tailscale
CLI Tooltailscale/tailscale
The easiest, most secure way to use WireGuard and 2FA to create private networks.
Overview
Tailscale provides a zero-configuration VPN solution built on WireGuard, with integrated 2FA and SSO support. The open-source repo includes the daemon and CLI tool for Linux, Windows, and macOS. It enables secure peer-to-peer connections without complex firewall configuration.
README Preview
# Tailscale\n\nhttps://tailscale.com\n\nPrivate WireGuard® networks made easy\n\n## Overview\n\nThis repository contains the majority of Tailscale's open source code.\nNotably, it includes the `tailscaled` daemon and\nthe `tailscale` CLI tool. The `tailscaled` daemon runs on Linux, Windows,\n[macOS](https://tailscale.com/kb/1065/macos-variants/), and to varying degrees\non FreeBSD and OpenBSD. The Tailscale iOS and Android apps use this repo's\ncode, but this repo doesn't contain the mobile GUI code.\n\nOther [Tailscale repos](https://github.com/orgs/tailscale/repositories) of note:\n\n* the Android app is at https://github.com/tailscale/tailscale-android\n* the Synology package is at https://github.com/tailscale/tailscale-synology\n* the QNAP package is at https://github.com/tailscale/tailscale-qpkg\n* the Chocolatey packaging is at https://github.com/tailscale/tailscale-chocolatey\n\nFor background on which parts of Tailscale are open source and why,\nsee [https://tailscale.com/opensource/](https://tailscale.com/opensource/).\n\n## Using\n\nWe serve packages for a variety of distros and platforms at\n[https://pkgs.tailscale.com](https://pkgs.tailscale.com/).\n\n## Other clients\n\nThe [macOS, iOS, and Windows clients](https://tailscale.com/download)\nuse the code in this repository but additionally include small GUI\nwrappers. The GUI wrappers on non-open source platforms are themselves\nnot open source.\n\n## Building\n\nWe always require the latest Go release, currently Go 1.26. (While we build\nreleases with our [Go fork](https://github.com/tailscale/go/), its use is not\nrequired.)\n\n```\ngo install tailscale.com/cmd/tailscale{,d}\n```\n\nIf you're packaging Tailscale for distribution, use `build_dist.sh`\ninstead, to burn commit IDs and version info into the binaries:\n\n```\n./build_dist.sh tailscale.com/cmd/tailscale\n./build_dist.sh tailscale.com/cmd/tailscaled\n```\n\nIf your distro has conventions that preclude the use of\n`build_dist.sh`, please do theFAQ (5)
TroubleshootingHow to fix DNS resolution failure when using Tailscale Android split tunneling allowlist mode?
Root cause: When Tailscale for Android runs split tunneling in allowlist (include) mode, the Tailscale app itself was not automatically added to the allowed list, so the Tailscale process is excluded from the VPN. This means permitted apps cannot reach Tailscale's DNS resolver even when subnet routing works normally. The old documentation stating allowlist mode requires MDM is outdated: the feature no longer has MDM restrictions. The issue affects Tailscale v1.98.8 on Android 17 and other supported Android versions.
Solutions:
1. Immediate temporary workaround: Switch split tunneling back to the default blocklist mode, and block all apps except the exact set you allowed in allowlist mode. DNS resolution will be restored immediately.
2. Permanent fix: The official patch is included in unstable builds available at https://pkgs.tailscale.com/unstable/. Upgrade to this unstable build to resolve the issue, or wait for an upcoming stable release that includes the fix.
TroubleshootingWhy does bare 'tailscale up' hang and never return when the node is already Running with advertised tags?
This is a known bug in Tailscale 1.102.5 (Linux): when a node is already in Running state and has AdvertiseTags set, bare tailscale up blocks forever and eventually dies with context canceled (e.g., exit 124 under timeout). The node stays online and functional; only the CLI hangs. Workarounds:
1. Check state before running the command and skip it if already up:
if [ "$(tailscale status --json --peers=false | jq -r .BackendState)" != "Running" ]; then
sudo tailscale up
fi2. If you must run tailscale up (e.g., to recover state), pass the complete set of non-default flags including your tags, and wrap it in a timeout:
timeout 30 sudo tailscale up --advertise-tags=tag:your-tag --ssh --accept-routesRepeating
up with the full existing flags returns immediately because the CLI detects no tag change and takes the fast edit-and-return path.
Root cause: bare up is treated as 'simpleUp' with no tag flags, so the CLI sees tags as changed, disables the quick justEdit return path, and then waits for an IPN Running notification that never fires because tailscaled performs no state transition (WantRunning is already true). Untagged nodes are unaffected and return immediately.
TroubleshootingHow to fix 'Error 401 - bad tailscale-authstate2 cookie' when opening Tailscale Admin Console from the macOS app in Safari?
This error occurs when clicking the Admin Console button in the Tailscale macOS menu bar app while using Apple SSO in Safari. The app opens controlplane.tailscale.com/login, which sets the tailscale-authstate2 cookie on that subdomain, but Apple's OAuth redirects back to login.tailscale.com — Safari's strict cookie scoping doesn't send the cookie across subdomains, causing the 401 error (Chrome works due to its Lax+POST relaxation window).
**Workaround:** Navigate directly to https://login.tailscale.com/admin in your browser instead of using the app's Admin Console button. Since login and cookie stay on the same domain as the OAuth redirect_uri, Apple SSO succeeds.
**Permanent fix (requires Tailscale server-side change):** Either set Domain=.tailscale.com on the tailscale-authstate2 cookie, or update the macOS app to open https://login.tailscale.com/admin directly.
TroubleshootingHow to fix broken DNS when using a Mullvad exit node after Mullvad's public DNS shutdown (194.242.2.2 stops working)?
Mullvad is shutting down its public encrypted DNS servers, and 194.242.2.2 (the resolver advertised for Mullvad exit nodes since 2023) stops answering on 2026-11-02, breaking DNS for exit node users. Fix: update to the release that advertises Mullvad's in-tunnel resolver 10.64.0.1 for Mullvad exit nodes instead of 194.242.2.2 — this resolver works inside the tunnel and is unaffected by the shutdown. Manual workaround: override the exit node DNS configuration to use 10.64.0.1 (only reachable through the Mullvad tunnel). If you used Mullvad's public DNS outside the tunnel, switch to Quad9 (9.9.9.9), which Mullvad officially recommends and now sponsors.
TroubleshootingHow do I fix golang.org/x/net vulnerability alerts when building a Go project with security scanners?
Upgrade golang.org/x/net from v0.59.0 to v0.60.0 and use the Go 1.27.2 toolchain. Run:
go get golang.org/x/net@v0.60.0
go mod tidyFor Tailscale, also update go.toolchain.rev to the Go 1.27.2 toolchain commit (186053ab2af2ef8fc43f3c1d1150216e89d4aff0), then rebuild and rescan. This clears scanner findings even if the vulnerable code path is not used at runtime.