--- title: "🔍 Tailscale — Identity-Based Connectivity Platform (WireGuard Mesh VPN) (en)" description: "Tailscale is an identity-based connectivity platform that builds a peer-to-peer WireGuard mesh to replace traditional VPNs." url: "https://aaronchan.com/kb/tailscale/" updated: "2026-10-26" category: Networking (en) tags: - Networking --- # 🔍 Tailscale — Identity-Based Connectivity Platform (WireGuard Mesh VPN) (en) ![Tailscale Logo](https://aaronchan.com/wp-content/uploads/2026/10/tailscale-logo.png) > 📅 Date compiled: 2026-10-22 > ⚠️ Pricing / information may change; refer to the official website --- ## Part 1: What is Tailscale (Overview) Tailscale is a **Zero Trust identity-based connectivity platform** that replaces traditional VPNs (Virtual Private Network), SASE, and PAM, securely connecting remote teams, multi-cloud environments, CI/CD, IoT devices, and AI workloads. | Item | Description | | --- | --- | | Positioning | Identity-based connectivity platform, replaces traditional VPN / SASE / PAM | | Core technology | Open-source **WireGuard** encryption protocol | | Network architecture | Peer-to-peer **mesh network**, called a **tailnet** | | Deployment difficulty | Zero-config, up in minutes, no port forwarding | | Cross-platform | Linux / macOS / Windows / iOS / Android / NAS / routers | --- ## Part 2: How It Works (Technical Principles) Tailscale divides the network into a **data plane** and a **control plane**, connecting devices in a decentralized way to avoid the bottleneck of traditional VPNs. | Layer | Mechanism | Description | | --- | --- | --- | | Data plane | WireGuard | Establishes lightweight encrypted tunnels between devices; traffic flows peer-to-peer directly | | Control plane | Coordination server | Handles identity authentication, key exchange, and access policies; never touches actual traffic | | NAT traversal | STUN / ICE | Lets devices behind firewalls/NAT connect directly | | Relay | DERP relay | Forwards traffic via relay servers when a direct connection isn't possible | **Differences from traditional VPNs:** | Aspect | Traditional VPN (hub-and-spoke) | Tailscale (mesh) | | --- | --- | --- | | Topology | Centralized gateway (single node) | Peer-to-peer direct | | Latency | Traffic converges, can become a bottleneck | Direct connection, lower latency | | Throughput | Limited by the central gateway | Higher throughput | | Single point of failure | Yes | Decentralized, more stable | --- ## Part 3: Core Features | Feature | Description | | --- | --- | | MagicDNS | Automatically resolves devices in your tailnet by custom hostnames | | Tailscale SSH | Centralized SSH access and identity authorization (free plan: up to 5 hosts) | | Exit nodes | Route all traffic through a designated node (equivalent to traditional VPN usage) | | Subnet routers | Connect internal private networks (e.g. office network) | | ACLs (Access Control Lists) | Implement least-privileged access policies | | Identity provider integration | Supports Okta, Azure AD, GitHub, Google and other IdPs | --- ## Part 4: Pricing Plans (after April 2026 Pricing v4 update) On April 8, 2026, Tailscale restructured pricing, merging the old **Personal Plus** 6-user allowance into the free **Personal** plan and removing the device cap. | Plan | Price | Users | Devices | Tagged resources | ACL groups | Ephemeral minutes/month | SSO / SCIM | | --- | --- | --- | --- | --- | --- | --- | --- | | Personal | Free forever | 6 | Unlimited | 50 | 3 | 1,000 | None | | Standard | $8 per user/month | Unlimited | Unlimited | 50 (add-on available) | 10 | 1,000 | SCIM only | | Premium | $18 per user/month | Unlimited | Unlimited | 50 (add-on available) | 300 | 10,000 | Full SSO + SCIM | | Enterprise | Custom quote | Custom | Custom | Custom | Custom | Custom | Full + dedicated support | **Plan highlights:** - **Personal (free)**: For home labs and home VPN; non-commercial use only - **Standard**: Adds SCIM user provisioning, MDM deployment, and device posture integration - **Premium**: Adds just-in-time access, network flow logs, advanced SSH, regional routing, priority support - Business customers get a **14-day free trial** (no user limit) --- ## Part 5: Recommended Use Cases | Use case | Recommended plan | Reason | | --- | --- | --- | | Home lab / personal VPN | Personal (free) | 6 users + unlimited devices is enough | | Gaming with friends (Steam Deck etc.) | Personal (free) | No config, no port opening | | SMB remote access | Standard | SCIM + MDM + device posture management | | Compliance audit, flow logs | Premium | Network flow logs + just-in-time access | | Large enterprise, Kubernetes clusters | Enterprise | Custom SLA, dedicated support, billing flexibility | --- ## ⚠️ Considerations | Consideration | Description | | --- | --- | | Free plan non-commercial only | Personal is for personal/home use; business use requires a paid plan | | Custom domain counts as business | Registering with a custom domain (e.g. @[acme.com](http://acme.com)) is treated as business use and auto-starts a trial | | Priced per seat | Billed per user seat, not per device; devices are unlimited on every plan | | Free plan limits | 50 tagged resources, 3 ACL groups, 1,000 ephemeral minutes per month | | Add-on tagged resources | Extra tagged resources $1 per month each | --- ## 📱 Official App Download - 🍎 **iOS (App Store)**: [Download Tailscale](https://apps.apple.com/us/app/tailscale/id1470499037) - 🤖 **Android (Google Play)**: [Download Tailscale](https://play.google.com/store/apps/details?id=com.tailscale.ipn&hl=en_US) ## 🔗 References | Source | Link | | --- | --- | | What is Tailscale (official docs) | [https://tailscale.com/docs/concepts/what-is-tailscale](https://tailscale.com/docs/concepts/what-is-tailscale) | | How Tailscale works (official blog) | [https://tailscale.com/blog/how-tailscale-works](https://tailscale.com/blog/how-tailscale-works) | | Pricing v4 update announcement | [https://tailscale.com/blog/pricing-v4](https://tailscale.com/blog/pricing-v4) | | Pricing FAQ (official) | [https://tailscale.com/docs/reference/faq/pricing](https://tailscale.com/docs/reference/faq/pricing) | | Official pricing page | [https://tailscale.com/pricing](https://tailscale.com/pricing) | | 🎬 Video: [Subtitled] More secure than VPN — build your own private network (Garion Photo Tech) | [https://youtu.be/8FtnHE8KliI?si=Ig0H110mGLjsk4It](https://youtu.be/8FtnHE8KliI?si=Ig0H110mGLjsk4It) | --- *Source: Tailscale official docs, blog, and public pricing pages (October 2026)*