Meet the tailnet

A tailnet is the private network Tailscale creates for an account or organization. Authenticating a new device adds it to that network.

Think of it as one flat private network that follows your identity, not a place. Your laptop at home, your phone on mobile data, and a server in a datacenter all sit on the same tailnet.

What every device gets

Each device receives stable Tailscale IPv4 and IPv6 addresses plus a private DNS name. The IPv4 address comes from the 100.64.0.0/10 range, so it never collides with your home or office network.

tailscale status

100.87.12.44   flavio-mbp    flavio@   macOS   -
100.101.9.23   lab-server    flavio@   linux   active; direct 203.0.113.40:41641
100.114.3.7    pixel-9       flavio@   android offline

Those addresses do not change when the device moves between networks. That stability is what makes it safe to put them in SSH configs and connection strings.

Users, devices, and services

Users come from an identity provider, while tagged devices represent services. A laptop belongs to a person. A production server should not: you tag it (for example tag:server) so its identity describes its role, not whoever happened to install it.

The admin console coordinates membership, DNS, routes, and access policy for the whole tailnet. It is the one place where you see every device, who owns it, and when it was last seen.

What stays outside

A tailnet is private by definition. Visitors to your public website never touch it. Only enrolled devices participate, and later lessons decide what each of them may reach.

List the people, laptops, phones, servers, and private services that belong in a small practice tailnet. Leave public website visitors outside it. That list becomes your enrollment plan for the next lessons: each entry is either a person who logs in or a service that gets a tag.