Back to column

Tailscale — selected stack

Tailscale Linux clients using WireGuard over UDP/IP on the routed Internet; Tailscale-managed coordination and an external identity provider for user enrollment. Tailnet Lock enabled with participant-controlled signing nodes; explicit restrictive network grants. Direct node-to-node payload paths with DERP/TLS relay fallback, ending at the two Tailscale nodes. Standard TUN client, not tsnet or userspace proxy mode. No Headscale, subnet/exit-node endpoint substitution, application TLS, content protocol or additional preshared post-quantum secret selected. Documentary profile, not a pinned runtime certification. F37/F38: explicitly selected optional router-local AQM and independently administered DiffServ domains on outer IP transport, classifying tunnel/DERP connection aggregates without inspecting encrypted inner traffic. No application QoS reservation or requirement to copy inner DSCP; not universal public-network deployment.

Official project website · Logo credits · Methodology and limits