs/features/access-control) to check if you have any rules that might disallow access. If you don't, it's possible the tailnet that shared it with you is restricting the traffic. Ask them to review their access control policies too.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Share your machines with other users

\n

Last validated: Jan 5, 2026

\n

Sharingis currently in beta. To try it, follow the steps below to enable it for your network using Tailscale v1.4 or later.

\n

Sharingis available for all plans.

\n

You can share access to specific machines with people outside your Tailscale network (known as a tailnet) without exposing them to the public internet. Sharing gives the recipient access to only the shared machine in your tailnet, and nothing else.

\n

Users in your tailnet can access all machines as governed by access control policies; sharing a machine is only required for allowing external users to access a machine.

\n

Sharing respects the access control policies and MagicDNS settings of both your tailnet and the recipient's tailnet. Sharing strips tags, groups, and subnet information from the recipient tailnet. A shared machine is visible only to the individual recipient user—it is not visible to the recipient user's entire tailnet.

\n

Share a machine with another user

\n

You need to be an Owner, Admin, or IT admin of a tailnet to share a machine.

\n

To share a machine:

\n
    \n
  1. Open the Machines page of the admin console and find the machine you'd like to share.
    2. \n
  2. Send invites by email or manually by using links.
    3. \n
  3. Wait for the recipient to accept.
    4. \n
\n

After the recipient accepts the invite, they can access the shared machine from their Tailscale clients and admin console, as if it was on their own tailnet. For example, the macOS app will display it in the menu bar, and Linux apps will find it from tailscale status.

\n

Notes about shared machines:

\n
    \n
  • Tailscale quarantines shared machines by default. A shared machine can receive incoming connections (from the other user's tailnet) but cannot start connections. This means users can accept shares without exposing their tailnet to risks.
    • \n
  • As of Tailscale v1.4, shared machines appear in the other tailnet as the sharer, not the owner of the machine. If Ross shares his co-worker Dave's machine to another tailnet, it will appear to be owned by Ross in the new tailnet.
    • \n
  • Unused invite links expire after 30 days.
    • \n
\n

A machine cannot be shared with a tag or accessed by tagged machines on another tailnet, as only users can accept machine shares.

\n

Share using email

\n

When you send invites by email, each specified recipient receives a single-use invite link to your machine. The recipient does not need to have a Tailscale account with the same email address. They can log in and accept the share from any Tailscale account.

\n
    \n
  1. Select the \"ellipsis menu, then select Share to open the Share dialog.
    2. \n
  2. Select the Share by email tab.
    3. \n
  3. Add the email address for each user that you want to send invite links.
    4. \n
  4. Select Share to send email invitations to each listed email address.
    5. \n
\n

Share using a link

\n

For invite links you plan to share manually, you can choose to make a single-use or reusable invite link. A single-use invite link is a one-time use link. A reusable invite link can be used up to 1,000 times. Unused links expire in 30 days for both single-use and reusable invite links.

\n
    \n
  1. Select the \"ellipsis menu, then select Share to open the Share dialog.
    2. \n
  2. Select Copy invite link tab.
    3. \n
  3. (Optional): Toggle on Reusable link for a link that can be accepted more than once.
    4. \n
  4. Select Copy share link to create the link and copy it to your clipboard.
    5. \n
  5. Share the copied invite link to your intended recipient. Treat the invite link the way you would a password. It provides the ability to connect to a machine within your tailnet.
    6. \n
\n

Wait for the recipient to accept

\n

A recipient needs to be an Owner, Admin, or IT admin of a tailnet to accept a shared machine invitation.

\n

The recipient can visit the invite link to review your invitation. After they accept, you can find their profile picture and email address in the Share dialog. You'll also find an indicator in the Machines list on the admin console showing which machines have been shared to external users.

\n

Unused invite links expire after 30 days.

\n

Revoke an invite

\n

You need to be an Owner, Admin, or IT admin of a tailnet to revoke a share or share invite.

\n

You can revoke a share or share invite from the Machines page of the admin console. After you revoke an invite, the recipient user can no longer access the shared machine. To restore access, you must create a new invite and the recipient must accept that new invite.

\n

To revoke an invite:

\n
    \n
  1. Go to the Machines page of the admin console.
    2. \n
  2. Select the Share option for the machine.
    3. \n
  3. Select the \"ellipsis menu > Revoke invite.
    4. \n
\n

How sharing works

\n

Sharing a machine exposes that machine to a user on another tailnet. Only that user is able to access your machine. It is invisible to other users on that tailnet.

\n

\"In

\n

In this example, only the shared machine from tailnet A and the share recipient's machines in tailnet B can talk across tailnet boundaries.

\n

When you accept an invite, Tailscale exposes the minimum set of information possible about your tailnet to that machine. Accepting an invite exposes:

\n
    \n
  • The email and avatar of the recipient (required to help confirm invites)
    • \n
  • Physical machine IPs of machines from your tailnet (required for connections)
    • \n
\n

Quarantine

\n

Shared machines are quarantined by default. They can respond to incoming connections from the tailnet they're shared to, but cannot start connections on their own. Quarantining helps sharing be \"secure by default\", since you can accept shares with no risk of exposing your tailnet.

\n

Sharing and MagicDNS

\n

MagicDNS is a per-tailnet setting. If your tailnet has MagicDNS enabled, you can access machines over MagicDNS regardless of the other tailnet's settings.

\n

Shared machines support MagicDNS in Tailscale v1.4 or later. Shared machines can only be reached by using their fully qualified domain name, which looks like <hostname>.<tailnet-name>.ts.net.

\n
    \n
  • <hostname> is the name of a machine.
    • \n
  • <tailnet-name> is the tailnet name of a tailnet.
    • \n
\n

For example, if your friend shares a machine named minecraft-server on the yak-bebop tailnet to your tailnet, you can reach it at minecraft-server.yak-bebop.ts.net. However, you can't reach it at minecraft-server from your tailnet.

\n

Previously, you might have used a tailnet DNS name ending in .beta.tailscale.net. If so, migrate to the new tailnet DNS name that ends in .ts.net. Support for the beta.tailscale.net name ended on September 13, 2024.

\n

These restrictions are necessary to prevent MagicDNS names from changing unexpectedly, and to support future features on top of sharing.

\n

Sharing and access control policies

\n

When a user accepts a share, the user can make outbound requests to the shared machine, which will adhere to any access control policies defined in the tailnet that owns the shared machine.

\n

By default, the shared machine is quarantined and cannot make outbound requests to the user's machines. However, it's possible to \"mutually share\" machines, allowing the machines to make outbound connections to each other.

\n

For example, if you have workstation-1 (owned by example-company-tailnet) and workstation-2 (owned by sam@example.com) and you want workstation-1 and workstation-2 to have access to each other, you would:

\n
    \n
  1. Share workstation-1 with alice@example.com.
    2. \n
  2. Share workstation-2 with alice@example-company.com.
    3. \n
\n

If you're having trouble connecting to a shared machine, review your tailnet policy file for rules that might be blocking access.

\n

To write access rules that apply to a shared machine, you can use the email address of the recipient. For example, if you invite alice@example.com to share a machine at 100.74.78.2, you can give Alice access to a particular host.

\n
\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"group:admins\"],\\\r\n    \"dst\": [\"*\"],\\\r\n    \"ip\": [\"*\"]\\\r\n  },\\\r\n  {\\\r\n    \"src\": [\"alice@example.com\"],\\\r\n    \"dst\": [\"100.74.78.2\"],\\\r\n    \"ip\": [\"*\"]\\\r\n  }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Be careful of rules like \"src\": [\"*\"], which apply to everyone who has access to your tailnet, including invited users. Consider making a group that includes all your tailnet users instead of *.

\n

You can also write access rules by using the special autogroup:shared group. This group automatically includes all users invited to your tailnet, and lets you write rules without knowing email addresses in advance.

\n

For example, to restrict invited users to only access web server ports 80 and 443, you can write a rule like:

\n
\"grants\": [\\\r\n  // Admins can access everything in the tailnet.\\\r\n  {\\\r\n    \"src\": [\"group:admins\"],\\\r\n    \"dst\": [\"*\"],\\\r\n    \"ip\": [\"*\"]\\\r\n  },\\\r\n  // Shared users can only access port 80 and 443 of machines they are invited to.\\\r\n  {\\\r\n    \"src\": [\"autogroup:shared\"],\\\r\n    \"dst\": [\"*\"],\\\r\n    \"ip\": [\"80\", \"443\"]\\\r\n  }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Remember: invited users are only able to access machines you've invited them to share. Access rules further limit what they can access. Although the rule *:80,443 seems like it lets users access all machines, it only further restricts their access to the ports we've specified.

\n

Sharing does not expose tag to the other tailnet. All tag information is stripped and cannot be used in the tailnet policy file of the other tailnet.

\n

Sharing and Subnets (subnet routers)

\n

Shared machines do not advertise subnets to the tailnets they're shared into, while inviting external users into your tailnet will give them access to subnet routers.

\n

Sharing and Exit Nodes

\n

Sharing an exit node exposes it to the other tailnet.

\n

To share an exit node, use the following sequence:

\n
    \n
  1. \n

    Advertise the machine as an exit node.

    \n
    2. \n
  2. \n

    If you are not using autoApprovers, allow the exit node from the admin console.

    \n
    3. \n
  3. \n

    Share the machine per the instructions above, allowing the recipient to use it as an exit node. Ensure the Allow use as an exit node option is checked.

    \n
    4. \n
\n

If a user is deleted, the shared machines they manage will be deleted. If a user is suspended, the shared machines they manage will not be able to connect to other machines.

\n

Sharing and suspended or deleted users

\n

When you delete a user, it also deletes the shared machines they manage. If you suspend a user, Tailscale prevents the shared machines they manage from connecting to other machines.

\n

Sharing and Tailnet Lock

\n

A node shared into a tailnet with Tailnet Lock requires a signature before it is accessible.

\n

To share nodes out of a tailnet with Tailnet Lock, the user who accepts the share invite needs to have their nodes signed in the locked tailnet before they can access the shared node.

\n

Sharing and rewards

\n

Every time you share a machine with a unique user, and they accept the invitation, Tailscale increases the device limit on both accounts by two. This applies to every unique domain that accepts a machine you shared. The rewards apply automatically when a user accepts an invitation, and the increased device limit shows on device limits on the Billing page of the admin console.

\n

Troubleshooting

\n

If you can find a machine that was shared with you, but you can't connect to it:

\n
    \n
  • If you're trying to access the machine by machine name (and not 100.x.y.z address), ensure you have MagicDNS enabled. You can enable MagicDNS from the DNS page of the admin console.
    • \n
  • Review your tailnet's access control policies to check if you have any rules that might disallow access. If you don't, it's possible the tailnet that shared it with you is restricting the traffic. Ask them to review their access control policies too.
    • \n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}