{"slug":"tailscale-cli","title":"Tailscale CLI","tags":["tailscale"],"agent_summary":"Last validated: Jan 26, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale CLI\r\n\r\nLast validated: Jan 26, 2026\r\n\r\nThe Tailscale client includes a built-in command-line interface (CLI) you can use to manage and troubleshoot your device within your Tailscale network (known as a tailnet).\r\n\r\nThe Tailscale CLIis available for [all plans](https://tailscale.com/pricing).\r\n\r\n## [Using the Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli\\#using-the-tailscale-cli)\r\n\r\nThe location of the CLI varies depending on your platform:\r\n\r\n[Linux](https://tailscale.com/docs/reference/tailscale-cli?tab=linux) [macOS](https://tailscale.com/docs/reference/tailscale-cli?tab=macos) [Windows](https://tailscale.com/docs/reference/tailscale-cli?tab=windows)\r\n\r\nOn Linux, the CLI is your primary interface to Tailscale. The `tailscale` binary is likely already in your `$PATH`, so you can run commands with:\r\n\r\n```shell\r\ntailscale \r\n```\r\n\r\nThere is no CLI support for iOS and Android.\r\n\r\n### [Tab completion](https://tailscale.com/docs/reference/tailscale-cli\\#tab-completion)\r\n\r\nThe Tailscale CLI supports tab-completion for commands, flags, and arguments. You can configure tab-completion with the [`completion` command](https://tailscale.com/docs/reference/tailscale-cli#completion).\r\n\r\n```shell\r\ntailscale completion [--flags] [--descs]\r\n```\r\n\r\nSelect your shell, then follow the instructions to load Tailscale CLI completions.\r\n\r\n[Bash](https://tailscale.com/docs/reference/tailscale-cli?tab=bash) [Zsh](https://tailscale.com/docs/reference/tailscale-cli?tab=zsh) [Fish](https://tailscale.com/docs/reference/tailscale-cli?tab=fish) [PowerShell](https://tailscale.com/docs/reference/tailscale-cli?tab=powershell)\r\n\r\nTo load tab-completions for Bash, run the following command.\r\n\r\n```shell\r\nsource <(tailscale completion bash)\r\n```\r\n\r\nRun the following command to load completions for every new session on Linux, then reload your shell.\r\n\r\n```shell\r\ntailscale completion bash > /etc/bash_completion.d/tailscale\r\n```\r\n\r\nRun the following command to load completions for every new session on macOS, then reload your shell.\r\n\r\n```shell\r\ntailscale completion bash > $(brew --prefix)/etc/bash_completion.d/tailscale\r\n```\r\n\r\n## [Command Reference](https://tailscale.com/docs/reference/tailscale-cli\\#command-reference)\r\n\r\nCommon flags for all commands:\r\n\r\n- `--socket=` Path to the tailscaled socket.\r\n\r\n### [up](https://tailscale.com/docs/reference/tailscale-cli\\#up)\r\n\r\nConnect your device to Tailscale and authenticate if needed.\r\n\r\n```shell\r\ntailscale up [flags]\r\n```\r\n\r\nRunning `tailscale up` without any flags connects to Tailscale.\r\n\r\nCommon flags:\r\n\r\n- `--accept-routes` Accept [subnet routes](https://tailscale.com/docs/features/subnet-routers) that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.\r\n- `--advertise-exit-node` Offer to be an [exit node](https://tailscale.com/docs/features/exit-nodes) for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.\r\n- `--advertise-routes=` Expose physical [subnet routes](https://tailscale.com/docs/features/subnet-routers) to your entire Tailscale network.\r\n- `--exit-node=` Provide a [Tailscale IP](https://tailscale.com/docs/concepts/ip-and-dns-addresses) or [machine name](https://tailscale.com/docs/concepts/machine-names) to use as an exit node. To disable the use of an exit node, pass the flag with an empty argument: `--exit-node=`.\r\n- `--exit-node-allow-lan-access` Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.\r\n- `--force-reauth` Force re-authentication.\r\n- `--snat-subnet-routes` (Linux only) Disable source NAT. In normal operations, a subnet device sees the traffic originating from the subnet router. This simplifies routing, but does not allow traversing multiple networks. By disabling source NAT, the end machine sees the LAN IP address of the originating machine as the source.\r\n- `--stateful-filtering` Enable stateful filtering for [subnet routers](https://tailscale.com/docs/features/subnet-routers) and [exit nodes](https://tailscale.com/docs/features/exit-nodes). When enabled, inbound packets with another node's destination IP are dropped, unless they are a part of a tracked outbound connection from that node. Defaults to disabled.\r\n- `--shields-up` [Block incoming connections](https://tailscale.com/docs/features/client/manage-preferences) from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections.\r\n- `--ssh` Run a [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) server, permitting access per the tailnet administrator's declared [access policy](https://tailscale.com/docs/features/access-control/acls), or the [default policy](https://tailscale.com/docs/reference/examples/acls#allow-all-default-acl) if none is defined. Defaults to false.\r\n\r\nFor a complete list of available flags, refer to the [`tailscale up`](https://tailscale.com/docs/reference/tailscale-cli/up) topic.\r\n\r\n### [down](https://tailscale.com/docs/reference/tailscale-cli\\#down)\r\n\r\nDisconnect from Tailscale. Running this command is the same as choosing to disconnect from or quit a Tailscale client.\r\n\r\n```shell\r\ntailscale down\r\n```\r\n\r\nWhen disconnected, you cannot reach devices over Tailscale. To reconnect, re-run `tailscale up` without any flags.\r\n\r\nAvailable flags:\r\n\r\n- `--accept-risk=` Accept risk and skip confirmation for risk type. This can be either `lose-ssh` or `all`, or an empty string to not accept risk.\r\n- `--reason=\"\"` Specify the reason (inside quotes) for disconnecting Tailscale when the [system policies](https://tailscale.com/docs/features/tailscale-system-policies)`AlwaysOn.Enabled` and `AlwaysOn.OverrideWithReason` are enabled. For example, `tailscale down --reason=\"DNS issues\"`.\r\n\r\n### [bugreport](https://tailscale.com/docs/reference/tailscale-cli\\#bugreport)\r\n\r\nThe `bugreport` command is available in Tailscale v1.8 or later. If you don't see this command, consider [updating](https://tailscale.com/docs/features/client/update) your Tailscale client.\r\n\r\nGenerate a bug report with diagnostic information.\r\n\r\nThe `bugreport` command makes it easier to report bugs to the Tailscale team by marking diagnostic logs with indicators to make triage easier.\r\n\r\nIf you encounter a connectivity issue, run `tailscale bugreport` on the device experiencing the issue at the time you encounter it.\r\n\r\n```shell\r\ntailscale bugreport\r\n```\r\n\r\nThis command prints a random identifier into diagnostic logs, which you can share with our team.\r\n\r\nIdentifiers look like this:\r\n\r\n```shell\r\nBUG-1b7641a16971a9cd75822c0ed8043fee70ae88cf05c52981dc220eb96a5c49a8-20210427151443Z-fbcd4fd3a4b7ad94\r\n```\r\n\r\nThis command shares no personally identifiable information and is unused unless you share the bug identifier with our team.\r\n\r\nAvailable flags:\r\n\r\n- `--diagnose` Prints additional verbose information about the system to the Tailscale logs after generating a `bugreport` identifier, which can then be viewed by our support team. Defaults to `false`.\r\n- `--record` Pause and then write another `bugreport`. Use this flag to create an initial `bugreport` identifier. During the pause, perform the action that reproduces your issue. Then, press Enter to create a second `bugreport` identifier. Share both bug identifiers with our team. Defaults to `false`.\r\n\r\n### [cert](https://tailscale.com/docs/reference/tailscale-cli\\#cert)\r\n\r\nGenerate Let's Encrypt certificate and key files on the host for [HTTPS certificates](https://tailscale.com/docs/how-to/set-up-https-certificates) in your tailnet.\r\n\r\nIf you are trying to serve a folder of files or reverse proxy to an HTTP service, use the [`tailscale serve`](https://tailscale.com/docs/reference/tailscale-cli#serve) command instead.\r\n\r\n```shell\r\ntailscale cert hostname.tails-scales.ts.net\r\n```\r\n\r\nAlternatively, if you want to save the certificate and private key to files, you can use the `--cert-file` and `--key-file` arguments:\r\n\r\n```shell\r\ntailscale cert --cert-file=cert.pem --key-file=key.pem hostname.tails-scales.ts.net\r\n```\r\n\r\nThe certificates provided by Let's Encrypt have a 90-day expiry and require periodic renewal. When a certificate is delivered as files on disk which you then move to an install location, such as when using `tailscale cert`, the [`tailscaled` daemon](https://tailscale.com/docs/reference/tailscaled) doesn't know where to place a renewed certificate or how to install it. As a result, you are responsible for renewing any certificates that you create using `tailscale cert`.\r\n\r\nIf a certificate is handled without the user initiating any file-based certificate installation (such as when using the [Caddy integration of Tailscale](https://github.com/tailscale/caddy-tailscale)) then the certificate will automatically renew without the user doing anything.\r\n\r\nAvailable flags:\r\n\r\n- `--cert-file=` Specify the certificate output path.\r\n- `--key-file=` Specify the private key output path.\r\n- `--min-validity=` Request a specified minimum remaining validity on the returned certificate. `duration` can be any value parseable by [`time.ParseDuration()`](https://pkg.go.dev/time#ParseDuration). For example, use `120h` to set the duration to five days.\r\n- `--serve-demo` Serve on port `:443` using the cert as a demo, instead of writing out the files to disk.\r\n\r\nThe `--min-validity` flag lets you ensure that the returned certificate is valid for at least the specified duration. If you specify a duration longer than the [certification lifetime set by Let's Encrypt](https://letsencrypt.org/docs/faq#what-is-the-lifetime-for-let-s-encrypt-certificates-for-how-long-are-they-valid), it uses the maximum lifetime set by Let's Encrypt.\r\n\r\n### [dns](https://tailscale.com/docs/reference/tailscale-cli\\#dns)\r\n\r\nThe `dns` command lets you access [Tailscale DNS settings](https://tailscale.com/docs/reference/dns-in-tailscale). It's available in Tailscale v1.74.0 and later.\r\n\r\nSubcommands:\r\n\r\n- `status` Print the configuration of the local DNS forwarder and the tailnet-wide [MagicDNS](https://tailscale.com/docs/features/magicdns) configuration.\r\n- `query` Perform a DNS query using the local DNS forwarder. It's available in Tailscale v1.76.0 and later.\r\n\r\nAvailable flags for `status`:\r\n\r\n- `--all` Outputs advanced debugging information.\r\n\r\nAvailable flags for `status` and `query`:\r\n\r\n- `--json` Output in JSON format.\r\n\r\n### [drive](https://tailscale.com/docs/reference/tailscale-cli\\#drive)\r\n\r\nShare a directory with your tailnet using [Taildrive](https://tailscale.com/docs/features/taildrive).\r\n\r\n```shell\r\ntailscale drive share \r\ntailscale drive rename \r\ntailscale drive unshare \r\ntailscale drive list\r\n```\r\n\r\nSubcommands:\r\n\r\n- `share` Create or modify a share.\r\n- `rename` Rename a share.\r\n- `unshare` Remove a share.\r\n- `list` List current shares.\r\n\r\n### [completion](https://tailscale.com/docs/reference/tailscale-cli\\#completion)\r\n\r\nConfigure tab-completion for the Tailscale CLI.\r\n\r\n```shell\r\ntailscale completion [flags]\r\n```\r\n\r\nSubcommands:\r\n\r\n- `bash` Configure tab-completion for the `bash` shell.\r\n- `zsh` Configure tab-completion for the `zsh` shell.\r\n- `fish` Configure tab-completion for the `fish` shell.\r\n- `powershell` Configure tab-completion for PowerShell.\r\n\r\nAvailable flags:\r\n\r\n- `--flags=` Configure whether to suggest flags (in addition to subcommands). Set to `true` by default.\r\n- `--descs=` Configure whether to include descriptions of subcommands in the suggestions. Set to `true` by default.\r\n\r\n### [configure](https://tailscale.com/docs/reference/tailscale-cli\\#configure)\r\n\r\nConfigure resources that you want to include in your tailnet.\r\n\r\n```shell\r\ntailscale configure \r\n```\r\n\r\nSubcommands:\r\n\r\n- `kubeconfig` (alpha) Configure `kubectl` to connect to a Kubernetes cluster using Tailscale.\r\n- `mac-vpn` Install or uninstall the VPN configuration on [App Store](https://tailscale.com/docs/concepts/macos-variants#mac-app-store-variant) and [Standalone variant](https://tailscale.com/docs/concepts/macos-variants#standalone-variant) of macOS.\r\n- `synology` Configure Synology to enable outbound connections needed for Tailscale.\r\n- `sysext` Activate, deactivate, or manage the state of the Tailscale [system extension](https://tailscale.com/docs/concepts/macos-sysext) on the [Standalone variant](https://tailscale.com/docs/concepts/macos-variants#standalone-variant) of macOS.\r\n- `systray` Manage the `systray` client for Linux.\r\n\r\nAvailable flags for `kubeconfig`:\r\n\r\n- `--http` Use HTTP instead of HTTPS to connect to the auth proxy. Ignored if you include a scheme in the hostname argument.\r\n\r\nAvailable subcommands for `mac-vpn`:\r\n\r\n- `install` Write the Tailscale VPN configuration to the macOS settings.\r\n- `uninstall` Delete the Tailscale VPN configuration from the macOS settings.\r\n\r\nAvailable subcommands for `sysext`:\r\n\r\n- `activate` Register the Tailscale system extension with macOS.\r\n- `deactivate` Deactivate the Tailscale system extension on macOS.\r\n- `status` Print the enablement status of the Tailscale system extension.\r\n\r\nAvailable flags for `systray`:\r\n\r\n- `--enable-startup=` Install the startup script for the init system. The only currently supported value is `systemd`.\r\n\r\nExamples:\r\n\r\n- To configure your local `kubeconfig` file for authentication with a Kubernetes auth proxy:\r\n\r\n```shell\r\ntailscale configure kubeconfig \r\n```\r\n\r\n- To configure Synology to enable outbound connections:\r\n\r\n```shell\r\ntailscale configure synology\r\n```\r\n\r\n### [exit-node](https://tailscale.com/docs/reference/tailscale-cli\\#exit-node)\r\n\r\nGet information about [exit-nodes](https://tailscale.com/docs/features/exit-nodes) in your tailnet.\r\n\r\n```shell\r\ntailscale exit-node \r\n```\r\n\r\nAvailable subcommands:\r\n\r\n- `list` Lists the exit nodes in your tailnet.\r\n- `suggest` Suggests a [recommended exit node](https://tailscale.com/docs/features/exit-nodes/auto-exit-nodes).\r\n\r\nAvailable flags for `list`:\r\n\r\n- `--filter=` Filter exit nodes by country.\r\n\r\n### [file](https://tailscale.com/docs/reference/tailscale-cli\\#file)\r\n\r\nAccess and make files available to [Taildrop](https://tailscale.com/docs/features/taildrop).\r\n\r\n```shell\r\ntailscale file cp :\r\ntailscale file get \r\n```\r\n\r\nAvailable commands:\r\n\r\n- `cp` Copy files to a host.\r\n- `get` Move files out of the Tailscale file inbox.\r\n\r\nAvailable flags for `cp`:\r\n\r\n- `--name=` Alternate filename to use, especially useful when `` is `-` (`stdin`).\r\n- `--targets` List possible file `cp` targets.\r\n- `--verbose` Verbose output.\r\n\r\nAvailable flags for `get`:\r\n\r\n- `--conflict=``behavior`when a conflicting (same-named) file already exists in the target directory.\r\n - `skip` Skip conflicting files: leave them in the Taildrop inbox and print an error. Get any non-conflicting files.\r\n - `overwrite` Overwrite existing file.\r\n - `rename` Write to a new number-suffixed filename.\r\n- `--loop` Run get in a loop, receiving files as they come in.\r\n- `--verbose` Verbose output.\r\n- `--wait` Wait for a file to arrive if inbox is empty.\r\n\r\n### [funnel](https://tailscale.com/docs/reference/tailscale-cli\\#funnel)\r\n\r\nServe content and local servers from your Tailscale node to the internet.\r\n\r\nTo limit local service access to your tailnet, use the [`serve`](https://tailscale.com/docs/reference/tailscale-cli#serve) command.\r\n\r\n```shell\r\ntailscale funnel \r\ntailscale funnel [flags] \r\n```\r\n\r\nSubcommands:\r\n\r\n- [`status`](https://tailscale.com/docs/reference/tailscale-cli/funnel#get-the-status) Gets the status.\r\n- [`reset`](https://tailscale.com/docs/reference/tailscale-cli/funnel#reset-tailscale-funnel) Resets the configuration.\r\n\r\nFor more information, refer to the [`tailscale funnel`](https://tailscale.com/docs/reference/tailscale-cli/funnel) topic.\r\n\r\n### [ip](https://tailscale.com/docs/reference/tailscale-cli\\#ip)\r\n\r\nGet a device's Tailscale IP address.\r\n\r\n```shell\r\ntailscale ip [flags] []\r\n```\r\n\r\nBy default, this command returns both an [`100.x.y.z` IPv4 address](https://tailscale.com/docs/concepts/ip-and-dns-addresses) and an IPv6 address for the current device. You can return only an IPv4 or IPv6 address by passing either the `-4` or `-6` flags.\r\n\r\n```shell\r\ntailscale ip -4\r\n```\r\n\r\nFor example, this command will return information similar to the following:\r\n\r\n```shell\r\n100.121.112.23\r\n```\r\n\r\nYou can also find the Tailscale IP for other devices on your network by adding the device hostname after the command. For example:\r\n\r\n```shell\r\ntailscale ip raspberrypi\r\n```\r\n\r\nThis command will return information similar to the following:\r\n\r\n```shell\r\n100.126.153.111\r\nfd7a:115c:a1e0:ab12:4843:cd96:627e:9975\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--4` Only return an IPv4 address.\r\n- `--6` Only return an IPv6 address.\r\n- `--1` Only return one address, preferring IPv4.\r\n- `--assert=` Assert that the node's IP (or one of the node's IPs) matches this IP address.\r\n\r\n### [licenses](https://tailscale.com/docs/reference/tailscale-cli\\#licenses)\r\n\r\nGet open source license information.\r\n\r\n```shell\r\ntailscale licenses\r\n```\r\n\r\n### [lock](https://tailscale.com/docs/reference/tailscale-cli\\#lock)\r\n\r\nManage [Tailnet Lock](https://tailscale.com/docs/features/tailnet-lock) for your tailnet.\r\n\r\n```shell\r\ntailscale lock [flags] \r\n```\r\n\r\nCommon subcommands:\r\n\r\n- [`init`](https://tailscale.com/docs/reference/tailscale-cli/lock#lock-init) Initializes Tailnet Lock.\r\n- [`status`](https://tailscale.com/docs/reference/tailscale-cli/lock#lock-status) Outputs the state of Tailnet Lock.\r\n- [`add`](https://tailscale.com/docs/reference/tailscale-cli/lock#lock-add) Adds one or more trusted signing keys to Tailnet Lock.\r\n- [`remove`](https://tailscale.com/docs/reference/tailscale-cli/lock#lock-remove) Removes one or more trusted signing keys from Tailnet Lock.\r\n- [`sign`](https://tailscale.com/docs/reference/tailscale-cli/lock#lock-sign) Signs a node key and transmits the signature to the coordination server.\r\n\r\nRunning `tailscale lock` with no subcommand and no arguments is equivalent to running [`tailscale lock status`](https://tailscale.com/docs/reference/tailscale-cli/lock#lock-status).\r\n\r\nFor a complete list of subcommands and flags, refer to the [`tailscale lock`](https://tailscale.com/docs/reference/tailscale-cli/lock) topic.\r\n\r\n### [login](https://tailscale.com/docs/reference/tailscale-cli\\#login)\r\n\r\nLog into Tailscale (and add this device to your Tailscale network). For more information about logging in, refer to [fast-user-switching](https://tailscale.com/docs/features/client/fast-user-switching).\r\n\r\n```shell\r\ntailscale login [flags]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--accept-dns` Accept [DNS configuration](https://tailscale.com/docs/reference/dns-in-tailscale) from the admin console. Defaults to accepting DNS settings.\r\n- `--accept-routes` Accept [subnet routes](https://tailscale.com/docs/features/subnet-routers) that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.\r\n- `--advertise-connector` Offer to be an [app connector](https://tailscale.com/docs/features/app-connectors) for domain-specific internet traffic for the tailnet.\r\n- `--advertise-exit-node` Offer to be an [exit node](https://tailscale.com/docs/features/exit-nodes) for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.\r\n- `--advertise-routes=` Expose physical [subnet routes](https://tailscale.com/docs/features/subnet-routers) to your entire Tailscale network.\r\n- `--advertise-tags=` Give tagged permissions to this device. You must be [listed in `\"TagOwners\"`](https://tailscale.com/docs/reference/syntax/policy-file#tag-owners) to be able to apply tags.\r\n- `--auth-key=` Provide an [auth key](https://tailscale.com/docs/features/access-control/auth-keys) to automatically authenticate the node as your user account. For a best practice when handling the `--auth-key` value, refer to [Securely handle an auth key](https://tailscale.com/docs/features/access-control/auth-keys/how-to/secure-auth-keys).\r\n- `--client-id` Client ID used to generate [auth keys](https://tailscale.com/docs/features/access-control/auth-keys) by using\r\n[workload identity federation](https://tailscale.com/docs/features/workload-identity-federation).\r\n- `--client-secret` [OAuth Client](https://tailscale.com/docs/features/oauth-clients) secret used to generate\r\n[auth keys](https://tailscale.com/docs/features/access-control/auth-keys); if it begins with `file:`, then it's a path to a\r\nfile containing the secret.\r\n- `--exit-node=` Provide a [Tailscale IP](https://tailscale.com/docs/concepts/ip-and-dns-addresses) or [machine name](https://tailscale.com/docs/concepts/machine-names) to use as an exit node. To disable the use of an exit node, pass the flag with an empty argument: `--exit-node=`.\r\n- `--exit-node-allow-lan-access` Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.\r\n- `--hostname=` Provide a hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in [MagicDNS](https://tailscale.com/docs/features/magicdns).\r\n- `--id-token` ID token from the identity provider to exchange with the control\r\nserver for [workload identity federation](https://tailscale.com/docs/features/workload-identity-federation); if it begins\r\nwith `file:`, then it's a path to a file containing the token.\r\n- `--audience` Audience used when requesting an ID token from an identity provider for auth keys generated by [workload identity federation](https://tailscale.com/docs/features/workload-identity-federation).\r\n- `--login-server=` Provide the base URL of a control server instead of `https://controlplane.tailscale.com`. If you are using [Headscale](https://tailscale.com/blog/opensource#the-open-source-coordination-server) for your control server, use your Headscale instance's URL.\r\n- `--netfilter-mode=` Netfilter mode (one of `on`, `nodivert`, `off`). Refer to [Tailscale netfilter modes](https://tailscale.com/docs/reference/netfilter-modes) for more information.\r\n- `--nickname=` [Nickname](https://tailscale.com/docs/features/client/fast-user-switching#setting-a-nickname) for the current account.\r\n- `--operator=` Provide a Unix username other than `root` to operate `tailscaled`.\r\n- `--qr` Generate a QR code for the web login URL. Defaults to not showing a QR code.\r\n- `--qr-format=` QR code formatting: `small` or `large`. Defaults to `small`.\r\n- `--stateful-filtering` Enable stateful filtering for [subnet routers](https://tailscale.com/docs/features/subnet-routers) and [exit nodes](https://tailscale.com/docs/features/exit-nodes). When enabled, inbound packets with another node's destination IP are dropped, unless they are a part of a tracked outbound connection from that node. Defaults to disabled.\r\n- `--shields-up` [Block incoming connections](https://tailscale.com/docs/features/client/manage-preferences) from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections.\r\n- `--snat-subnet-routes` Source NAT traffic to local routes advertised with `--advertise-routes`.\r\n- `--ssh` Run a [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) server, permitting access per the tailnet administrator's declared [access policy](https://tailscale.com/docs/features/access-control/acls), or the [default policy](https://tailscale.com/docs/reference/examples/acls#allow-all-default-acl) if none is defined. Defaults to false.\r\n- `--timeout=` Maximum amount of time to wait for the Tailscale service to initialize. `duration` can be any value parseable by [`time.ParseDuration()`](https://pkg.go.dev/time#ParseDuration). Defaults to `0s`, which blocks forever.\r\n- `--unattended`(Windows only) Run in [unattended mode](https://tailscale.com/docs/how-to/run-unattended) where Tailscale keeps running even after the current user logs out.\r\n\r\n### [logout](https://tailscale.com/docs/reference/tailscale-cli\\#logout)\r\n\r\nDisconnect from Tailscale and expire the current log in. The next time you run `tailscale up`, you'll need to reauthenticate your device.\r\n\r\n```shell\r\ntailscale logout\r\n```\r\n\r\nIf you run `tailscale logout` on an [ephemeral node](https://tailscale.com/docs/features/ephemeral-nodes), the node will be removed from your tailnet immediately.\r\n\r\nAvailable flags:\r\n\r\n- `--reason` Reason for the logout, if required by a [system policy](https://tailscale.com/docs/features/tailscale-system-policies).\r\n\r\n### [metrics](https://tailscale.com/docs/reference/tailscale-cli\\#metrics)\r\n\r\nExpose and collect [Tailscale client metrics](https://tailscale.com/docs/reference/tailscale-client-metrics) for use with third-party monitoring systems.\r\n\r\n```shell\r\ntailscale metrics\r\n```\r\n\r\nSubcommands:\r\n\r\n- `print` Shows client metrics in the current terminal session.\r\n- `write` Writes metric values to a text file.\r\n\r\n### [netcheck](https://tailscale.com/docs/reference/tailscale-cli\\#netcheck)\r\n\r\nGet a report on your current physical network conditions. This command is provided to help debug connection troubles.\r\n\r\n```shell\r\ntailscale netcheck\r\n```\r\n\r\n`netcheck` will output a report like this:\r\n\r\n```shell\r\nReport:\r\n\t* Time: 2025-03-13T16:35:03.336481Z\r\n\t* UDP: true\r\n\t* IPv4: yes, \r\n\t* IPv6: yes, \r\n\t* MappingVariesByDestIP: false\r\n\t* PortMapping:\r\n\t* Nearest DERP: Seattle\r\n\t* DERP latency:\r\n\t\t- sea: 24.2ms (Seattle)\r\n\t\t- sfo: 50.5ms (San Francisco)\r\n\t\t- lax: 57.2ms (Los Angeles)\r\n\t\t- den: 58.5ms (Denver)\r\n\t\t- dfw: 63ms (Dallas)\r\n\t\t- ord: 73.3ms (Chicago)\r\n```\r\n\r\n(In the example output, the list of [DERP servers](https://tailscale.com/docs/reference/derp-servers) is truncated for brevity.)\r\n\r\n- `UDP` shows whether UDP traffic is enabled on the current network. If this is false, it's unlikely Tailscale will be able to make point-to-point connections, and will instead rely on our [encrypted TCP relays (DERP)](https://tailscale.com/docs/reference/derp-servers)\r\n- `IPv4` and **IPv6** show your network public IP addresses and support for both protocols.\r\n- `MappingVariesByDestIP` describes whether your device is behind a difficult NAT that varies the device's IP address depending on the destination.\r\n- `HairPinning` describes whether your router can route connections from endpoints on your LAN back to your LAN using those endpoints' globally-mapped IPv4 addresses/ports.\r\n- `PortMapping` describes a list of which three port-mapping services exist on your router. Possible values are \"UPnP\", \"NAT-PMP\", and \"PCP\".\r\n- `DERP latency` and `Nearest DERP` describe latency from our [encrypted TCP relays (DERP)](https://tailscale.com/docs/reference/derp-servers). The lowest latency (\"nearest\") server is used for traffic.\r\n\r\nIf any fields are blank, it means Tailscale wasn't able to measure that network property.\r\n\r\nAll the information from `tailscale netcheck` is also available in the [Machines](https://login.tailscale.com/admin/machines) page of the admin console, by selecting a particular machine.\r\n\r\nAvailable flags:\r\n\r\n- `--every=` If non-zero, do an incremental report with the given frequency.\r\n- `--format=` Output format; empty (for human-readable), `json` or `json-line`.\r\n- `--verbose` Verbose logs.\r\n- `--bind-address` Send and receive connectivity probes using this locally bound IP address.\r\n- `--bind-port` Send and receive connectivity probes using this UDP port.\r\n\r\n### [nc](https://tailscale.com/docs/reference/tailscale-cli\\#nc)\r\n\r\nConnect to a port on a host, connected to stdin/stdout.\r\n\r\n```shell\r\ntailscale nc \r\n```\r\n\r\n### [ping](https://tailscale.com/docs/reference/tailscale-cli\\#ping)\r\n\r\nAttempt to ping another device exclusively over Tailscale.\r\n\r\nThe regular `ping` command often works fine over Tailscale, but `tailscale ping` provides more details about the connection over Tailscale that can be helpful when troubleshooting connectivity.\r\n\r\n```shell\r\ntailscale ping \r\n```\r\n\r\nYou can call `tailscale ping` using either a [100.x.y.z address](https://tailscale.com/docs/concepts/ip-and-dns-addresses) or a [machine name](https://tailscale.com/docs/concepts/machine-names).\r\n\r\nAvailable flags:\r\n\r\n- `--c` Maximum number of pings to send. Defaults to 10.\r\n- `--icmp`, `--icmp=false` Perform an ICMP-level ping (through WireGuard, but not the local host OS stack). Defaults to false.\r\n- `--peerapi`, `--peerapi=false` Try hitting the peer's PeerAPI HTTP server. Defaults to false.\r\n- `--size=` Size of the ping message (default pings only). 0 for minimum size.\r\n- `--tsmp`, `--tsmp=false` Perform a TSMP-level ping (through WireGuard, but not either host's OS stack). Defaults to false.\r\n- `--timeout=` Maximum amount of time to wait before giving up on a ping. `duration` can be any value parseable by [`time.ParseDuration()`](https://pkg.go.dev/time#ParseDuration). Defaults to `5s`.\r\n- `--until-direct`, `--until-direct=false` Stop once a direct path is established. Defaults to true.\r\n- `--verbose`, `--verbose=false` Show verbose output. Defaults to false.\r\n\r\nThere are [four types of ping messages](https://tailscale.com/docs/reference/ping-types) supported by the `tailscale ping` command.\r\n\r\n### [serve](https://tailscale.com/docs/reference/tailscale-cli\\#serve)\r\n\r\nServe content and local servers from your Tailscale node to your tailnet.\r\n\r\nTo publicly share the local service to the internet, use the [`funnel`](https://tailscale.com/docs/reference/tailscale-cli#funnel) command.\r\n\r\n```shell\r\ntailscale serve \r\ntailscale serve [flags] \r\n```\r\n\r\nSubcommands:\r\n\r\n- [`status`](https://tailscale.com/docs/reference/tailscale-cli/serve#get-the-status) Gets the status.\r\n- [`reset`](https://tailscale.com/docs/reference/tailscale-cli/serve#reset-tailscale-serve) Resets the configuration.\r\n\r\nFor more information, refer to the [`tailscale serve`](https://tailscale.com/docs/reference/tailscale-cli/serve) topic.\r\n\r\n### [set](https://tailscale.com/docs/reference/tailscale-cli\\#set)\r\n\r\nChange specified preferences.\r\n\r\nUnlike [`tailscale up`](https://tailscale.com/docs/reference/tailscale-cli#up), this command does not require the complete set of desired settings. It only updates the settings you explicitly set. There are no default values. Note that when using [Fast User Switching](https://tailscale.com/docs/features/client/fast-user-switching), changes made are only for the currently connected tailnet.\r\n\r\n```shell\r\ntailscale set [flags]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--accept-dns` Accept [DNS configuration](https://tailscale.com/docs/reference/dns-in-tailscale) from the admin console.\r\n- `--accept-risk=` Accept risk and skip confirmation for risk type. This can be either `lose-ssh` or `all`, or an empty string to not accept risk.\r\n- `--accept-routes`, `--accept-routes=false` Accept [subnet routes](https://tailscale.com/docs/features/subnet-routers) that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.\r\n- `--advertise-connector` Offer to be an [app connector](https://tailscale.com/docs/features/app-connectors) for domain-specific internet traffic for the tailnet.\r\n- `--advertise-exit-node`, `--advertise-exit-node=false` Offer to be an exit node for internet traffic for the tailnet.\r\n- `--advertise-routes=` Expose physical [subnet routes](https://tailscale.com/docs/features/subnet-routers) to your entire Tailscale network. This is a comma-separated string, such as \"10.0.0.0/8,192.168.0.0/24\", or an empty string to not advertise routes.\r\n- `--auto-update`, `--auto-update=false` Enable or disable [auto-updates](https://tailscale.com/docs/features/client/update#auto-updates) for the client.\r\n- `--exit-node=` Provide a [Tailscale IP](https://tailscale.com/docs/concepts/ip-and-dns-addresses) or [machine name](https://tailscale.com/docs/concepts/machine-names) to use as an exit node. You can also use `--exit-node=auto:any` to track the suggested exit node and automatically switch to it when available exit nodes or network conditions change. To disable the use of an exit node, pass the flag with an empty argument using `--exit-node=`.\r\n- `--exit-node-allow-lan-access`, `--exit-node-allow-lan-access=false` Allow the client node access to its own LAN while connected to an exit node.\r\n- `--hostname=` Hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in [MagicDNS](https://tailscale.com/docs/features/magicdns).\r\n- `--netfilter-mode=` Netfilter mode (one of `on`, `nodivert`, `off`). Refer to [Tailscale netfilter modes](https://tailscale.com/docs/reference/netfilter-modes) for more information.\r\n- `--nickname=` [Nickname](https://tailscale.com/docs/features/client/fast-user-switching#setting-a-nickname) for the current account.\r\n- `--operator=` A Unix username other than `root` to operate `tailscaled`.\r\n- `--relay-server-port=` Specify a UDP port to accept peer relay connections on. UDP port number (`0` will pick a random unused port) for the relay server to bind to, on all interfaces, or empty string to disable relay server functionality. Refer to [Tailscale Peer Relays](https://tailscale.com/docs/features/peer-relay) for more information.\r\n- `--relay-server-static-endpoints` Use static endpoints for [Tailscale Peer Relays](https://tailscale.com/docs/features/peer-relay).\r\n- `--report-posture` Allow management plane to gather [device posture](https://tailscale.com/docs/features/device-posture) information.\r\n- `--shields-up`, `--shields-up=false` [Block incoming connections](https://tailscale.com/docs/features/client/manage-preferences) from other devices on your Tailscale network.\r\nUseful for personal devices that only make outgoing connections.\r\n- `--snat-subnet-routes` Source NAT traffic to local routes advertised with `--advertise-routes`.\r\n- `--ssh`, `--ssh=false` Run a [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) server, permitting access per the tailnet administrator's declared [access policy](https://tailscale.com/docs/features/access-control/acls), or the [default policy](https://tailscale.com/docs/reference/examples/acls#allow-all-default-acl) if none is defined.\r\n- `--stateful-filtering` Apply stateful filtering to forwarded packets (subnet routers, exit nodes, and so on).\r\n- `--update-check` Notify about available Tailscale updates.\r\n- `--webclient`, `--webclient=false` Expose the [web interface](https://tailscale.com/docs/features/client/device-web-interface) to your tailnet persistently in the background on port `:5252.`\r\n\r\n### [ssh](https://tailscale.com/docs/reference/tailscale-cli\\#ssh)\r\n\r\nEstablish a [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) session to a Tailscale machine.\r\n\r\nYou can often use the regular `ssh` command or another SSH client to make an SSH session to a Tailscale machine. However, when your local node is in [userspace-networking](https://tailscale.com/docs/reference/kernel-vs-userspace-routers#userspace-netstack-mode) mode and can't make a direct connection, use `tailscale ssh`. This sets up an SSH `ProxyCommand` to connect through the local `tailscaled` daemon. You can also use `tailscale ssh` when your local node is in [kernel](https://tailscale.com/docs/reference/kernel-vs-userspace-routers#kernel-mode) mode.\r\n\r\nThe `tailscale ssh` command automatically checks the destination server's SSH host key against the node's SSH host key as advertised by using the Tailscale coordination server.\r\n\r\n```shell\r\ntailscale ssh \r\n```\r\n\r\n`` is one of the following forms:\r\n\r\n- `host` The destination server. An interactive session will prompt you for the user name to use for the session.\r\n- `user@host` The user name for the session and the destination server.\r\n\r\nFor both forms, `host` can be the destination server's [MagicDNS](https://tailscale.com/docs/features/magicdns) name (even if `--accept-dns=false` was set on the local node) or the destination server's [Tailscale IP address](https://tailscale.com/docs/concepts/ip-and-dns-addresses).\r\n\r\n`tailscale ssh` is not available on sandboxed macOS builds—use the regular `ssh` client instead.\r\n\r\n### [status](https://tailscale.com/docs/reference/tailscale-cli\\#status)\r\n\r\nGet the status of your connections to other Tailscale devices.\r\n\r\n```shell\r\ntailscale status\r\n```\r\n\r\nThis command returns a condensed table of information in human-readable format:\r\n\r\n```markup\r\n1 2 3 4 5\r\n100.1.2.3 device-a apenwarr@ linux active; direct , tx 1116 rx 1124\r\n100.4.5.6 device-b crawshaw@ macOS active; relay , tx 1351 rx 4262\r\n100.7.8.9 device-c danderson@ windows idle; tx 1214 rx 50\r\n100.0.1.2 device-d ross@ iOS -\r\n```\r\n\r\nFrom left-to-right, these columns represent:\r\n\r\n- Column 1 is a [**Tailscale IP**](https://tailscale.com/docs/concepts/tailscale-ip-addresses), which you can use to connect to the device.\r\n- Column 2 is the [**machine name**](https://tailscale.com/docs/concepts/machine-names) of the device. If you use [MagicDNS](https://tailscale.com/docs/features/magicdns), you can also use this name to connect.\r\n- Column 3 is the **email address** for the owner of the device.\r\n- Column 4 is the **device OS**.\r\n- Column 5 shows the current **connection status**.\r\n\r\nConnection status (column 5) is shown using three terms:\r\n\r\n- `active` means traffic is currently being sent/received from this device. It also includes the connection type, which can be `direct`, `relay`, or `peer-relay`.\r\n - If the connection is `direct`, it includes peer device's IP address.\r\n - If the connection is `relay`, it includes the [DERP server](https://tailscale.com/docs/reference/derp-servers)'s city code (`nyc`, `fra`, `tok`, `syd`) for the respective location.\r\n - If the connection is [`peer-relay`](https://tailscale.com/docs/features/peer-relay), it includes the Tailscale IP address of the peer relay and the VNI (virtual network interface) used.\r\n- `idle` means traffic is not currently being sent/received from this device.\r\n- `-` means no traffic has ever been sent/received from this device.\r\n\r\n`active` and `idle` connection statuses will also include `tx`/`rx` values indicating the number of bytes sent (`tx`) and received (`rx`) from this device.\r\n\r\nRunning `tailscale status` with the `--json` flag returns a machine-readable JSON response.\r\n\r\n```shell\r\ntailscale status --json\r\n```\r\n\r\nUnlike `tailscale status`, using this flag gives a detailed list of peers and users in your tailnet that makes it well-suited for automation tasks. It also includes additional metadata associated with your device.\r\n\r\nCombine this with [`jq`](https://stedolan.github.io/jq) to automate data collection about your network. For example, the following command counts and sorts the relay servers your Tailscale peers are connected to.\r\n\r\n```shell\r\ntailscale status --json | jq -r '.Peer[].Relay | select(.!=\"\")' | sort | uniq -c | sort -nr\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--active` Filter output to only peers with active sessions (not applicable to web mode).\r\n- `--browser` Open a browser in web mode (default `true`).\r\n- `--header` Show column headers in table format (default `false`).\r\n- `--json` Output in JSON format (WARNING: format subject to change).\r\n- `--listen=
` Listen address for web mode; use port 0 for automatic (default `127.0.0.1:8384`).\r\n- `--peers` Show status of peers (default `true`).\r\n- `--self` Show status of local machine (default `true`).\r\n- `--web` Run webserver with HTML showing status.\r\n\r\n### [switch](https://tailscale.com/docs/reference/tailscale-cli\\#switch)\r\n\r\nSwitch to a different Tailscale account. For more information about switching accounts, refer to [fast-user-switching](https://tailscale.com/docs/features/client/fast-user-switching).\r\n\r\n```shell\r\ntailscale switch [flags]\r\n```\r\n\r\nExamples:\r\n\r\n- To switch to the `alice@example.com` account:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ntailscale switch alice@example.com\r\n```\r\n\r\n- To switch to the account that has the [nickname](https://tailscale.com/docs/features/client/fast-user-switching#setting-a-nickname) \"work\":\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ntailscale switch work\r\n```\r\n\r\n\r\nAvailable flags:\r\n\r\n- `--list` Lists available accounts.\r\n\r\n\r\n - `--json` List available accounts in JSON format.\r\n\r\n```shell\r\ntailscale switch --list --json\r\n```\r\n\r\nSubcommands:\r\n\r\n- `remove ` removes a Tailscale account from the local machine. This does not delete the account itself, but it will no longer be available for switching to. You can add it back by logging in again. This command is currently in alpha and may change in the future.\r\n\r\n### [syspolicy](https://tailscale.com/docs/reference/tailscale-cli\\#syspolicy)\r\n\r\nList system policies, reload system policies, or inspect errors related to the [system policies](https://tailscale.com/docs/features/tailscale-system-policies) configured in your tailnet.\r\n\r\n```shell\r\ntailscale syspolicy\r\n```\r\n\r\nSubcommands:\r\n\r\n- `list` Shows system policies, reload system policies, or explore errors related to the [system policies](https://tailscale.com/docs/features/tailscale-system-policies) configured on the device.\r\n- `reload` Forces the Tailscale client to reload and reapply system policy settings on the device.\r\n\r\nAvailable flags:\r\n\r\n- `--json` Return a machine-readable JSON response.\r\n\r\n### [systray](https://tailscale.com/docs/reference/tailscale-cli\\#systray)\r\n\r\nThe `systray` command is available on the Linux client, is currently in [beta](https://tailscale.com/docs/reference/tailscale-release-stages#beta), and is available in Tailscale v1.88 or later.\r\n\r\nRun the [system tray (`systray`) application](https://tailscale.com/docs/features/client/linux-systray) for Linux desktop clients to access some common actions like fast user switching and exit node selection.\r\n\r\n```shell\r\ntailscale systray\r\n```\r\n\r\nDo not run `tailscale systray` as superuser (`sudo tailscale systray`), because systray is not designed to run as superuser and the command will fail.\r\n\r\n### [update](https://tailscale.com/docs/reference/tailscale-cli\\#update)\r\n\r\nThe `update` command is available in Tailscale v1.36 or later for Windows and Ubuntu/Debian Linux, in v1.48.0 or later for the Mac Apple Store version and Synology, and in v1.54.0 or later for QNAP and the [Standalone variant of the macOS application](https://tailscale.com/docs/concepts/macos-variants#standalone-variant). If you don't see this command and you are running one of these operating systems, consider [updating your Tailscale client](https://tailscale.com/docs/features/client/update).\r\n\r\nUpdate the Tailscale client version to the latest version, or to a different version.\r\n\r\n```shell\r\ntailscale update [flags]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--dry-run` Show what update would do, without performing the update and without prompting to start the update.\r\n- `--track` The track to check for updates, either \"stable\", \"release-candidate\", or unstable. If not specified, the update uses the track currently in effect for the client. For more information, refer to [Tailscale client versions and release tracks](https://tailscale.com/docs/reference/tailscale-client-versions#client-release-tracks).\r\n- `--version` An explicit version to use for the update or downgrade. You cannot specify both `--track` and `--version`. This flag is not available on the macOS client.\r\n- `--yes` Perform the update without interactive prompts. Defaults to false.\r\n\r\nIf you downgrade to a version that does not have the `tailscale update` functionality, you won't be able to run `tailscale update` to return to the prior version. You would need to [perform an update](https://tailscale.com/docs/features/client/update) without using the Tailscale CLI.\r\n\r\nTo determine the current version on a client, run [`tailscale version`](https://tailscale.com/docs/reference/tailscale-cli#version).\r\n\r\nExamples:\r\n\r\nUpdate to the latest version within your current track (stable or unstable, depending on what you're running):\r\n\r\n```shell\r\ntailscale update\r\n```\r\n\r\nUpdate to the latest version within your current track without using interactive prompts:\r\n\r\n```shell\r\ntailscale update --yes\r\n```\r\n\r\nUpdate to Tailscale v1.34:\r\n\r\n```shell\r\ntailscale update --version=1.34.0\r\n```\r\n\r\nUpdate to the latest unstable version:\r\n\r\n```shell\r\ntailscale update --track=unstable\r\n```\r\n\r\n### [version](https://tailscale.com/docs/reference/tailscale-cli\\#version)\r\n\r\nPrint the version of Tailscale.\r\n\r\n```shell\r\ntailscale version [flags]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--daemon` Also print local node's daemon version. Defaults to false.\r\n- `--json` Return a machine-readable JSON response.\r\n- `--upstream` Print the latest upstream release version from `pkgs.tailscale.com`. Defaults to false.\r\n- `--track`, `--track=[stable|unstable|release-candidate]` Check a specified track for updates. Empty value is the current track. For more information, refer to [Tailscale client versions and release tracks](https://tailscale.com/docs/reference/tailscale-client-versions#client-release-tracks).\r\n\r\nRunning `tailscale version` also prints other information, including the Go version. Here's an example of the output:\r\n\r\n```shell\r\ntailscale version\r\n1.72.0\r\n tailscale commit: 9a0f00ea8ed08d1a94b357fb232ac9d44a512664\r\n other commit: 387e0b40ad87031fb4444372ee80a97156e8deb9\r\n go version: go1.22.5\r\n```\r\n\r\n### [wait](https://tailscale.com/docs/reference/tailscale-cli\\#wait)\r\n\r\nWait for Tailscale resources to become available for binding within a specified timeout or indefinitely.\r\n\r\nThe command returns exit code `0` on success. It returns a non-zero exit code on failure or timeout.\r\n\r\nAs of Tailscale version 1.96, the only resource available to wait for is the Tailscale interface and its IPs. A future version of this command may support waiting for other types of resources.\r\n\r\nIf running in userspace-networking mode, this command only waits for `tailscaled` and the `Running` state, as no physical network interface exists.\r\n\r\n```shell\r\ntailscale wait [flags]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--timeout=` Set a timeout duration in seconds. Setting the duration to `0` will set the timeout to indefinite.\r\n\r\nExamples:\r\n\r\nTo wait on a specific type of IP address, use `tailscale ip` in combination with the `tailscale wait` command. For example, to wait for an IPv4 address:\r\n\r\n```shell\r\ntailscale wait && tailscale ip --assert=\r\n```\r\n\r\nLinux `systemd` users can wait for the `tailscale-online.target` target, which runs this command.\r\n\r\nA service that wants to bind to (listen on) a Tailscale interface or IP address, can use the following pattern to ensure Tailscale is ready before the program starts:\r\n\r\n```shell\r\ntailscale wait && /path/to/service [...]\r\n```\r\n\r\n### [web](https://tailscale.com/docs/reference/tailscale-cli\\#web)\r\n\r\nStart a web server for controlling the `tailscaled` daemon. Starting a web server is useful when the CLI or a native app is impractical (such as on NAS devices).\r\n\r\n```shell\r\ntailscale web [flags]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--cgi=` Run the web server as a CGI script. Defaults to false.\r\n- `--listen=` Set the listen address. Use port `0` for automatic. Defaults to `localhost:8088`.\r\n- `--origin=` Origin at which the web UI is served (if behind a reverse proxy or used with CGI).\r\n- `--prefix=` Set the URL prefix added to requests (for CGI or reverse proxies).\r\n- `--readonly` Run the web server in read-only mode.\r\n\r\n### [whois](https://tailscale.com/docs/reference/tailscale-cli\\#whois)\r\n\r\nGet the machine and user associated with a Tailscale IP.\r\n\r\n```shell\r\ntailscale whois ip[:port]\r\n```\r\n\r\nFor user devices, this command returns:\r\n\r\n```markup\r\nMachine:\r\n Name:\r\n ID:\r\n Addresses:\r\n AllowedIPs:\r\nUser:\r\n Name:\r\n ID:\r\nCapabilities:\r\n```\r\n\r\nFor devices that are tagged, this command returns:\r\n\r\n```markup\r\nMachine:\r\n Name:\r\n ID:\r\n Addresses:\r\n AllowedIPs:\r\n Tags:\r\nCapabilities:\r\n```\r\n\r\nFor each of these fields:\r\n\r\n- `Machine`, `Name` is the [machine name](https://tailscale.com/docs/concepts/machine-names) of the device. If you use [MagicDNS](https://tailscale.com/docs/features/magicdns), you can also use this name to connect.\r\n- `Machine`, `ID` is the [node id](https://tailscale.com/docs/reference/glossary#node) of the device.\r\n- `Machine`, `Addresses` are the [Tailscale IP](https://tailscale.com/docs/concepts/tailscale-ip-addresses), which you can use to connect to the device.\r\n- `Machine`, `AllowedIPs` are the subnet routes available to the device.\r\n- `Machine`, `Tags` are the tags to which the device belongs.\r\n- `User`, `Name` is the email address for the owner of the device.\r\n- `User`, `ID` is the unique ID of the user\r\n- `Capabilities` show the grants for the device.\r\n\r\nRunning `tailscale whois` with the `--json` flag will return a machine-readable JSON response. (Note that the `--json` option must come before the `ip[:port]` argument.)\r\n\r\n```shell\r\ntailscale whois --json ip[:port]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--json` Output in JSON format.\r\n- `--proto=` Protocol for the WhoIs request; one of `tcp` or `udp`; empty mans both.\r\n\r\n### [appc-routes](https://tailscale.com/docs/reference/tailscale-cli\\#appc-routes)\r\n\r\nPrint the current [app connector](https://tailscale.com/docs/features/app-connectors) route status.\r\n\r\nBy default this command prints the domains configured in the app connector\r\nconfiguration and how many routes have been learned for each domain.\r\n\r\n```shell\r\ntailscale appc-routes [flags]\r\n```\r\n\r\nAvailable flags:\r\n\r\n- `--all` Print learned domains and routes and extra policy configured routes.\r\n- `--map` Print the map of learned domains.\r\n- `--n` Print the total number of routes this node advertises.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Tailscale CLI

\n

Last validated: Jan 26, 2026

\n

The Tailscale client includes a built-in command-line interface (CLI) you can use to manage and troubleshoot your device within your Tailscale network (known as a tailnet).

\n

The Tailscale CLIis available for all plans.

\n

Using the Tailscale CLI

\n

The location of the CLI varies depending on your platform:

\n

Linux macOS Windows

\n

On Linux, the CLI is your primary interface to Tailscale. The tailscale binary is likely already in your $PATH, so you can run commands with:

\n
tailscale <command>\n
\n

There is no CLI support for iOS and Android.

\n

Tab completion

\n

The Tailscale CLI supports tab-completion for commands, flags, and arguments. You can configure tab-completion with the completion command.

\n
tailscale completion <shell> [--flags] [--descs]\n
\n

Select your shell, then follow the instructions to load Tailscale CLI completions.

\n

Bash Zsh Fish PowerShell

\n

To load tab-completions for Bash, run the following command.

\n
source <(tailscale completion bash)\n
\n

Run the following command to load completions for every new session on Linux, then reload your shell.

\n
tailscale completion bash > /etc/bash_completion.d/tailscale\n
\n

Run the following command to load completions for every new session on macOS, then reload your shell.

\n
tailscale completion bash > $(brew --prefix)/etc/bash_completion.d/tailscale\n
\n

Command Reference

\n

Common flags for all commands:

\n
    \n
  • --socket=<path> Path to the tailscaled socket.
    • \n
\n

up

\n

Connect your device to Tailscale and authenticate if needed.

\n
tailscale up [flags]\n
\n

Running tailscale up without any flags connects to Tailscale.

\n

Common flags:

\n
    \n
  • --accept-routes Accept subnet routes that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.
    • \n
  • --advertise-exit-node Offer to be an exit node for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.
    • \n
  • --advertise-routes=<ip> Expose physical subnet routes to your entire Tailscale network.
    • \n
  • --exit-node=<ip|name> Provide a Tailscale IP or machine name to use as an exit node. To disable the use of an exit node, pass the flag with an empty argument: --exit-node=.
    • \n
  • --exit-node-allow-lan-access Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.
    • \n
  • --force-reauth Force re-authentication.
    • \n
  • --snat-subnet-routes (Linux only) Disable source NAT. In normal operations, a subnet device sees the traffic originating from the subnet router. This simplifies routing, but does not allow traversing multiple networks. By disabling source NAT, the end machine sees the LAN IP address of the originating machine as the source.
    • \n
  • --stateful-filtering Enable stateful filtering for subnet routers and exit nodes. When enabled, inbound packets with another node's destination IP are dropped, unless they are a part of a tracked outbound connection from that node. Defaults to disabled.
    • \n
  • --shields-up Block incoming connections from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections.
    • \n
  • --ssh Run a Tailscale SSH server, permitting access per the tailnet administrator's declared access policy, or the default policy if none is defined. Defaults to false.
    • \n
\n

For a complete list of available flags, refer to the tailscale up topic.

\n

down

\n

Disconnect from Tailscale. Running this command is the same as choosing to disconnect from or quit a Tailscale client.

\n
tailscale down\n
\n

When disconnected, you cannot reach devices over Tailscale. To reconnect, re-run tailscale up without any flags.

\n

Available flags:

\n
    \n
  • --accept-risk=<risk> Accept risk and skip confirmation for risk type. This can be either lose-ssh or all, or an empty string to not accept risk.
    • \n
  • --reason=\"<description>\" Specify the reason (inside quotes) for disconnecting Tailscale when the system policiesAlwaysOn.Enabled and AlwaysOn.OverrideWithReason are enabled. For example, tailscale down --reason=\"DNS issues\".
    • \n
\n

bugreport

\n

The bugreport command is available in Tailscale v1.8 or later. If you don't see this command, consider updating your Tailscale client.

\n

Generate a bug report with diagnostic information.

\n

The bugreport command makes it easier to report bugs to the Tailscale team by marking diagnostic logs with indicators to make triage easier.

\n

If you encounter a connectivity issue, run tailscale bugreport on the device experiencing the issue at the time you encounter it.

\n
tailscale bugreport\n
\n

This command prints a random identifier into diagnostic logs, which you can share with our team.

\n

Identifiers look like this:

\n
BUG-1b7641a16971a9cd75822c0ed8043fee70ae88cf05c52981dc220eb96a5c49a8-20210427151443Z-fbcd4fd3a4b7ad94\n
\n

This command shares no personally identifiable information and is unused unless you share the bug identifier with our team.

\n

Available flags:

\n
    \n
  • --diagnose Prints additional verbose information about the system to the Tailscale logs after generating a bugreport identifier, which can then be viewed by our support team. Defaults to false.
    • \n
  • --record Pause and then write another bugreport. Use this flag to create an initial bugreport identifier. During the pause, perform the action that reproduces your issue. Then, press Enter to create a second bugreport identifier. Share both bug identifiers with our team. Defaults to false.
    • \n
\n

cert

\n

Generate Let's Encrypt certificate and key files on the host for HTTPS certificates in your tailnet.

\n

If you are trying to serve a folder of files or reverse proxy to an HTTP service, use the tailscale serve command instead.

\n
tailscale cert hostname.tails-scales.ts.net\n
\n

Alternatively, if you want to save the certificate and private key to files, you can use the --cert-file and --key-file arguments:

\n
tailscale cert --cert-file=cert.pem --key-file=key.pem hostname.tails-scales.ts.net\n
\n

The certificates provided by Let's Encrypt have a 90-day expiry and require periodic renewal. When a certificate is delivered as files on disk which you then move to an install location, such as when using tailscale cert, the tailscaled daemon doesn't know where to place a renewed certificate or how to install it. As a result, you are responsible for renewing any certificates that you create using tailscale cert.

\n

If a certificate is handled without the user initiating any file-based certificate installation (such as when using the Caddy integration of Tailscale) then the certificate will automatically renew without the user doing anything.

\n

Available flags:

\n
    \n
  • --cert-file=<cert> Specify the certificate output path.
    • \n
  • --key-file=<key> Specify the private key output path.
    • \n
  • --min-validity=<duration> Request a specified minimum remaining validity on the returned certificate. duration can be any value parseable by time.ParseDuration(). For example, use 120h to set the duration to five days.
    • \n
  • --serve-demo Serve on port :443 using the cert as a demo, instead of writing out the files to disk.
    • \n
\n

The --min-validity flag lets you ensure that the returned certificate is valid for at least the specified duration. If you specify a duration longer than the certification lifetime set by Let's Encrypt, it uses the maximum lifetime set by Let's Encrypt.

\n

dns

\n

The dns command lets you access Tailscale DNS settings. It's available in Tailscale v1.74.0 and later.

\n

Subcommands:

\n
    \n
  • status Print the configuration of the local DNS forwarder and the tailnet-wide MagicDNS configuration.
    • \n
  • query Perform a DNS query using the local DNS forwarder. It's available in Tailscale v1.76.0 and later.
    • \n
\n

Available flags for status:

\n
    \n
  • --all Outputs advanced debugging information.
    • \n
\n

Available flags for status and query:

\n
    \n
  • --json Output in JSON format.
    • \n
\n

drive

\n

Share a directory with your tailnet using Taildrive.

\n
tailscale drive share <name> <path>\r\ntailscale drive rename <oldname> <newname>\r\ntailscale drive unshare <name>\r\ntailscale drive list\n
\n

Subcommands:

\n
    \n
  • share Create or modify a share.
    • \n
  • rename Rename a share.
    • \n
  • unshare Remove a share.
    • \n
  • list List current shares.
    • \n
\n

completion

\n

Configure tab-completion for the Tailscale CLI.

\n
tailscale completion <subcommand> [flags]\n
\n

Subcommands:

\n
    \n
  • bash Configure tab-completion for the bash shell.
    • \n
  • zsh Configure tab-completion for the zsh shell.
    • \n
  • fish Configure tab-completion for the fish shell.
    • \n
  • powershell Configure tab-completion for PowerShell.
    • \n
\n

Available flags:

\n
    \n
  • --flags=<true|false> Configure whether to suggest flags (in addition to subcommands). Set to true by default.
    • \n
  • --descs=<true|false> Configure whether to include descriptions of subcommands in the suggestions. Set to true by default.
    • \n
\n

configure

\n

Configure resources that you want to include in your tailnet.

\n
tailscale configure <subcommands>\n
\n

Subcommands:

\n
    \n
  • kubeconfig (alpha) Configure kubectl to connect to a Kubernetes cluster using Tailscale.
    • \n
  • mac-vpn Install or uninstall the VPN configuration on App Store and Standalone variant of macOS.
    • \n
  • synology Configure Synology to enable outbound connections needed for Tailscale.
    • \n
  • sysext Activate, deactivate, or manage the state of the Tailscale system extension on the Standalone variant of macOS.
    • \n
  • systray Manage the systray client for Linux.
    • \n
\n

Available flags for kubeconfig:

\n
    \n
  • --http Use HTTP instead of HTTPS to connect to the auth proxy. Ignored if you include a scheme in the hostname argument.
    • \n
\n

Available subcommands for mac-vpn:

\n
    \n
  • install Write the Tailscale VPN configuration to the macOS settings.
    • \n
  • uninstall Delete the Tailscale VPN configuration from the macOS settings.
    • \n
\n

Available subcommands for sysext:

\n
    \n
  • activate Register the Tailscale system extension with macOS.
    • \n
  • deactivate Deactivate the Tailscale system extension on macOS.
    • \n
  • status Print the enablement status of the Tailscale system extension.
    • \n
\n

Available flags for systray:

\n
    \n
  • --enable-startup=<init-system> Install the startup script for the init system. The only currently supported value is systemd.
    • \n
\n

Examples:

\n
    \n
  • To configure your local kubeconfig file for authentication with a Kubernetes auth proxy:
    • \n
\n
tailscale configure kubeconfig <hostname-or-fqdn>\n
\n
    \n
  • To configure Synology to enable outbound connections:
    • \n
\n
tailscale configure synology\n
\n

exit-node

\n

Get information about exit-nodes in your tailnet.

\n
tailscale exit-node <subcommands>\n
\n

Available subcommands:

\n\n

Available flags for list:

\n
    \n
  • --filter=<country> Filter exit nodes by country.
    • \n
\n

file

\n

Access and make files available to Taildrop.

\n
tailscale file cp <files...> <target>:\r\ntailscale file get <target-directory>\n
\n

Available commands:

\n
    \n
  • cp Copy files to a host.
    • \n
  • get Move files out of the Tailscale file inbox.
    • \n
\n

Available flags for cp:

\n
    \n
  • --name=<name> Alternate filename to use, especially useful when <file> is - (stdin).
    • \n
  • --targets List possible file cp targets.
    • \n
  • --verbose Verbose output.
    • \n
\n

Available flags for get:

\n
    \n
  • --conflict=<behavior>``behaviorwhen a conflicting (same-named) file already exists in the target directory.\n
      \n
    • skip Skip conflicting files: leave them in the Taildrop inbox and print an error. Get any non-conflicting files.
      • \n
    • overwrite Overwrite existing file.
      • \n
    • rename Write to a new number-suffixed filename.
      • \n
    \n
    • \n
  • --loop Run get in a loop, receiving files as they come in.
    • \n
  • --verbose Verbose output.
    • \n
  • --wait Wait for a file to arrive if inbox is empty.
    • \n
\n

funnel

\n

Serve content and local servers from your Tailscale node to the internet.

\n

To limit local service access to your tailnet, use the serve command.

\n
tailscale funnel <target>\r\ntailscale funnel <subcommand> [flags] <args>\n
\n

Subcommands:

\n
    \n
  • status Gets the status.
    • \n
  • reset Resets the configuration.
    • \n
\n

For more information, refer to the tailscale funnel topic.

\n

ip

\n

Get a device's Tailscale IP address.

\n
tailscale ip [flags] [<hostname>]\n
\n

By default, this command returns both an 100.x.y.z IPv4 address and an IPv6 address for the current device. You can return only an IPv4 or IPv6 address by passing either the -4 or -6 flags.

\n
tailscale ip -4\n
\n

For example, this command will return information similar to the following:

\n
100.121.112.23\n
\n

You can also find the Tailscale IP for other devices on your network by adding the device hostname after the command. For example:

\n
tailscale ip raspberrypi\n
\n

This command will return information similar to the following:

\n
100.126.153.111\r\nfd7a:115c:a1e0:ab12:4843:cd96:627e:9975\n
\n

Available flags:

\n
    \n
  • --4 Only return an IPv4 address.
    • \n
  • --6 Only return an IPv6 address.
    • \n
  • --1 Only return one address, preferring IPv4.
    • \n
  • --assert=<specific-ip-address> Assert that the node's IP (or one of the node's IPs) matches this IP address.
    • \n
\n

licenses

\n

Get open source license information.

\n
tailscale licenses\n
\n

lock

\n

Manage Tailnet Lock for your tailnet.

\n
tailscale lock <subcommand> [flags] <args>\n
\n

Common subcommands:

\n
    \n
  • init Initializes Tailnet Lock.
    • \n
  • status Outputs the state of Tailnet Lock.
    • \n
  • add Adds one or more trusted signing keys to Tailnet Lock.
    • \n
  • remove Removes one or more trusted signing keys from Tailnet Lock.
    • \n
  • sign Signs a node key and transmits the signature to the coordination server.
    • \n
\n

Running tailscale lock with no subcommand and no arguments is equivalent to running tailscale lock status.

\n

For a complete list of subcommands and flags, refer to the tailscale lock topic.

\n

login

\n

Log into Tailscale (and add this device to your Tailscale network). For more information about logging in, refer to fast-user-switching.

\n
tailscale login [flags]\n
\n

Available flags:

\n
    \n
  • --accept-dns Accept DNS configuration from the admin console. Defaults to accepting DNS settings.
    • \n
  • --accept-routes Accept subnet routes that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.
    • \n
  • --advertise-connector Offer to be an app connector for domain-specific internet traffic for the tailnet.
    • \n
  • --advertise-exit-node Offer to be an exit node for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.
    • \n
  • --advertise-routes=<ip> Expose physical subnet routes to your entire Tailscale network.
    • \n
  • --advertise-tags=<tags> Give tagged permissions to this device. You must be listed in \"TagOwners\" to be able to apply tags.
    • \n
  • --auth-key=<key> Provide an auth key to automatically authenticate the node as your user account. For a best practice when handling the --auth-key value, refer to Securely handle an auth key.
    • \n
  • --client-id Client ID used to generate auth keys by using\r\nworkload identity federation.
    • \n
  • --client-secret OAuth Client secret used to generate\r\nauth keys; if it begins with file:, then it's a path to a\r\nfile containing the secret.
    • \n
  • --exit-node=<ip|name> Provide a Tailscale IP or machine name to use as an exit node. To disable the use of an exit node, pass the flag with an empty argument: --exit-node=.
    • \n
  • --exit-node-allow-lan-access Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.
    • \n
  • --hostname=<name> Provide a hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in MagicDNS.
    • \n
  • --id-token ID token from the identity provider to exchange with the control\r\nserver for workload identity federation; if it begins\r\nwith file:, then it's a path to a file containing the token.
    • \n
  • --audience Audience used when requesting an ID token from an identity provider for auth keys generated by workload identity federation.
    • \n
  • --login-server=<url> Provide the base URL of a control server instead of https://controlplane.tailscale.com. If you are using Headscale for your control server, use your Headscale instance's URL.
    • \n
  • --netfilter-mode=<mode> Netfilter mode (one of on, nodivert, off). Refer to Tailscale netfilter modes for more information.
    • \n
  • --nickname=<name> Nickname for the current account.
    • \n
  • --operator=<user> Provide a Unix username other than root to operate tailscaled.
    • \n
  • --qr Generate a QR code for the web login URL. Defaults to not showing a QR code.
    • \n
  • --qr-format=<format> QR code formatting: small or large. Defaults to small.
    • \n
  • --stateful-filtering Enable stateful filtering for subnet routers and exit nodes. When enabled, inbound packets with another node's destination IP are dropped, unless they are a part of a tracked outbound connection from that node. Defaults to disabled.
    • \n
  • --shields-up Block incoming connections from other devices on your Tailscale network. Useful for personal devices that only make outgoing connections.
    • \n
  • --snat-subnet-routes Source NAT traffic to local routes advertised with --advertise-routes.
    • \n
  • --ssh Run a Tailscale SSH server, permitting access per the tailnet administrator's declared access policy, or the default policy if none is defined. Defaults to false.
    • \n
  • --timeout=<duration> Maximum amount of time to wait for the Tailscale service to initialize. duration can be any value parseable by time.ParseDuration(). Defaults to 0s, which blocks forever.
    • \n
  • --unattended(Windows only) Run in unattended mode where Tailscale keeps running even after the current user logs out.
    • \n
\n

logout

\n

Disconnect from Tailscale and expire the current log in. The next time you run tailscale up, you'll need to reauthenticate your device.

\n
tailscale logout\n
\n

If you run tailscale logout on an ephemeral node, the node will be removed from your tailnet immediately.

\n

Available flags:

\n
    \n
  • --reason Reason for the logout, if required by a system policy.
    • \n
\n

metrics

\n

Expose and collect Tailscale client metrics for use with third-party monitoring systems.

\n
tailscale metrics\n
\n

Subcommands:

\n
    \n
  • print Shows client metrics in the current terminal session.
    • \n
  • write Writes metric values to a text file.
    • \n
\n

netcheck

\n

Get a report on your current physical network conditions. This command is provided to help debug connection troubles.

\n
tailscale netcheck\n
\n

netcheck will output a report like this:

\n
Report:\r\n\t* Time: 2025-03-13T16:35:03.336481Z\r\n\t* UDP: true\r\n\t* IPv4: yes, <ipv4-address>\r\n\t* IPv6: yes, <ipv6-address>\r\n\t* MappingVariesByDestIP: false\r\n\t* PortMapping:\r\n\t* Nearest DERP: Seattle\r\n\t* DERP latency:\r\n\t\t- sea: 24.2ms  (Seattle)\r\n\t\t- sfo: 50.5ms  (San Francisco)\r\n\t\t- lax: 57.2ms  (Los Angeles)\r\n\t\t- den: 58.5ms  (Denver)\r\n\t\t- dfw: 63ms    (Dallas)\r\n\t\t- ord: 73.3ms  (Chicago)\n
\n

(In the example output, the list of DERP servers is truncated for brevity.)

\n
    \n
  • UDP shows whether UDP traffic is enabled on the current network. If this is false, it's unlikely Tailscale will be able to make point-to-point connections, and will instead rely on our encrypted TCP relays (DERP)
    • \n
  • IPv4 and IPv6 show your network public IP addresses and support for both protocols.
    • \n
  • MappingVariesByDestIP describes whether your device is behind a difficult NAT that varies the device's IP address depending on the destination.
    • \n
  • HairPinning describes whether your router can route connections from endpoints on your LAN back to your LAN using those endpoints' globally-mapped IPv4 addresses/ports.
    • \n
  • PortMapping describes a list of which three port-mapping services exist on your router. Possible values are \"UPnP\", \"NAT-PMP\", and \"PCP\".
    • \n
  • DERP latency and Nearest DERP describe latency from our encrypted TCP relays (DERP). The lowest latency (\"nearest\") server is used for traffic.
    • \n
\n

If any fields are blank, it means Tailscale wasn't able to measure that network property.

\n

All the information from tailscale netcheck is also available in the Machines page of the admin console, by selecting a particular machine.

\n

Available flags:

\n
    \n
  • --every=<duration> If non-zero, do an incremental report with the given frequency.
    • \n
  • --format=<format> Output format; empty (for human-readable), json or json-line.
    • \n
  • --verbose Verbose logs.
    • \n
  • --bind-address Send and receive connectivity probes using this locally bound IP address.
    • \n
  • --bind-port Send and receive connectivity probes using this UDP port.
    • \n
\n

nc

\n

Connect to a port on a host, connected to stdin/stdout.

\n
tailscale nc <hostname-or-IP> <port>\n
\n

ping

\n

Attempt to ping another device exclusively over Tailscale.

\n

The regular ping command often works fine over Tailscale, but tailscale ping provides more details about the connection over Tailscale that can be helpful when troubleshooting connectivity.

\n
tailscale ping <hostname-or-ip>\n
\n

You can call tailscale ping using either a 100.x.y.z address or a machine name.

\n

Available flags:

\n
    \n
  • --c Maximum number of pings to send. Defaults to 10.
    • \n
  • --icmp, --icmp=false Perform an ICMP-level ping (through WireGuard, but not the local host OS stack). Defaults to false.
    • \n
  • --peerapi, --peerapi=false Try hitting the peer's PeerAPI HTTP server. Defaults to false.
    • \n
  • --size=<size> Size of the ping message (default pings only). 0 for minimum size.
    • \n
  • --tsmp, --tsmp=false Perform a TSMP-level ping (through WireGuard, but not either host's OS stack). Defaults to false.
    • \n
  • --timeout=<duration> Maximum amount of time to wait before giving up on a ping. duration can be any value parseable by time.ParseDuration(). Defaults to 5s.
    • \n
  • --until-direct, --until-direct=false Stop once a direct path is established. Defaults to true.
    • \n
  • --verbose, --verbose=false Show verbose output. Defaults to false.
    • \n
\n

There are four types of ping messages supported by the tailscale ping command.

\n

serve

\n

Serve content and local servers from your Tailscale node to your tailnet.

\n

To publicly share the local service to the internet, use the funnel command.

\n
tailscale serve <target>\r\ntailscale serve <subcommand> [flags] <args>\n
\n

Subcommands:

\n
    \n
  • status Gets the status.
    • \n
  • reset Resets the configuration.
    • \n
\n

For more information, refer to the tailscale serve topic.

\n

set

\n

Change specified preferences.

\n

Unlike tailscale up, this command does not require the complete set of desired settings. It only updates the settings you explicitly set. There are no default values. Note that when using Fast User Switching, changes made are only for the currently connected tailnet.

\n
tailscale set [flags]\n
\n

Available flags:

\n
    \n
  • --accept-dns Accept DNS configuration from the admin console.
    • \n
  • --accept-risk=<risk> Accept risk and skip confirmation for risk type. This can be either lose-ssh or all, or an empty string to not accept risk.
    • \n
  • --accept-routes, --accept-routes=false Accept subnet routes that other nodes advertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.
    • \n
  • --advertise-connector Offer to be an app connector for domain-specific internet traffic for the tailnet.
    • \n
  • --advertise-exit-node, --advertise-exit-node=false Offer to be an exit node for internet traffic for the tailnet.
    • \n
  • --advertise-routes=<ip> Expose physical subnet routes to your entire Tailscale network. This is a comma-separated string, such as \"10.0.0.0/8,192.168.0.0/24\", or an empty string to not advertise routes.
    • \n
  • --auto-update, --auto-update=false Enable or disable auto-updates for the client.
    • \n
  • --exit-node=<ip|name> Provide a Tailscale IP or machine name to use as an exit node. You can also use --exit-node=auto:any to track the suggested exit node and automatically switch to it when available exit nodes or network conditions change. To disable the use of an exit node, pass the flag with an empty argument using --exit-node=.
    • \n
  • --exit-node-allow-lan-access, --exit-node-allow-lan-access=false Allow the client node access to its own LAN while connected to an exit node.
    • \n
  • --hostname=<name> Hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in MagicDNS.
    • \n
  • --netfilter-mode=<mode> Netfilter mode (one of on, nodivert, off). Refer to Tailscale netfilter modes for more information.
    • \n
  • --nickname=<name> Nickname for the current account.
    • \n
  • --operator=<user> A Unix username other than root to operate tailscaled.
    • \n
  • --relay-server-port=<port> Specify a UDP port to accept peer relay connections on. UDP port number (0 will pick a random unused port) for the relay server to bind to, on all interfaces, or empty string to disable relay server functionality. Refer to Tailscale Peer Relays for more information.
    • \n
  • --relay-server-static-endpoints Use static endpoints for Tailscale Peer Relays.
    • \n
  • --report-posture Allow management plane to gather device posture information.
    • \n
  • --shields-up, --shields-up=false Block incoming connections from other devices on your Tailscale network.\r\nUseful for personal devices that only make outgoing connections.
    • \n
  • --snat-subnet-routes Source NAT traffic to local routes advertised with --advertise-routes.
    • \n
  • --ssh, --ssh=false Run a Tailscale SSH server, permitting access per the tailnet administrator's declared access policy, or the default policy if none is defined.
    • \n
  • --stateful-filtering Apply stateful filtering to forwarded packets (subnet routers, exit nodes, and so on).
    • \n
  • --update-check Notify about available Tailscale updates.
    • \n
  • --webclient, --webclient=false Expose the web interface to your tailnet persistently in the background on port :5252.
    • \n
\n

ssh

\n

Establish a Tailscale SSH session to a Tailscale machine.

\n

You can often use the regular ssh command or another SSH client to make an SSH session to a Tailscale machine. However, when your local node is in userspace-networking mode and can't make a direct connection, use tailscale ssh. This sets up an SSH ProxyCommand to connect through the local tailscaled daemon. You can also use tailscale ssh when your local node is in kernel mode.

\n

The tailscale ssh command automatically checks the destination server's SSH host key against the node's SSH host key as advertised by using the Tailscale coordination server.

\n
tailscale ssh <args>\n
\n

<args> is one of the following forms:

\n
    \n
  • host The destination server. An interactive session will prompt you for the user name to use for the session.
    • \n
  • user@host The user name for the session and the destination server.
    • \n
\n

For both forms, host can be the destination server's MagicDNS name (even if --accept-dns=false was set on the local node) or the destination server's Tailscale IP address.

\n

tailscale ssh is not available on sandboxed macOS builds—use the regular ssh client instead.

\n

status

\n

Get the status of your connections to other Tailscale devices.

\n
tailscale status\n
\n

This command returns a condensed table of information in human-readable format:

\n
1           2         3           4         5\r\n100.1.2.3   device-a  apenwarr@   linux     active; direct <ip-port>, tx 1116 rx 1124\r\n100.4.5.6   device-b  crawshaw@   macOS     active; relay <relay-server>, tx 1351 rx 4262\r\n100.7.8.9   device-c  danderson@  windows   idle; tx 1214 rx 50\r\n100.0.1.2   device-d  ross@       iOS       -\n
\n

From left-to-right, these columns represent:

\n
    \n
  • Column 1 is a Tailscale IP, which you can use to connect to the device.
    • \n
  • Column 2 is the machine name of the device. If you use MagicDNS, you can also use this name to connect.
    • \n
  • Column 3 is the email address for the owner of the device.
    • \n
  • Column 4 is the device OS.
    • \n
  • Column 5 shows the current connection status.
    • \n
\n

Connection status (column 5) is shown using three terms:

\n
    \n
  • active means traffic is currently being sent/received from this device. It also includes the connection type, which can be direct, relay, or peer-relay.\n
      \n
    • If the connection is direct, it includes peer device's IP address.
      • \n
    • If the connection is relay, it includes the DERP server's city code (nyc, fra, tok, syd) for the respective location.
      • \n
    • If the connection is peer-relay, it includes the Tailscale IP address of the peer relay and the VNI (virtual network interface) used.
      • \n
    \n
    • \n
  • idle means traffic is not currently being sent/received from this device.
    • \n
  • - means no traffic has ever been sent/received from this device.
    • \n
\n

active and idle connection statuses will also include tx/rx values indicating the number of bytes sent (tx) and received (rx) from this device.

\n

Running tailscale status with the --json flag returns a machine-readable JSON response.

\n
tailscale status --json\n
\n

Unlike tailscale status, using this flag gives a detailed list of peers and users in your tailnet that makes it well-suited for automation tasks. It also includes additional metadata associated with your device.

\n

Combine this with jq to automate data collection about your network. For example, the following command counts and sorts the relay servers your Tailscale peers are connected to.

\n
tailscale status --json | jq -r '.Peer[].Relay | select(.!=\"\")' | sort | uniq -c | sort -nr\n
\n

Available flags:

\n
    \n
  • --active Filter output to only peers with active sessions (not applicable to web mode).
    • \n
  • --browser Open a browser in web mode (default true).
    • \n
  • --header Show column headers in table format (default false).
    • \n
  • --json Output in JSON format (WARNING: format subject to change).
    • \n
  • --listen=<address> Listen address for web mode; use port 0 for automatic (default 127.0.0.1:8384).
    • \n
  • --peers Show status of peers (default true).
    • \n
  • --self Show status of local machine (default true).
    • \n
  • --web Run webserver with HTML showing status.
    • \n
\n

switch

\n

Switch to a different Tailscale account. For more information about switching accounts, refer to fast-user-switching.

\n
tailscale switch <account> [flags]\n
\n

Examples:

\n
    \n
  • To switch to the alice@example.com account:
    • \n
\n
tailscale switch alice@example.com\n
\n
    \n
  • To switch to the account that has the nickname \"work\":
    • \n
\n
tailscale switch work\n
\n

Available flags:

\n
    \n
  • \n

    --list Lists available accounts.

    \n
      \n
    • --json List available accounts in JSON format.
      • \n
    \n
    • \n
\n
tailscale switch --list --json\n
\n

Subcommands:

\n
    \n
  • remove <id> removes a Tailscale account from the local machine. This does not delete the account itself, but it will no longer be available for switching to. You can add it back by logging in again. This command is currently in alpha and may change in the future.
    • \n
\n

syspolicy

\n

List system policies, reload system policies, or inspect errors related to the system policies configured in your tailnet.

\n
tailscale syspolicy\n
\n

Subcommands:

\n
    \n
  • list Shows system policies, reload system policies, or explore errors related to the system policies configured on the device.
    • \n
  • reload Forces the Tailscale client to reload and reapply system policy settings on the device.
    • \n
\n

Available flags:

\n
    \n
  • --json Return a machine-readable JSON response.
    • \n
\n

systray

\n

The systray command is available on the Linux client, is currently in beta, and is available in Tailscale v1.88 or later.

\n

Run the system tray (systray) application for Linux desktop clients to access some common actions like fast user switching and exit node selection.

\n
tailscale systray\n
\n

Do not run tailscale systray as superuser (sudo tailscale systray), because systray is not designed to run as superuser and the command will fail.

\n

update

\n

The update command is available in Tailscale v1.36 or later for Windows and Ubuntu/Debian Linux, in v1.48.0 or later for the Mac Apple Store version and Synology, and in v1.54.0 or later for QNAP and the Standalone variant of the macOS application. If you don't see this command and you are running one of these operating systems, consider updating your Tailscale client.

\n

Update the Tailscale client version to the latest version, or to a different version.

\n
tailscale update [flags]\n
\n

Available flags:

\n
    \n
  • --dry-run Show what update would do, without performing the update and without prompting to start the update.
    • \n
  • --track The track to check for updates, either \"stable\", \"release-candidate\", or unstable. If not specified, the update uses the track currently in effect for the client. For more information, refer to Tailscale client versions and release tracks.
    • \n
  • --version An explicit version to use for the update or downgrade. You cannot specify both --track and --version. This flag is not available on the macOS client.
    • \n
  • --yes Perform the update without interactive prompts. Defaults to false.
    • \n
\n

If you downgrade to a version that does not have the tailscale update functionality, you won't be able to run tailscale update to return to the prior version. You would need to perform an update without using the Tailscale CLI.

\n

To determine the current version on a client, run tailscale version.

\n

Examples:

\n

Update to the latest version within your current track (stable or unstable, depending on what you're running):

\n
tailscale update\n
\n

Update to the latest version within your current track without using interactive prompts:

\n
tailscale update --yes\n
\n

Update to Tailscale v1.34:

\n
tailscale update --version=1.34.0\n
\n

Update to the latest unstable version:

\n
tailscale update --track=unstable\n
\n

version

\n

Print the version of Tailscale.

\n
tailscale version [flags]\n
\n

Available flags:

\n
    \n
  • --daemon Also print local node's daemon version. Defaults to false.
    • \n
  • --json Return a machine-readable JSON response.
    • \n
  • --upstream Print the latest upstream release version from pkgs.tailscale.com. Defaults to false.
    • \n
  • --track, --track=[stable|unstable|release-candidate] Check a specified track for updates. Empty value is the current track. For more information, refer to Tailscale client versions and release tracks.
    • \n
\n

Running tailscale version also prints other information, including the Go version. Here's an example of the output:

\n
tailscale version\r\n1.72.0\r\n  tailscale commit: 9a0f00ea8ed08d1a94b357fb232ac9d44a512664\r\n  other commit: 387e0b40ad87031fb4444372ee80a97156e8deb9\r\n  go version: go1.22.5\n
\n

wait

\n

Wait for Tailscale resources to become available for binding within a specified timeout or indefinitely.

\n

The command returns exit code 0 on success. It returns a non-zero exit code on failure or timeout.

\n

As of Tailscale version 1.96, the only resource available to wait for is the Tailscale interface and its IPs. A future version of this command may support waiting for other types of resources.

\n

If running in userspace-networking mode, this command only waits for tailscaled and the Running state, as no physical network interface exists.

\n
tailscale wait [flags]\n
\n

Available flags:

\n
    \n
  • --timeout=<duration> Set a timeout duration in seconds. Setting the duration to 0 will set the timeout to indefinite.
    • \n
\n

Examples:

\n

To wait on a specific type of IP address, use tailscale ip in combination with the tailscale wait command. For example, to wait for an IPv4 address:

\n
tailscale wait && tailscale ip --assert=<specific-ip-address>\n
\n

Linux systemd users can wait for the tailscale-online.target target, which runs this command.

\n

A service that wants to bind to (listen on) a Tailscale interface or IP address, can use the following pattern to ensure Tailscale is ready before the program starts:

\n
tailscale wait && /path/to/service [...]\n
\n

web

\n

Start a web server for controlling the tailscaled daemon. Starting a web server is useful when the CLI or a native app is impractical (such as on NAS devices).

\n
tailscale web [flags]\n
\n

Available flags:

\n
    \n
  • --cgi=<true|false> Run the web server as a CGI script. Defaults to false.
    • \n
  • --listen=<ip|name> Set the listen address. Use port 0 for automatic. Defaults to localhost:8088.
    • \n
  • --origin=<hostname> Origin at which the web UI is served (if behind a reverse proxy or used with CGI).
    • \n
  • --prefix=<string> Set the URL prefix added to requests (for CGI or reverse proxies).
    • \n
  • --readonly Run the web server in read-only mode.
    • \n
\n

whois

\n

Get the machine and user associated with a Tailscale IP.

\n
tailscale whois ip[:port]\n
\n

For user devices, this command returns:

\n
Machine:\r\n  Name:\r\n  ID:\r\n  Addresses:\r\n  AllowedIPs:\r\nUser:\r\n  Name:\r\n  ID:\r\nCapabilities:\n
\n

For devices that are tagged, this command returns:

\n
Machine:\r\n  Name:\r\n  ID:\r\n  Addresses:\r\n  AllowedIPs:\r\n  Tags:\r\nCapabilities:\n
\n

For each of these fields:

\n
    \n
  • Machine, Name is the machine name of the device. If you use MagicDNS, you can also use this name to connect.
    • \n
  • Machine, ID is the node id of the device.
    • \n
  • Machine, Addresses are the Tailscale IP, which you can use to connect to the device.
    • \n
  • Machine, AllowedIPs are the subnet routes available to the device.
    • \n
  • Machine, Tags are the tags to which the device belongs.
    • \n
  • User, Name is the email address for the owner of the device.
    • \n
  • User, ID is the unique ID of the user
    • \n
  • Capabilities show the grants for the device.
    • \n
\n

Running tailscale whois with the --json flag will return a machine-readable JSON response. (Note that the --json option must come before the ip[:port] argument.)

\n
tailscale whois --json ip[:port]\n
\n

Available flags:

\n
    \n
  • --json Output in JSON format.
    • \n
  • --proto=<proto> Protocol for the WhoIs request; one of tcp or udp; empty mans both.
    • \n
\n

appc-routes

\n

Print the current app connector route status.

\n

By default this command prints the domains configured in the app connector\r\nconfiguration and how many routes have been learned for each domain.

\n
tailscale appc-routes [flags]\n
\n

Available flags:

\n
    \n
  • --all Print learned domains and routes and extra policy configured routes.
    • \n
  • --map Print the map of learned domains.
    • \n
  • --n Print the total number of routes this node advertises.
    • \n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}