# Tailscale

> The zero-config mesh VPN built on WireGuard: how it works, subnet routers, exit nodes, MagicDNS, app connectors, ACLs and grants, identity/SSO, device and user management, the CLI and API, and the security model.
> Covers: Tailscale (zero-config mesh VPN on WireGuard): how it works (coordination server, WireGuard data plane, STUN/DERP NAT traversal), the tailnet and 100.x addressing, install and the CLI, subnet routers, exit nodes, MagicDNS, app connectors, the tailnet policy file (ACLs and grants), device tags/key-expiry/Tailnet-Lock, identity/SSO and user/org management, the API and auth keys, and the security model with firewall ports - with verbatim CLI flags and policy syntax.
> Not covered: Step-by-step use-case tutorials (hosting a specific app, game servers, etc.); detailed commercial pricing tiers; client source-level internals; and vendor-specific integrations beyond how they connect. For those, see tailscale.com/kb or the integration's own docs.
> Current as of: 2026-07-07

- [LLM Wiki](/raw/tailscale/README.md)
- [Tailscale Knowledge Base — Index](/raw/tailscale/wiki/index.md)
- [Access Controls (Tailnet Policy File, ACLs, and Grants)](/raw/tailscale/wiki/concepts/access-controls.md)
- [Tailscale API, automation, and logging](/raw/tailscale/wiki/concepts/api-and-automation.md)
- [App connectors](/raw/tailscale/wiki/concepts/app-connectors.md)
- [CLI Reference](/raw/tailscale/wiki/concepts/cli-reference.md)
- [Device Management (Tags, Key Expiry, Tailnet Lock)](/raw/tailscale/wiki/concepts/device-management.md)
- [Exit nodes](/raw/tailscale/wiki/concepts/exit-nodes.md)
- [How Tailscale Works](/raw/tailscale/wiki/concepts/how-tailscale-works.md)
- [Identity and SSO](/raw/tailscale/wiki/concepts/identity-and-sso.md)
- [Install and First Use](/raw/tailscale/wiki/concepts/install-and-first-use.md)
- [MagicDNS and DNS](/raw/tailscale/wiki/concepts/magicdns-and-dns.md)
- [Tailscale security and trust model](/raw/tailscale/wiki/concepts/security-model.md)
- [Subnet routers](/raw/tailscale/wiki/concepts/subnet-routers.md)
- [Tailnet and Addressing](/raw/tailscale/wiki/concepts/tailnet-and-addressing.md)
- [Users and Organization](/raw/tailscale/wiki/concepts/users-and-organization.md)
- [What is Tailscale?](/raw/tailscale/wiki/concepts/what-is-tailscale.md)
- [Activity Log](/raw/tailscale/wiki/log.md)
- [ACLs vs. grants in the tailnet policy file](/raw/tailscale/wiki/syntheses/acls-vs-grants.md)
- [Routing mechanisms compared: subnet routers vs. exit nodes vs. app connectors](/raw/tailscale/wiki/syntheses/routing-mechanisms-compared.md)
- [Tailscale vs. a traditional VPN](/raw/tailscale/wiki/syntheses/tailscale-vs-vpn.md)