![\"Project](\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\")
Last validated: Jan 12, 2026
\nAn access control list (ACL) manages system access using rules in the tailnet policy file. You can use ACLs to filter traffic and enhance security by managing who and what can use which resources.
\nA tag lets you assign an identity (that's separate from human users) to devices. You can use tags in your access rules to restrict access.
\nThe admin console is the central location to manage your Tailscale network (known as a tailnet). You can manage devices on your network, users and their permissions, and settings such as key expiry. The admin console also informs you if an update to the Tailscale client is available for your device. When you make changes from the admin console, the coordination server updates the changes to your tailnet immediately.
\nYou can access the admin console at admin console.
\nAPI is an acronym for application programming interface. APIs define a set of rules to interact with an application or service programmatically. The Tailscale API lets you manage your Tailscale account and tailnet.
\nCLI is an acronym for command line interface. The Tailscale CLI includes a robust set of commands with functionality that GUI applications might not have. The Tailscale CLI is installed automatically when you install Tailscale on Linux, macOS, or Windows.
\nThe Tailscale client is a software application that runs on a device so the device can join and participate in a tailnet. The client uses the WireGuard protocol to create encrypted peer-to-peer connections. The client is available for multiple operating systems. Much of the client code is open source.
\nA coordination server is a central server that maintains a connection to all devices in your Tailscale network. It manages encryption keys, network changes, access policy changes, and maintains a connection to all devices in your Tailscale network. The coordination server is part of the control plane, not the data plane. It avoids being a performance bottleneck by not relaying traffic between devices.
\nA device is anything other than a user. It can be physical or virtual and sends, receives, or processes data on your Tailscale network.
\nA device key is a unique public and private key pair for a specific device. More than one user can use a device key, but each device can only have one device key. The combination of a specific user with a device key represents a unique device.
\nA firewall limits what network traffic can pass between two points. Firewalls can be hardware-based or software-based. Tailscale includes a built-in firewall, defined by the domain's access rules.
\nWith a traditional virtual private network (VPN), full tunnel describes a configuration where all traffic from a client is sent through the VPN, including internet-bound traffic. With Tailscale, you can route all internet-bound traffic by setting a device on your network as an exit node. If your clients are configured to use an exit node and also have routes or connectivity to other Tailscale devices, subnet routers, or app connectors, then Tailscale will still operate as a split tunnel VPN, routing traffic directly to each endpoint without routing traffic through the exit node first.
\nAn identity provider is a method for users to authenticate to a tailnet. Examples of identity providers include Google, Okta, and Microsoft. Tailscale is not an identity provider but relies other identity providers for authentication.
\nKey expiry is the end of the validity period for a cryptographic key. An expired key can no longer encrypt or decrypt data, nor authenticate a device to a Tailscale network.
\nUsing Tailscale means you never have to manage encryption keys directly. Tailscale automatically expires keys and requires them to be regenerated at regular intervals. You can disable key expiry for long-lived devices from the admin console.
\nMagicDNS automatically registers memorable hostnames for devices in your Tailscale network. It also extends and improves DNS functionality.
\nNAT is an acronym for network address translation. NAT traversal is a way to connect devices across the internet through barriers such as firewalls. Most internet devices can't talk to each other because of firewalls and devices that do network address translation. NAT traversal works around these barriers, allowing data to traverse the network.
\nA network topology is an arrangement of devices in a network. It shows the connections between them. Examples of network topologies include star, bus, hub-and-spoke, mesh, and hybrid.
\nTraditional virtual private networks (VPNs) use a hub-and-spoke topology. Each device communicates with another in this setup by sending all traffic through a central gateway device. Tailscale operates as a mesh topology where each device can talk directly to others using NAT traversal.
\nA node is a combination of a user and a device.
\nAn overlay network is a virtual network built on top of the underlay network, where nodes communicate using logical addresses and encrypted tunnels independent of the underlay's addressing or topology. Tailscale forms an overlay network (the tailnet) that gives each node a stable identity and IP address, regardless of how the underlay changes.
\nA peer is another node that your device is trying to talk to. A peer might or might not be in the same domain.
\nA relay is an intermediary server that passes data between two or more devices in a network. Tailscale uses a special type of globally distributed relay server called Designated Encrypted Relay for Packets (DERP). DERP relay servers function as a fallback to connect devices when NAT traversal fails.
\nSplit tunnel, as opposed to full tunnel, describes a VPN configuration where only some traffic (specific IP ranges, domains, or subnets) is sent through the VPN, while all other traffic goes directly to the internet by using the device's local internet gateway. In Tailscale, this means only traffic destined for other Tailscale devices, subnet routers, or app connectors uses the tailnet, leaving general internet traffic untouched.
\nSSO is an acronym for single sign-on. Single sign-on lets users log in to one site using the identity of another.
\nA tailnet is another term for a Tailscale network, which is an interconnected collection of users, devices, and resources. The network has a control plane and a data plane that work in unison to manage access and send data between devices.
\nThere are personal and organization tailnets. A personal tailnet is a shared domain single-user tailnet (like gmail.com). An organization tailnet is a custom domain tailnet (like example.com),
The tailnet policy file stores your Tailscale network's access rules, along with other tailnet configuration items. It uses human JSON (HuJSON) and conforms to the Tailscale policy syntax.
\nA Tailscalar is a Tailscale employee.
\nA Tailscale IP address is a unique IP address assigned to each device in your Tailscale network. It's always in the form 100.x.y.z (for example, 100.100.123.123). It stays the same even when switching between your home internet connection, cellular networks, or coffee shop Wi-Fi networks.
In networking, a tunnel is an encapsulated connection between one or more points in a network. It lets users, devices, or resources communicate securely over a public data network.
\nAn underlay network is the physical or existing IP network over which Tailscale runs, such as your home Wi-Fi, office LAN, or your cloud or data center's internet connection. Tailscale uses this underlay for actual packet transport, creating an overlay network on top of the underlay that handles encryption, NAT traversal, access controls, and many more features.
\nWireGuard is the underlying cryptographic protocol that Tailscale uses.
\nAsk AI
\nreCAPTCHA
\nRecaptcha requires verification.
\nprotected by reCAPTCHA
\n"}