{"slug":"tailscale-up-command","title":"tailscale up command","tags":["tailscale"],"agent_summary":"Last validated: Jan 26, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# tailscale up command\r\n\r\nLast validated: Jan 26, 2026\r\n\r\n`tailscale up` connects your device to Tailscale, and authenticates if needed.\r\n\r\n```shell\r\ntailscale up [flags]\r\n```\r\n\r\nRunning `tailscale up` without any flags connects to Tailscale.\r\n\r\nYou can specify flags to configure Tailscale's behavior. Flags are not persisted between runs; you must specify all flags each time.\r\n\r\nTo clear previously set flags like tags and routes, pass the flag with an empty argument:\r\n\r\n```shell\r\n# Connects with `tag:server`\r\ntailscale up --advertise-tags=tag:server\r\n\r\n# Connects and clears any tags\r\ntailscale up --advertise-tags=\r\n```\r\n\r\nIn Tailscale v1.8 or later, if you forget to specify a flag you added before, the CLI will warn you and provide a copyable command that includes all existing flags.\r\n\r\nAvailable flags:\r\n\r\n- `--accept-dns` Accept [DNS configuration](https://tailscale.com/docs/reference/dns-in-tailscale) from the admin console. Defaults to accepting DNS settings.\r\n- `--accept-risk=` Accept risk and skip confirmation for risk type. This can be either `lose-ssh` or `all`, or an empty string to not accept risk.\r\n- `--accept-routes` Accept [subnet routes](https://tailscale.com/docs/features/subnet-routers) that other nodes\r\nadvertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.\r\n- `--advertise-connector` Advertise this node as an [app connector](https://tailscale.com/docs/features/app-connectors).\r\n- `--advertise-exit-node` Offer to be an [exit node](https://tailscale.com/docs/features/exit-nodes) for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.\r\n- `--advertise-routes=` Expose physical [subnet routes](https://tailscale.com/docs/features/subnet-routers) to your entire\r\nTailscale network.\r\n- `--advertise-tags=` Give tagged permissions to this device. You\r\nmust be [listed in `\"TagOwners\"`](https://tailscale.com/docs/reference/syntax/policy-file#tag-owners) to be able to apply\r\ntags.\r\n- `--auth-key=` Provide an [auth key](https://tailscale.com/docs/features/access-control/auth-keys) to\r\nautomatically authenticate the node as your user account.\r\n- `--client-id` Client ID used to generate [auth keys](https://tailscale.com/docs/features/access-control/auth-keys) by using\r\n[workload identity federation](https://tailscale.com/docs/features/workload-identity-federation).\r\n- `--client-secret` [OAuth Client](https://tailscale.com/docs/features/oauth-clients) secret used to generate\r\n[auth keys](https://tailscale.com/docs/features/access-control/auth-keys); if it begins with `file:`, then it's a path to a\r\nfile containing the secret.\r\n- `--exit-node=` Provide a [Tailscale IP](https://tailscale.com/docs/concepts/ip-and-dns-addresses) or [machine name](https://tailscale.com/docs/concepts/machine-names) to use as an exit node. You can also use `--exit-node=auto:any` to track the suggested exit node and automatically switch to it when available exit nodes or network conditions change. To disable the use of an exit node, pass the flag with an empty argument using `--exit-node=`.\r\n- `--exit-node-allow-lan-access` Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.\r\n- `--force-reauth` Force re-authentication.\r\n- `--hostname=` Provide a hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in [MagicDNS](https://tailscale.com/docs/features/magicdns).\r\n- `--id-token` ID token from the identity provider to exchange with the control\r\nserver for [workload identity federation](https://tailscale.com/docs/features/workload-identity-federation); if it begins\r\nwith `file:`, then it's a path to a file containing the token.\r\n- `--audience` Audience used when requesting an ID token from an identity provider for auth keys generated by [workload identity federation](https://tailscale.com/docs/features/workload-identity-federation).\r\n- `--json` Output in JSON format. Format is subject to change.\r\n- `--login-server=` Provide the base URL of a control server instead of `https://controlplane.tailscale.com`.\r\nIf you are using [Headscale](https://tailscale.com/blog/opensource#the-open-source-coordination-server) for your control server, use your Headscale instance's URL.\r\n- `--netfilter-mode` (Linux only) Advanced feature for controlling the degree of automatic firewall configuration.\r\nValues are either `off`, `nodivert`, or `on`. Defaults to `on`, except for Synology which defaults to `off`. Setting this flag\r\nto `off` disables all management of `netfilter`. Setting to `nodivert` creates and manages Tailscale sub-chains, but leaves the calling of those\r\nchains up to the administrator. Setting to `on` means using full management of Tailscale's rules. Note that if you set `--netfilter-mode` to `off`\r\nor `nodivert`, it is your responsibility to configure the firewall securely for Tailscale traffic. We recommend using the rules installed by\r\n`--netfilter-mode=on` as a starting point. Refer to [netfilter modes](https://tailscale.com/docs/reference/netfilter-modes) for more information.\r\n- `--operator=` Provide a Unix username other than `root` to operate `tailscaled`.\r\n- `--qr` Generate a QR code for the web login URL. Defaults to not showing a QR code.\r\n- `--qr-format=` QR code formatting: `small` or `large`. Defaults to `small`.\r\n- `--reset` Reset unspecified settings to default values.\r\n- `--shields-up` [Block incoming connections](https://tailscale.com/docs/features/client/manage-preferences)\r\nfrom other devices on your Tailscale network. Useful for personal devices\r\nthat only make outgoing connections.\r\n- `--snat-subnet-routes` (Linux only) Source NAT traffic to local routes that are advertised with `--advertise-routes`. Defaults to sourcing the NAT\r\ntraffic to the advertised routes. Set to false to disable subnet route masquerading.\r\n- `--stateful-filtering` (Linux only) Enable stateful filtering for subnet\r\nrouters and exit nodes. When enabled, inbound packets with another node's\r\ndestination IP are dropped, unless they are a part of a tracked outbound\r\nconnection from that node. Defaults to disabled.\r\n- `--ssh` Run a [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) server, permitting access per the tailnet administrator's declared\r\n[access policy](https://tailscale.com/docs/features/access-control/acls), or the [default policy](https://tailscale.com/docs/reference/examples/acls#allow-all-default-acl) if none is\r\ndefined. Defaults to false.\r\n- `--timeout=` Maximum amount of time to wait for the Tailscale service to initialize. `duration` can be any value parseable by [`time.ParseDuration()`](https://pkg.go.dev/time#ParseDuration). Defaults to `0s`, which blocks forever.\r\n- `--unattended`(Windows only) Run in [unattended mode](https://tailscale.com/docs/how-to/run-unattended) where Tailscale keeps running even after the current user logs out.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

tailscale up command

\n

Last validated: Jan 26, 2026

\n

tailscale up connects your device to Tailscale, and authenticates if needed.

\n
tailscale up [flags]\n
\n

Running tailscale up without any flags connects to Tailscale.

\n

You can specify flags to configure Tailscale's behavior. Flags are not persisted between runs; you must specify all flags each time.

\n

To clear previously set flags like tags and routes, pass the flag with an empty argument:

\n
# Connects with `tag:server`\r\ntailscale up --advertise-tags=tag:server\r\n\r\n# Connects and clears any tags\r\ntailscale up --advertise-tags=\n
\n

In Tailscale v1.8 or later, if you forget to specify a flag you added before, the CLI will warn you and provide a copyable command that includes all existing flags.

\n

Available flags:

\n
    \n
  • --accept-dns Accept DNS configuration from the admin console. Defaults to accepting DNS settings.
    • \n
  • --accept-risk=<risk> Accept risk and skip confirmation for risk type. This can be either lose-ssh or all, or an empty string to not accept risk.
    • \n
  • --accept-routes Accept subnet routes that other nodes\r\nadvertise. The default depends on the host operating system. For certain platforms - Windows, iOS, Android, the macOS App Store variant, and the macOS standalone variant - the default is to accept routes. All other platforms default to not accepting routes.
    • \n
  • --advertise-connector Advertise this node as an app connector.
    • \n
  • --advertise-exit-node Offer to be an exit node for outbound internet traffic from the Tailscale network. Defaults to not offering to be an exit node.
    • \n
  • --advertise-routes=<ip> Expose physical subnet routes to your entire\r\nTailscale network.
    • \n
  • --advertise-tags=<tags> Give tagged permissions to this device. You\r\nmust be listed in \"TagOwners\" to be able to apply\r\ntags.
    • \n
  • --auth-key=<key> Provide an auth key to\r\nautomatically authenticate the node as your user account.
    • \n
  • --client-id Client ID used to generate auth keys by using\r\nworkload identity federation.
    • \n
  • --client-secret OAuth Client secret used to generate\r\nauth keys; if it begins with file:, then it's a path to a\r\nfile containing the secret.
    • \n
  • --exit-node=<ip|name> Provide a Tailscale IP or machine name to use as an exit node. You can also use --exit-node=auto:any to track the suggested exit node and automatically switch to it when available exit nodes or network conditions change. To disable the use of an exit node, pass the flag with an empty argument using --exit-node=.
    • \n
  • --exit-node-allow-lan-access Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node.
    • \n
  • --force-reauth Force re-authentication.
    • \n
  • --hostname=<name> Provide a hostname to use for the device instead of the one provided by the OS. Note that this will change the machine name used in MagicDNS.
    • \n
  • --id-token ID token from the identity provider to exchange with the control\r\nserver for workload identity federation; if it begins\r\nwith file:, then it's a path to a file containing the token.
    • \n
  • --audience Audience used when requesting an ID token from an identity provider for auth keys generated by workload identity federation.
    • \n
  • --json Output in JSON format. Format is subject to change.
    • \n
  • --login-server=<url> Provide the base URL of a control server instead of https://controlplane.tailscale.com.\r\nIf you are using Headscale for your control server, use your Headscale instance's URL.
    • \n
  • --netfilter-mode (Linux only) Advanced feature for controlling the degree of automatic firewall configuration.\r\nValues are either off, nodivert, or on. Defaults to on, except for Synology which defaults to off. Setting this flag\r\nto off disables all management of netfilter. Setting to nodivert creates and manages Tailscale sub-chains, but leaves the calling of those\r\nchains up to the administrator. Setting to on means using full management of Tailscale's rules. Note that if you set --netfilter-mode to off\r\nor nodivert, it is your responsibility to configure the firewall securely for Tailscale traffic. We recommend using the rules installed by\r\n--netfilter-mode=on as a starting point. Refer to netfilter modes for more information.
    • \n
  • --operator=<user> Provide a Unix username other than root to operate tailscaled.
    • \n
  • --qr Generate a QR code for the web login URL. Defaults to not showing a QR code.
    • \n
  • --qr-format=<format> QR code formatting: small or large. Defaults to small.
    • \n
  • --reset Reset unspecified settings to default values.
    • \n
  • --shields-up Block incoming connections\r\nfrom other devices on your Tailscale network. Useful for personal devices\r\nthat only make outgoing connections.
    • \n
  • --snat-subnet-routes (Linux only) Source NAT traffic to local routes that are advertised with --advertise-routes. Defaults to sourcing the NAT\r\ntraffic to the advertised routes. Set to false to disable subnet route masquerading.
    • \n
  • --stateful-filtering (Linux only) Enable stateful filtering for subnet\r\nrouters and exit nodes. When enabled, inbound packets with another node's\r\ndestination IP are dropped, unless they are a part of a tracked outbound\r\nconnection from that node. Defaults to disabled.
    • \n
  • --ssh Run a Tailscale SSH server, permitting access per the tailnet administrator's declared\r\naccess policy, or the default policy if none is\r\ndefined. Defaults to false.
    • \n
  • --timeout=<duration> Maximum amount of time to wait for the Tailscale service to initialize. duration can be any value parseable by time.ParseDuration(). Defaults to 0s, which blocks forever.
    • \n
  • --unattended(Windows only) Run in unattended mode where Tailscale keeps running even after the current user logs out.
    • \n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}