Curriculum
Read the mesh in order.
Each module explains one layer three ways: an analogy, the mechanism, and the failure modes. Then it shows the layer on the wire and ends with scenario questions that have real answers. Modules publish in numbered order; the list below shows exactly what exists today.
Live now
- 00 The shape of Tailscale What Tailscale actually is, a WireGuard mesh data plane coordinated by a centralized control plane, and the mental model every later module builds on.
- 01 WireGuard foundations How WireGuard actually works at the layer Tailscale builds on, and the three problems it deliberately leaves unsolved.
- 02 The control plane How the Tailscale coordination server registers nodes, distributes keys and policy, and what freezes when it goes away.
- 03 NAT traversal, STUN, DERP, and Peer Relays How two Tailscale nodes behind NATs find each other, punch through, relay when they cannot, and upgrade the moment they can.
- 04 Identity and auth How users, devices, and workloads prove who they are in a tailnet, from SSO delegation through auth keys, tags, OAuth clients, and workload identity federation.
- 05 Policy: ACLs and grants How the tailnet policy file works, from HuJSON and legacy ACLs through grants, autogroups, tags, SSH rules, posture, and the tests that gate every save.
- 06 MagicDNS and split DNS How Tailscale's Quad100 resolver, MagicDNS names, per-platform OS resolver rewiring, split DNS, and exit node DNS behavior actually work, and how they fail.
- 07 Routing How a tailnet reaches networks and destinations that cannot run Tailscale, through subnet routers, exit nodes, site-to-site links, 4via6, and app connectors.
- 08 Exposing services How to publish services on and beyond your tailnet with serve, Funnel, HTTPS certificates, Tailscale Services, and tsnet, and how to choose between them.
- 09 The platform matrix Where Tailscale runs, what is identical on every platform, and what each operating system decides differently.
- 10 Enterprise operations How to run a tailnet at organization scale, covering admin surfaces, audit and flow logging, SCIM, roles, device approval, Tailnet Lock, GitOps for the policy file, and the Aperture AI gateway.
- 11 Troubleshooting and observability How to read tailscale status, ping, netcheck, bugreport, client logs, and metrics, and a symptom-driven playbook for the six ways a tailnet visibly breaks.
- 12 The codebase A guided tour of the tailscale/tailscale repository for engineers who want to read the source, follow a packet or a login through the code, and build it themselves.