Separate the control and data planes

Tailscale separates coordination from packet transport. This distinction explains both how the system works and what you trust Tailscale to manage.

The control plane

The control plane distributes identities, public keys, policies, routes, DNS settings, and endpoint information. It is the coordination service Tailscale runs. When your laptop joins, it tells the control plane “here is my public key, here are the endpoints where you can reach me”, and receives the same information about every peer it is allowed to see.

The coordination service does not sit in the normal data path or hold device private keys. Private keys are generated on each device and never leave it.

The data plane

The data plane runs on each device and carries WireGuard-encrypted packets. When you SSH from your laptop to a server, the packets flow between the two machines (or through a relay when a direct path fails). They do not pass through Tailscale’s servers as readable traffic.

You can watch the data plane at work:

tailscale ping lab-server

pong from lab-server (100.101.9.23) via 203.0.113.40:41641 in 12ms

That via 203.0.113.40:41641 is a direct UDP path between your two devices. The control plane helped them find each other, then stepped aside.

Why the split matters

If the coordination service becomes unreachable, existing connections keep working. Devices already hold each other’s keys and endpoints. What breaks is change: new devices cannot join, and policy updates stop propagating until it returns.

The split also defines your trust boundary. Tailscale can see which devices exist and which endpoints they use. It cannot read your traffic, because it never holds the private keys that would decrypt it.

Take a file transfer between two devices and label key distribution, policy distribution, encryption, packet transport, and decryption as control-plane or data-plane work. The first two belong to the control plane. Everything else happens on your own devices.