tailscale

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Tailscale

Tailscale is a zero-config mesh VPN that creates a secure peer-to-peer network (called a tailnet) between your devices. It uses WireGuard for encryption and connects devices directly rather than routing through a central gateway.

Beyond the core VPN, Tailscale offers a family of products built on the same identity and networking layer. This skill covers all of them — consult the reference file for whichever topic is relevant.

Tailscale是一款零配置网格VPN，可在你的设备之间创建安全的点对点网络（称为tailnet）。它采用WireGuard协议进行加密，直接连接设备而非通过中央网关路由。

除核心VPN功能外，Tailscale还提供一系列基于同一身份与网络层构建的产品。本技能涵盖所有这些产品——请根据相关主题查阅参考文档。

How references work

参考文档的使用方式

References fall into two shapes depending on what the skill needs to do for the user.

Descriptive references (most files —

aperture.md

containers.md

enterprise.md

device-management.md

session-recording.md

api.md

tsnet.md

) help you describe a topic to a user: explain it, draft configuration, recommend an approach. These use a hybrid layout — stable mental model and load-bearing configuration shapes inline, plus a curated list of canonical

tailscale.com/docs/...

URLs to WebFetch for current detail. Follow the in-file instructions about when to fetch. When WebFetch is available, prefer the live page over the inline summary for specifics (configuration keys, environment variables, supported models, pricing). When WebFetch is unavailable, answer from inline content and tell the user which doc page to consult.

Operational references (currently

cli.md

) help you operate a tool on the user's machine — Claude actually invokes the commands. These keep concrete command/flag content inline because wrong flags break real systems. The fallback is local, not network: run

tailscale help <subcommand>

to verify a flag before suggesting it. The canonical docs URL is the second fallback, for when the tool isn't installed.

The remaining references (

access-control.md

common-tasks.md

connectivity.md

exit-nodes.md

installation.md

subnet-routers.md

) are smaller and self-contained — read the file, answer the question.

根据为用户提供的服务类型，参考文档分为两种形式。

描述性参考文档（大多数文档——

aperture.md

、

containers.md

、

enterprise.md

、

device-management.md

、

session-recording.md

、

api.md

、

tsnet.md

）用于向用户描述主题：解释概念、编写配置、推荐方案。这类文档采用混合布局——稳定的核心模型和关键配置示例内嵌，同时提供精选的官方

tailscale.com/docs/...

链接，可通过WebFetch获取最新细节。请遵循文档内关于何时获取的说明。当WebFetch可用时，优先使用在线页面获取具体信息（配置项、环境变量、支持的模型、定价）；当WebFetch不可用时，以内嵌内容作答，并告知用户需查阅的文档页面。

操作型参考文档（目前仅

cli.md

）用于帮助用户在本地机器上操作工具——Claude会直接调用命令。这类文档将具体的命令/参数内嵌，因为错误的参数会破坏实际系统。备用方案为本地验证：在推荐参数前先运行

tailscale help <subcommand>

进行验证。官方文档链接是第二备用方案，适用于工具未安装的情况。

其余参考文档（

access-control.md

、

common-tasks.md

、

connectivity.md

、

exit-nodes.md

、

installation.md

、

subnet-routers.md

）篇幅较短且内容独立——直接阅读文档即可回答问题。

Core concepts

核心概念

Tailnet: Your private network of authenticated devices and users.
WireGuard: The encryption protocol underneath Tailscale. Key management is automatic.
MagicDNS: Automatic DNS names for every device (for example,
```
ssh my-server
```
).
100.x.y.z addresses: Each device gets a stable Tailscale IP in the CGNAT range.
Tailnet policy file: JSON configuration in the admin console that defines access controls, groups, tags, and SSH rules. Deny-by-default.

Tailnet：你的已认证设备和用户组成的私有网络。
WireGuard：Tailscale底层使用的加密协议，密钥管理自动完成。
MagicDNS：为每个设备自动分配DNS名称（例如，
```
ssh my-server
```
）。
100.x.y.z地址：每个设备会获得一个CGNAT范围内的稳定Tailscale IP。
Tailnet策略文件：管理控制台中的JSON配置，用于定义访问控制、群组、标签和SSH规则。默认采用拒绝所有的策略。

Authoring defaults

编写默认规则

When the user asks you to write or edit a tailnet policy file:

Use grants, not ACLs. Grants are Tailscale's recommended way to express access rules. Grants cover what ACLs do (network-layer access) plus application-layer capabilities (Kubernetes, Aperture, tsrecorder, Taildrive) in one form. ACLs are still supported for reading existing policies and migrations, but every new access rule you write should be a grant. Refer to
```
references/access-control.md
```
for the conversion pattern and https://tailscale.com/docs/reference/grants-vs-acls for the canonical comparison.
The grant-vs-ACL choice only applies to access rules. Other policy-file sections have their own dedicated syntax and aren't grants:
```
"ssh"
```
(SSH access),
```
"autoApprovers"
```
(auto-approving advertised routes and exit nodes),
```
"nodeAttrs"
```
(node-level attributes like Funnel),
```
"postures"
```
(device posture definitions, referenced from grants via
```
srcPosture
```
), and the
```
"groups"
```
/
```
"tagOwners"
```
definitions.

当用户要求编写或编辑tailnet策略文件时：

使用Grants而非ACLs。Grants是Tailscale推荐的访问规则表达方式。Grants不仅涵盖ACLs的功能（网络层访问），还能在同一格式中支持应用层能力（Kubernetes、Aperture、tsrecorder、Taildrive）。ACLs仍支持读取现有策略和迁移，但所有新编写的访问规则都应使用Grant。请参考
```
references/access-control.md
```
中的转换模式，以及官方对比文档https://tailscale.com/docs/reference/grants-vs-acls。
Grant与ACL的选择仅适用于访问规则。策略文件的其他部分有各自专用的语法，不属于Grant范畴：
```
"ssh"
```
（SSH访问）、
```
"autoApprovers"
```
（自动批准已通告的路由和出口节点）、
```
"nodeAttrs"
```
（节点级属性如Funnel）、
```
"postures"
```
（设备状态定义，通过
```
srcPosture
```
在Grant中引用），以及
```
"groups"
```
/
```
"tagOwners"
```
定义。

Quick start

快速开始

For macOS/Windows, download Tailscale from https://tailscale.com/download.

For iOS, iPadOS, tvOS, Android devices, Roku devices, and Fire TV, install Tailscale through the platform's app store.

Install Tailscale on Linux devices with the installation script:

bash

curl -fsSL https://tailscale.com/install.sh | sh   # Install (Linux)
sudo tailscale up                                    # Connect
tailscale status                                     # Verify

When authenticating with Tailscale, associate user devices with a user account. Use tags and auth keys to add servers and non-user devices to your tailnet.

对于macOS/Windows系统，从https://tailscale.com/download下载Tailscale。

对于iOS、iPadOS、tvOS、Android设备、Roku设备和Fire TV，通过对应平台的应用商店安装Tailscale。

在Linux设备上通过安装脚本安装Tailscale：

bash

curl -fsSL https://tailscale.com/install.sh | sh   # 安装（Linux）
sudo tailscale up                                    # 连接
tailscale status                                     # 验证

使用Tailscale认证时，将用户设备与用户账户关联。使用标签和认证密钥将服务器和非用户设备添加到你的tailnet中。

Find your task

查找对应任务

"I want to reach my work machines from my personal laptop or phone"

"我想从个人笔记本电脑或手机访问工作设备"

Need remote access to work?
├─ My work computers or internal apps → references/common-tasks.md
├─ Remote desktop into my work machine (RDP, VNC) → references/connectivity.md
├─ Replace our old company VPN → references/enterprise.md
└─ A device that can't run Tailscale (printer, camera, cloud VPC) → references/subnet-routers.md

需要远程访问工作资源？
├─ 我的工作电脑或内部应用 → references/common-tasks.md
├─ 远程桌面访问工作机器（RDP、VNC）→ references/connectivity.md
├─ 替换公司旧VPN → references/enterprise.md
└─ 无法运行Tailscale的设备（打印机、摄像头、云VPC）→ references/subnet-routers.md

"I'm traveling and want my internet to work like I'm home"

"我正在旅行，希望互联网使用体验和在家一样"

Traveling or on Wi-Fi you don't trust?
├─ Protect my traffic on hotel, cafe, or airport Wi-Fi → references/exit-nodes.md
├─ Use my home country's sites and streaming while abroad → references/exit-nodes.md
└─ Set up an exit node for family (the one you mail your parents) → references/exit-nodes.md

正在旅行或连接不可信Wi-Fi？
├─ 在酒店、咖啡馆或机场Wi-Fi环境下保护流量安全 → references/exit-nodes.md
├─ 在国外访问本国网站和流媒体服务 → references/exit-nodes.md
└─ 为家人设置出口节点（比如给父母使用的设备）→ references/exit-nodes.md

"I want to give people access to our servers only when they need it and audit what they did"

"我希望仅在需要时授予用户服务器访问权限，并审计他们的操作"

Need to lock down access?
├─ Access only when it's needed, not standing admin rights → references/access-control.md
├─ A break-glass path for emergencies → references/access-control.md
├─ Record SSH or kubectl sessions → references/session-recording.md
├─ Govern privileged access to servers, databases, and clusters (PAM) → references/border0.md
└─ Reach the Kubernetes API server → references/containers.md

需要锁定访问权限？
├─ 仅在需要时授予访问权限，而非永久管理员权限 → references/access-control.md
├─ 紧急情况下的应急访问路径 → references/access-control.md
├─ 录制SSH或kubectl会话 → references/session-recording.md
├─ 管控对服务器、数据库和集群的特权访问（PAM）→ references/border0.md
└─ 访问Kubernetes API服务器 → references/containers.md

"I want my services and machines to connect securely across networks"

"我希望我的服务和设备跨网络安全连接"

Need machines talking to each other?
├─ A CI/CD pipeline that reaches private infra → references/enterprise.md
├─ Kubernetes workloads across clusters or clouds → references/containers.md
├─ Services across more than one cloud → references/enterprise.md
├─ Thousands of field devices (fleets, vehicles, robots) → references/device-management.md
├─ Fix overlapping IPs across sites → references/subnet-routers.md
└─ Link two office networks together (site-to-site) → references/subnet-routers.md

需要设备间安全通信？
├─ 访问私有基础设施的CI/CD流水线 → references/enterprise.md
├─ 跨集群或云环境的Kubernetes工作负载 → references/containers.md
├─ 跨多个云环境的服务 → references/enterprise.md
├─ 数千台现场设备（车队、车辆、机器人）→ references/device-management.md
├─ 解决跨站点IP重叠问题 → references/subnet-routers.md
└─ 连接两个办公网络（站点到站点）→ references/subnet-routers.md

"I want to share a file or app on my machine with someone else"

"我想与他人共享我机器上的文件或应用"

Need to share or open something up?
├─ Send a file to someone's device → references/sharing-and-publishing.md (Taildrop)
├─ Keep a folder synced across my devices → references/sharing-and-publishing.md (Taildrive)
├─ Let a teammate reach an app on my laptop → references/sharing-and-publishing.md (Serve)
└─ Put an app on the public internet → references/sharing-and-publishing.md (Funnel)

需要共享或对外暴露资源？
├─ 向他人设备发送文件 → references/sharing-and-publishing.md（Taildrop）
├─ 在我的设备间同步文件夹 → references/sharing-and-publishing.md（Taildrive）
├─ 让同事访问我笔记本上的应用 → references/sharing-and-publishing.md（Serve）
└─ 将应用发布到公网 → references/sharing-and-publishing.md（Funnel）

"I'm testing an app and need it to reach or look like somewhere else"

"我正在测试应用，需要它访问特定网络或模拟特定位置"

Testing an app?
├─ Preview a local dev server with teammates or the internet → references/sharing-and-publishing.md
├─ Remote into a desktop (RDP, VNC, RustDesk) → references/connectivity.md
└─ Make test traffic appear to come from another country → references/exit-nodes.md

正在测试应用？
├─ 与同事或公网预览本地开发服务器 → references/sharing-and-publishing.md
├─ 远程桌面访问（RDP、VNC、RustDesk）→ references/connectivity.md
└─ 让测试流量看起来来自其他国家 → references/exit-nodes.md

"Something is broken or I'm seeing an error message"

"出现故障或错误提示"

Hit an error or something not working?
├─ A specific error or status message (in the app or admin console) → references/error-messages.md
├─ Devices can't connect, slow/relayed, or DNS/NAT problems → references/connectivity.md
├─ A grant or access rule isn't behaving → references/access-control.md
└─ Kubernetes operator problems → references/containers.md

遇到错误或功能异常？
├─ 特定错误或状态提示（应用或管理控制台中）→ references/error-messages.md
├─ 设备无法连接、速度慢/中继、DNS/NAT问题 → references/connectivity.md
├─ Grant或访问规则行为异常 → references/access-control.md
└─ Kubernetes Operator问题 → references/containers.md

"I want to run my own LLM and keep it private"

"我想运行自己的LLM并保持私有性"

Running your own AI?
├─ Reach my home model (Ollama, LM Studio) from my other devices → references/installation.md
├─ Put my home GPU on my tailnet for inference → references/tsnet.md
└─ Open my private chat UI or RAG to just my devices → references/sharing-and-publishing.md (Serve)

运行自有AI模型？
├─ 从其他设备访问本地模型（Ollama、LM Studio）→ references/installation.md
├─ 将本地GPU加入tailnet用于推理 → references/tsnet.md
└─ 仅向我的设备开放私有聊天UI或RAG系统 → references/sharing-and-publishing.md（Serve）

"I want to control what our company's AI tools cost and can reach"

"我想管控公司AI工具的成本和访问范围"

Governing how your company uses AI?
├─ Centralize and rotate our LLM API keys → references/aperture.md
├─ See cost and usage per person or team → references/aperture.md
├─ Put quotas or budgets on AI spend → references/aperture.md
└─ Control which MCP tools agents are allowed to use → references/aperture.md

管控公司AI使用？
├─ 集中管理并轮换LLM API密钥 → references/aperture.md
├─ 查看按人员或团队划分的成本与使用情况 → references/aperture.md
├─ 设置AI支出配额或预算 → references/aperture.md
└─ 控制Agent可使用的MCP工具 → references/aperture.md

"I want to give an AI agent a safe identity to reach tools"

"我想为AI Agent提供安全身份以访问工具"

Securing AI agents?
├─ Give each agent its own identity on the network → references/tsnet.md
├─ Let agents reach each other across machines → references/tsnet.md
├─ Control exactly which tools and data an agent can reach → references/access-control.md
└─ Fence an agent off so it can only touch what I allow → references/access-control.md

保障AI Agent安全？
├─ 为每个Agent分配独立的网络身份 → references/tsnet.md
├─ 让Agent跨机器互相访问 → references/tsnet.md
├─ 精确控制Agent可访问的工具和数据 → references/access-control.md
└─ 隔离Agent使其仅能访问授权资源 → references/access-control.md

"I want to get to my home computer, files, and media when I'm away"

"我想在外出时访问家用电脑、文件和媒体"

Need to reach home?
├─ Home computers and files → references/installation.md
├─ A headless Pi or home server, with no port forwarding → references/subnet-routers.md
├─ Media or backups (Jellyfin, *arr, Nextcloud) → references/sharing-and-publishing.md
├─ Smart-home gear (Home Assistant, Pi-hole) → references/subnet-routers.md
└─ Remote desktop or game streaming (Moonlight, RDP) → references/connectivity.md

需要访问家用资源？
├─ 家用电脑和文件 → references/installation.md
├─ 无显示器的树莓派或家用服务器（无需端口转发）→ references/subnet-routers.md
├─ 媒体或备份服务（Jellyfin、*arr、Nextcloud）→ references/sharing-and-publishing.md
├─ 智能家居设备（Home Assistant、Pi-hole）→ references/subnet-routers.md
└─ 远程桌面或游戏串流（Moonlight、RDP）→ references/connectivity.md

"I want to connect my company's devices securely through our email or SSO"

"我想通过公司邮箱或SSO安全连接公司设备"

Need everyone connected through SSO?
├─ Provision users from our identity provider (SSO, SCIM) → references/device-management.md
├─ Push Tailscale to managed devices (Jamf, Intune) → references/device-management.md
├─ Require posture or approval before connecting → references/device-management.md
└─ Automate nodes (auth keys, ephemeral nodes, Terraform) → references/enterprise.md

需要通过SSO统一连接？
├─ 从身份提供商同步用户（SSO、SCIM）→ references/device-management.md
├─ 向受管设备推送Tailscale（Jamf、Intune）→ references/device-management.md
├─ 要求连接前验证设备状态或获得批准 → references/device-management.md
└─ 自动化节点管理（认证密钥、临时节点、Terraform）→ references/enterprise.md

"I'm building an app that needs to reach private resources securely"

"我正在构建需要安全访问私有资源的应用"

Building it into your app?
├─ My service needs to reach a private database or API → references/tsnet.md
├─ Give my app its own identity, separate from the host → references/tsnet.md
└─ Serve or publish my app straight from code → references/tsnet.md

将Tailscale集成到应用中？
├─ 我的服务需要访问私有数据库或API → references/tsnet.md
├─ 为应用分配独立于主机的身份 → references/tsnet.md
└─ 直接从代码中发布应用 → references/tsnet.md

Topic index

主题索引

Read the reference file that matches the user's question. Each file is self-contained.

阅读与用户问题匹配的参考文档，每个文档内容独立。

Networking & connectivity

网络与连接

Topic	Reference file	When to read
Installation	`references/installation.md`	Installing Tailscale on any platform, updating, uninstalling
Exit nodes	`references/exit-nodes.md`	Routing all internet traffic through a device (VPN-style), travel security
Subnet routers	`references/subnet-routers.md`	Reaching devices that can't run Tailscale (printers, cameras, cloud VPCs)
Access control	`references/access-control.md`	Grants, ACLs, tags, groups, policy file structure
Connectivity	`references/connectivity.md`	Peer relay, DERP servers, NAT traversal, tailnet lock, connection types
Common tasks	`references/common-tasks.md`	Tailscale SSH, MagicDNS, auth keys, key expiry

主题	参考文档	适用场景
安装	`references/installation.md`	在任意平台安装、更新、卸载Tailscale
出口节点	`references/exit-nodes.md`	将所有互联网流量通过设备路由（VPN模式）、旅行安全
子网路由器	`references/subnet-routers.md`	访问无法运行Tailscale的设备（打印机、摄像头、云VPC）
访问控制	`references/access-control.md`	Grants、ACLs、标签、群组、策略文件结构
连接性	`references/connectivity.md`	对等中继、DERP服务器、NAT穿透、tailnet锁定、连接类型
常见任务	`references/common-tasks.md`	Tailscale SSH、MagicDNS、认证密钥、密钥过期

Sharing & publishing

共享与发布

Topic	Reference file	When to read
Sharing & publishing	`references/sharing-and-publishing.md`	Taildrop (file transfer), Taildrive (persistent folder sharing), Tailscale Serve (private), Tailscale Funnel (public)

主题	参考文档	适用场景
共享与发布	`references/sharing-and-publishing.md`	Taildrop（文件传输）、Taildrive（持久化文件夹共享）、Tailscale Serve（私有发布）、Tailscale Funnel（公网发布）

Containers & orchestration

容器与编排

Topic	Reference file	When to read
Docker & Kubernetes	`references/containers.md`	Running Tailscale in Docker containers, sidecar pattern, Docker Compose, Kubernetes operator, cluster ingress/egress, Connector CRD, ProxyGroup

主题	参考文档	适用场景
Docker与Kubernetes	`references/containers.md`	在Docker容器中运行Tailscale、边车模式、Docker Compose、Kubernetes Operator、集群入口/出口、Connector CRD、ProxyGroup

Enterprise & infrastructure

企业与基础设施

Topic	Reference file	When to read
Enterprise patterns	`references/enterprise.md`	VPN replacement, infrastructure access, ephemeral nodes, CI/CD integration (GitHub Actions), site-to-site networking, app connectors, auth keys for automation, Terraform provider
Device management	`references/device-management.md`	Device approval, device posture, MDM deployment, SCIM user/group provisioning, bulk device operations, enterprise rollout
Session recording	`references/session-recording.md`	tsrecorder setup, SSH session recording, S3 storage, Kubernetes kubectl recording, API request recording, failover, audit compliance
Border0 (PAM)	`references/border0.md`	Privileged access management, application-aware access, just-in-time access, session recording for SSH/Kubernetes/RDP/VNC/databases, connectors and sockets, credential elimination

主题	参考文档	适用场景
企业模式	`references/enterprise.md`	VPN替代方案、基础设施访问、临时节点、CI/CD集成（GitHub Actions）、站点到站点网络、应用连接器、自动化认证密钥、Terraform提供商
设备管理	`references/device-management.md`	设备批准、设备状态、MDM部署、SCIM用户/群组配置、批量设备操作、企业级部署
会话录制	`references/session-recording.md`	tsrecorder设置、SSH会话录制、S3存储、Kubernetes kubectl录制、API请求录制、故障转移、审计合规
Border0（PAM）	`references/border0.md`	特权访问管理、应用感知访问、即时访问、SSH/Kubernetes/RDP/VNC/数据库会话录制、连接器与套接字、凭证消除

Building on Tailscale

基于Tailscale开发

Topic	Reference file	When to read
tsnet (Go library)	`references/tsnet.md`	Building a Go application with Tailscale built in, so the app is itself a device on the tailnet; apps that authenticate their users by Tailscale identity with no separate login flow; apps that control access with tags and capability grants managed in the policy file; running several such apps on one host, each with its own identity and access rules; reaching or serving private tailnet services from Go with nothing exposed publicly

主题	参考文档	适用场景
tsnet（Go库）	`references/tsnet.md`	构建内嵌Tailscale的Go应用，使应用本身成为tailnet上的设备；通过Tailscale身份验证用户无需单独登录流程；使用策略文件中的标签和权限Grant控制访问；在同一主机上运行多个此类应用，每个应用拥有独立身份和访问规则；从Go应用中访问或发布私有tailnet服务，无需暴露到公网

AI & LLM governance

AI与LLM治理

Topic	Reference file	When to read
Aperture	`references/aperture.md`	AI gateway, LLM request routing, API key centralization, usage visibility, cost control, quotas, coding agent integration, MCP proxying

主题	参考文档	适用场景
Aperture	`references/aperture.md`	AI网关、LLM请求路由、API密钥集中管理、使用可见性、成本控制、配额、编码Agent集成、MCP代理

Reference

参考

Topic	Reference file	When to read
CLI	`references/cli.md`	Tailscale CLI commands, flags, serve/funnel, file transfer, diagnostics, tailnet lock
API	`references/api.md`	Tailscale REST API, authentication, device management, DNS, policy file, webhooks
Error & status messages	`references/error-messages.md`	Looking up a specific client or admin-console error/status message (DERP relay, DNS, SSH/SELinux, Docker, Windows, SSO, billing) and its fix

主题	参考文档	适用场景
CLI	`references/cli.md`	Tailscale CLI命令、参数、serve/funnel、文件传输、诊断、tailnet锁定
API	`references/api.md`	Tailscale REST API、认证、设备管理、DNS、策略文件、Webhooks
错误与状态提示	`references/error-messages.md`	查询特定客户端或管理控制台的错误/状态提示（DERP中继、DNS、SSH/SELinux、Docker、Windows、SSO、账单）及修复方法

CLI quick reference

CLI快速参考

Command	What it does
`tailscale up`	Connect to your tailnet
`tailscale down`	Disconnect
`tailscale status`	Show connected devices
`tailscale ip`	Show your Tailscale IP addresses
`tailscale ping <host>`	Test connectivity to a device
`tailscale set --ssh`	Enable Tailscale SSH on this device
`tailscale set --advertise-exit-node`	Advertise as an exit node
`tailscale set --exit-node=<ip>`	Use a specific exit node
`tailscale set --advertise-routes=<cidr>`	Advertise subnet routes
`tailscale set --accept-routes`	Accept advertised subnet routes (Linux)

命令	功能
`tailscale up`	连接到你的tailnet
`tailscale down`	断开连接
`tailscale status`	显示已连接设备
`tailscale ip`	显示你的Tailscale IP地址
`tailscale ping <host>`	测试与设备的连接性
`tailscale set --ssh`	在本设备上启用Tailscale SSH
`tailscale set --advertise-exit-node`	将本设备通告为出口节点
`tailscale set --exit-node=<ip>`	使用指定的出口节点
`tailscale set --advertise-routes=<cidr>`	通告子网路由
`tailscale set --accept-routes`	接受已通告的子网路由（Linux）