How Tailscale works: peer-to-peer connections and mesh networking

Traditional VPNs use a hub-and-spoke model: all devices connect to a central VPN gateway. For devices to communicate, traffic travels to the server and turns back. The gateway becomes both a bottleneck and a single point of failure—if it slows down or goes offline, all connections suffer.

Tailscale creates a mesh network: direct tunnels connect pairs of devices. When your phone accesses your home NAS, data flows straight from phone to NAS over the shortest path available, without a central server carrying the payload.

The trade-off of a mesh architecture is management complexity: interconnecting ten devices requires forty-five separate tunnels, each demanding key exchanges and endpoint tracking. Tailscale's core purpose is automating this coordination.

Each device running Tailscale generates a local public/private keypair. The private key never leaves the device, while the public key is registered with the coordination server upon authentication.

The coordination server maintains a global directory: public keys, assigned 100.x.y.z internal addresses, current observed network endpoints, and access control lists. It distributes relevant routing rows to authorised peers, updating them instantly as devices join, leave, or roam across networks.

The coordination server never relays data packets and cannot decrypt communications without private keys. It acts like a concierge issuing directories and badge permissions, completely absent from the conversations that follow.

Authentication integrates with your existing identity provider (SSO) rather than maintaining separate VPN credentials. Node keys rotate periodically, and retired devices can be revoked instantly from the administrative console.

Actual data transfer relies on WireGuard. Once devices exchange public keys through the coordination server, they establish an encrypted tunnel mutually authenticating each peer, immune to interception or tampering along the transit path.

Tailscale retains WireGuard's cryptographic foundations intact, focusing entirely on orchestration: key distribution, address assignment, and dynamic peer discovery across changing network environments. For protocol fundamentals, see WireGuard Explained: Architecture and Evolution.

Each node receives a permanent CGNAT IPv4 address (in the 100.64.0.0/10 range) that remains identical whether connecting over home broadband, office Wi‑Fi, or mobile cellular data. Combined with MagicDNS, nodes can be addressed by human-readable hostnames.

Most devices lack public IP addresses and sit behind Network Address Translation (NAT) gateways. Firewalls permit outbound sessions initiated from within while dropping unsolicited inbound packets from the internet. When two devices both sit behind separate firewalls, neither can initiate an inbound connection to the other.

Tailscale resolves this in three stages. First, nodes query public STUN servers to discover their public-facing IP and port mappings. Second, nodes exchange these observed endpoints via the coordination server. Third, both nodes transmit UDP packets toward each other's public endpoints simultaneously: firewalls recognise outbound traffic, open temporary return states, and allow matching incoming packets to pass through—a technique known as NAT hole punching.

Hole punching uses UDP and succeeds across most consumer routers. However, symmetric NAT architectures (allocating different external ports per destination) or strict enterprise firewalls blocking UDP will prevent direct traversal.

Because direct traversal cannot be guaranteed across all networks, Tailscale operates distributed relay servers called DERP (Designated Encrypted Relay for Packets). When peers fail to establish direct paths, both connect to a nearby DERP server, which forwards encrypted packets between them over TCP port 443 (HTTPS).

Relays handle packets already encrypted by WireGuard. Without private keys, DERP nodes can inspect only packet headers (sender, receiver, and size), leaving payload contents entirely confidential.

Connections start via DERP immediately upon node discovery to establish zero-delay reachability, while background routines attempt hole punching. Once a direct peer-to-peer path succeeds, traffic transitions seamlessly without dropping active connections. This explains why initial latency briefly spikes before settling.

Nodes remaining on relay transport experience throughput and latency dictated by DERP geographic proximity and load, performing slower than direct connections. Tailscale CLI and clients display connection status as either direct or relay.

• Exit nodes: designate a specific node to route all internet-bound traffic from other devices through its connection, functioning like a conventional VPN gateway with the exit node's public IP address.
• Subnet routers: configure a node to act as an internal gateway for its entire local area network, providing remote access to legacy equipment like printers, IP cameras, or storage arrays that cannot run Tailscale directly.
• Access Control Lists (ACLs): security policies managed from the coordination console enforcing granular connectivity rules between specific users, groups, tags, and ports.
• MagicDNS: provides automatic local DNS resolution so devices can be reached via clean hostnames instead of numeric 100.x addresses.

• Compared to WireGuard: WireGuard is a point-to-point tunnel protocol requiring manual key generation and static endpoint configuration; Tailscale is an automated networking system built on top of WireGuard managing authentication, key exchanges, IP management, and NAT traversal.
• Compared to traditional VPNs: traditional VPNs focus on routing all client traffic through a central gateway to mask public egress; Tailscale prioritises seamless peer-to-peer interconnectivity, with public egress serving as an optional feature (exit nodes).
• Compared to port forwarding or dynamic DNS: port forwarding exposes internal services to the public internet where anyone can probe them; Tailscale exposes zero public ports, admitting only authenticated devices within your private tailnet.
• Compared to ZeroTier: both build overlay virtual networks; ZeroTier emulates a Layer 2 Ethernet switch using custom protocols, whereas Tailscale operates at Layer 3 using WireGuard.

While Tailscale's client software is open source, its official coordination backend is operated as a proprietary SaaS. Headscale is an open-source, community-developed implementation of the Tailscale coordination protocol, allowing self-hosted deployments.

The official client includes options to specify an alternate server URL, redirecting connection requests from Tailscale's cloud infrastructure to your private Headscale instance.

Self-hosting places device inventories, public keys, and routing ACLs under complete administrative sovereignty, unconstrained by external account limits or pricing tiers.

• NAT traversal depends heavily on UDP. Carrier-grade NAT (CGNAT) and aggressive enterprise firewalls increase reliance on DERP relays.
• Relay throughput reflects geographic distance: using distant relays increases latency noticeably.
• Standard WireGuard packet structures carry fixed cryptographic signatures without protocol obfuscation, making them identifiable to deep packet inspection firewalls looking for uncamouflaged UDP streams.
• Mobile battery impact is negligible: idle tunnels transmit no packets, and active sessions recover automatically when transitioning between cellular and Wi‑Fi.

The LeoTun Private Network integrates official Tailscale client applications connected to our managed coordination servers: authenticate once with your account, and your devices stay persistently connected. We maintain regional exit nodes selectable directly from the client's Exit Node menu without importing configuration files, while your laptops, phones, and home servers communicate directly.

Because devices register with our managed control servers, device limits follow your membership tier rather than third-party SaaS quotas. If you previously connected to Tailscale's public cloud, log out before authenticating with our server. Step-by-step installation guides are in What the Private Network (Tailscale) Is, accessible from the Private Network page.

When visiting networks that block UDP where the Private Network degrades, switch your account to alternative protocols such as Cisco AnyConnect or Traffic Camouflage as outlined in Which Connection Method Fits Your Needs.