{"id":639,"date":"2025-10-21T12:18:13","date_gmt":"2025-10-21T12:18:13","guid":{"rendered":"https:\/\/devsecopsschool.com\/blog\/?p=639"},"modified":"2025-10-21T12:18:14","modified_gmt":"2025-10-21T12:18:14","slug":"how-to-install-configure-tailscale-in-linux-windows-macos","status":"publish","type":"post","link":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/","title":{"rendered":"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS?"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">0) What Tailscale Is (30-second refresher)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>mesh VPN \/ overlay network<\/strong>: your devices join a private network (\u201ctailnet\u201d) and get stable <strong>100.x.y.z<\/strong> IPs.<\/li>\n\n\n\n<li>Uses <strong>WireGuard<\/strong> for encrypted tunnels. Data tries to go <strong>direct P2P over UDP<\/strong>; if blocked, it falls back to encrypted <strong>DERP<\/strong> relays.<\/li>\n\n\n\n<li>Access is controlled by <strong>identity<\/strong> (your login) and <strong>ACL policies<\/strong>, not by being \u201con the same LAN\u201d.<\/li>\n\n\n\n<li>A <strong>control plane<\/strong> coordinates keys, device info, and policy; <strong>it is not in the data path<\/strong>.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1) Tailnet Basics (org vs personal)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Organization tailnet<\/strong> (you logged in with company email): you\u2019re a <strong>member<\/strong>; admins control ACLs, routes, DNS, etc. You\u2019ll see many org devices\u2014<strong>that doesn\u2019t grant you access<\/strong> unless ACLs allow it.<\/li>\n\n\n\n<li><strong>Personal tailnet<\/strong> (you logged in with personal email): <strong>you are the admin<\/strong>; full control (devices, ACLs, DNS\/MagicDNS, keys, routes).<\/li>\n<\/ul>\n\n\n\n<p><strong>Privacy lever (local):<\/strong><br>To block all inbound connections to your device while staying online:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tailscale up --shields-up\n<\/code><\/pre>\n\n\n\n<p>(Works on macOS\/Linux CLI; on Windows\/macOS you can also toggle via the app UI.)<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2) Install Tailscale (per OS)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Windows 10\/11<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Run the Tailscale installer (standard MSI).<\/li>\n\n\n\n<li>Launch the <strong>Tailscale<\/strong> app (tray icon).<\/li>\n\n\n\n<li>Click <strong>Log in<\/strong>, authenticate with the account you want this device to belong to.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">macOS (App + CLI)<\/h3>\n\n\n\n<p><strong>Recommended (GUI + helper):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># If you use Homebrew:\nbrew install --cask tailscale-app\nopen -a Tailscale\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click <strong>Log in<\/strong> in the app and authenticate.<\/li>\n\n\n\n<li>CLI becomes available as <code>tailscale<\/code>.<\/li>\n<\/ul>\n\n\n\n<p><strong>If your CLI says \u201ccommand not found\u201d or GUI\/CLI disagree<\/strong>, see \u201cmacOS fixes\u201d in the Troubleshooting section.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Linux (systemd distros)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -fsSL https:\/\/tailscale.com\/install.sh | sh\nsudo systemctl enable --now tailscaled\nsudo tailscale up\n# Browser opens for SSO; approve and you're online.\n<\/code><\/pre>\n\n\n\n<p><strong>Headless Linux<\/strong> (no browser):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In the Admin Console (your tailnet), make an <strong>Auth Key<\/strong>.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tailscale up --auth-key tskey-XXXXXXXXXXXXXXXX\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3) Add a Second Machine (join the same tailnet)<\/h2>\n\n\n\n<p>Repeat the install on the second device and <strong>log in with the same account\/identity<\/strong> you used on the first.<br>Verify both are visible to each other:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tailscale status\n<\/code><\/pre>\n\n\n\n<p>You should see each device listed with a <strong>100.x.y.z<\/strong> address and \u201cactive\u201d.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4) Verify Connectivity &amp; Name Resolution<\/h2>\n\n\n\n<p>From either machine:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tailscale ip         # show this device\u2019s tailnet IPs\ntailscale status     # show peers and state\nping 100.x.y.z       # test the other device by its Tailscale IP\n<\/code><\/pre>\n\n\n\n<p><strong>MagicDNS<\/strong> (if enabled in your tailnet): you can use hostnames like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ping hostname.tailnet\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">5) Common Access Methods (beyond SSH)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">A) SSH (Linux\/macOS targets)<\/h3>\n\n\n\n<p><strong>Key-based (classic):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># on your client\nssh-keygen -t ed25519 -C \"my-key\"\nssh-copy-id -i ~\/.ssh\/id_ed25519.pub user@100.x.y.z\n# test:\nssh user@100.x.y.z\n<\/code><\/pre>\n\n\n\n<p><strong>Harden (optional, on server):<\/strong><br>Disable password auth <em>after<\/em> key login works by editing <code>sshd_config<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PasswordAuthentication no\nPubkeyAuthentication yes\n<\/code><\/pre>\n\n\n\n<p>Then restart sshd.<\/p>\n\n\n\n<p><strong>Tailscale SSH (SSO-backed, no key copying):<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Admin enables Tailscale SSH in policy and on the target host:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tailscale up --ssh\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Then from your client:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh user@hostname.tailnet\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">B) Windows GUI (RDP)<\/h3>\n\n\n\n<p><strong>On the Windows host<\/strong> (PowerShell as Admin):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\" `\n  -Name \"fDenyTSConnections\" -Value 0\nEnable-NetFirewallRule -DisplayGroup \"Remote Desktop\"\n<\/code><\/pre>\n\n\n\n<p><strong>From client:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Windows: <code>mstsc \/v:100.x.y.z<\/code><\/li>\n\n\n\n<li>macOS: Microsoft Remote Desktop app \u2192 add <code>100.x.y.z<\/code><\/li>\n\n\n\n<li>Linux: <code>xfreerdp \/v:100.x.y.z<\/code><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">C) SMB \/ File Shares<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Windows host \u2192 Windows client:<\/strong> <code>\\\\100.x.y.z\\Share<\/code><\/li>\n\n\n\n<li><strong>Windows host \u2192 macOS client:<\/strong> Finder \u2192 Go \u2192 Connect to Server \u2192 <code>smb:\/\/100.x.y.z\/Share<\/code><\/li>\n\n\n\n<li><strong>Windows host \u2192 Linux client:<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install cifs-utils\nsudo mount -t cifs \/\/100.x.y.z\/Share \/mnt\/share -o user=USERNAME\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">D) VNC (alternative GUI, cross-platform)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Install a VNC server on the host (e.g., TightVNC).<\/li>\n\n\n\n<li>Connect from client VNC viewer to <code>100.x.y.z:5900<\/code>.<br>Note: VNC itself isn\u2019t encrypted, but the <strong>Tailscale tunnel is<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">E) HTTP(S) services \/ Databases<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Any TCP\/UDP service reachable on a port can be used over Tailscale if <strong>local firewall<\/strong> and <strong>ACLs<\/strong> allow it:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>nc -vz 100.x.y.z 443       # test HTTPS\nnc -vz 100.x.y.z 5432      # test PostgreSQL\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">6) Everyday CLI You\u2019ll Actually Use<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>tailscale status         # see who\u2019s online, route type (direct\/derp)\ntailscale ip             # show your addresses\ntailscale ping hostname  # quick health probe via Tailscale\ntailscale logout         # detach this device from the tailnet\ntailscale up --shields-up                # block inbound\ntailscale up --advertise-exit-node       # make this device an exit node\ntailscale up --exit-node=100.x.y.z       # route your internet via that exit node\ntailscale up --advertise-routes=192.168.1.0\/24   # act as subnet router\n<\/code><\/pre>\n\n\n\n<p><strong>Note:<\/strong> Routes advertised must be approved in your tailnet before others can use them.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">7) Features &amp; Options (with where they matter)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">MagicDNS<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Friendly names for peers (e.g., <code>mybox.tailnet<\/code>).<\/li>\n\n\n\n<li>Configure in your tailnet\u2019s DNS settings; then use names instead of IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Exit Nodes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Send <strong>all<\/strong> internet traffic through a chosen device (e.g., home desktop).<\/li>\n\n\n\n<li>On exit node: <code>tailscale up --advertise-exit-node<\/code><\/li>\n\n\n\n<li>On client: select that node in the app, or <code>tailscale up --exit-node=&lt;IP-or-name><\/code><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Subnet Routers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Make an entire LAN behind one device reachable to the tailnet:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tailscale up --advertise-routes=10.0.0.0\/24,10.10.0.0\/16\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Approve those routes in your tailnet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">ACLs (Access Control Lists)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Control <strong>who<\/strong> can access <strong>what<\/strong> (users\/groups \u2192 devices\/ports).<\/li>\n\n\n\n<li>If you can see devices but can\u2019t connect, an ACL likely blocks it.<\/li>\n\n\n\n<li>Ask your admin to allow your user\/group to <code>hostname:port<\/code> you need.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Device Posture \/ Keys<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Devices enroll with keys tied to identity; keys rotate automatically.<\/li>\n\n\n\n<li>Disabling a user\/device or rotating keys <strong>revokes access immediately<\/strong> (your earlier question about ex-employees).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">8) Security Reality Checks (based on your questions)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Seeing many org devices<\/strong>: normal in a company tailnet. <strong>No automatic access<\/strong> to them; ACLs gate everything.<\/li>\n\n\n\n<li><strong>Can admins access my Mac?<\/strong> No, not silently. They can only allow the <em>network path<\/em>. You still need a listening service (SSH\/RDP\/etc.), and they need policy allowing their identity to reach your port. Use <code>--shields-up<\/code> if you want local deny-all.<\/li>\n\n\n\n<li><strong>Ex-employee scenario<\/strong>: once removed\/disabled, their keys are invalid and other devices won\u2019t talk to them. Managed Tailscale revocation blocks later access even if they kept old configs.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">9) Troubleshooting (real issues you hit + quick fixes)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">A) macOS: <code>Error: CLI credentials are not available BadResponse<\/code><\/h3>\n\n\n\n<p>Cause: GUI login stored in user context but command was run under <code>sudo<\/code> (root) or the helper wasn\u2019t initialized.<\/p>\n\n\n\n<p><strong>Fix (clean):<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Quit Tailscale from menu bar.<\/li>\n\n\n\n<li>In Terminal:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tailscale down || true\nsudo launchctl unload \/Library\/LaunchDaemons\/com.tailscale.tailscaled.plist 2&gt;\/dev\/null || true\n<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Reinstall\/repair:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>brew install --cask tailscale-app\nopen -a Tailscale\n<\/code><\/pre>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li><strong>Run<\/strong> <code>tailscale up<\/code> <strong>without<\/strong> sudo (GUI-install context).<\/li>\n\n\n\n<li>If you must use root (headless style), use an <strong>Auth Key<\/strong>:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tailscale up --auth-key tskey-XXXXXXXXXXXXXXXX\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">B) macOS: <code>tailscaled: command not found<\/code><\/h3>\n\n\n\n<p>Cause: The helper\/daemon binary isn\u2019t in PATH or wasn\u2019t installed.<\/p>\n\n\n\n<p><strong>Fix:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Remove old\/broken bits, reinstall GUI app, then open it once:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo rm -rf \/Applications\/Tailscale.app\nsudo rm -f \/usr\/local\/bin\/tailscale \/usr\/local\/bin\/tailscaled\nbrew uninstall tailscale tailscale-app --force 2&gt;\/dev\/null || true\n\nbrew install --cask tailscale-app\nopen -a Tailscale   # initializes helper and CLI shim\ntailscale version\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">C) \u201cI see many devices. Can they access me?\u201d<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not by default. Check or toggle:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>tailscale up --shields-up\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You still can connect <strong>outbound<\/strong> to others.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">D) \u201cPing works but SSH\/RDP doesn\u2019t\u201d<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check local firewall on the target (open port 22\/3389\/etc.).<\/li>\n\n\n\n<li>Confirm service is listening (<code>sshd<\/code>, RDP enabled).<\/li>\n\n\n\n<li>Ask admin to allow the ACL rule for your user \u2192 <code>hostname:port<\/code>.<\/li>\n\n\n\n<li>Test port from client:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>nc -vz 100.x.y.z 22\n# Windows PowerShell:\nTest-NetConnection -ComputerName 100.x.y.z -Port 3389\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">E) \u201cDirect path fails, slow over DERP\u201d<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>That\u2019s expected on blocked UDP\/NAT. If possible, allow outbound UDP on both sides to improve direct connectivity.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">F) \u201cCan\u2019t resolve names\u201d<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable <strong>MagicDNS<\/strong> in your tailnet and ensure your client is set to accept DNS from Tailscale. Use the hostname you see in the app.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">10) Guided \u201cTwo-Machine\u201d Tutorials (by OS pair)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">macOS \u2194 Linux (SSH + Ping)<\/h3>\n\n\n\n<p><strong>On both:<\/strong> install, log in, confirm <code>tailscale status<\/code>.<br><strong>From macOS:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ping 100.a.b.c\nssh user@100.a.b.c\n<\/code><\/pre>\n\n\n\n<p><strong>If passwordless wanted:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-keygen -t ed25519\nssh-copy-id -i ~\/.ssh\/id_ed25519.pub user@100.a.b.c\nssh user@100.a.b.c\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Windows \u2194 macOS (RDP + SMB)<\/h3>\n\n\n\n<p><strong>On Windows (host):<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable Remote Desktop (Settings \u2192 System \u2192 Remote Desktop), or via PowerShell (see earlier).<\/li>\n\n\n\n<li>Share a folder if you want SMB.<\/li>\n<\/ul>\n\n\n\n<p><strong>From macOS (client):<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Microsoft Remote Desktop \u2192 add <code>100.x.y.z<\/code> \u2192 connect (RDP).<\/li>\n\n\n\n<li>Finder \u2192 Connect to Server \u2192 <code>smb:\/\/100.x.y.z\/Share<\/code>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Windows \u2194 Linux (RDP from Linux client)<\/h3>\n\n\n\n<p><strong>On Windows (host):<\/strong> enable RDP (and firewall rules).<br><strong>On Linux (client):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install freerdp2-x11   # distro equivalent\nxfreerdp \/v:100.x.y.z\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Linux \u2194 Linux (SSH + Subnet router)<\/h3>\n\n\n\n<p><strong>On the router host:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tailscale up --advertise-routes=192.168.1.0\/24\n<\/code><\/pre>\n\n\n\n<p>Approve route in tailnet; then from the other Linux box:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ping 192.168.1.10      # device behind the router\nssh user@192.168.1.10\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">11) Admin-Only (for your personal tailnet or if you\u2019re an org admin)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Machines<\/strong>: rename, disable, delete devices; approve routes; set exit nodes.<\/li>\n\n\n\n<li><strong>Access Controls<\/strong>: edit JSON ACLs (who \u2192 what:port).<\/li>\n\n\n\n<li><strong>DNS<\/strong>: MagicDNS on\/off; custom resolvers; split DNS.<\/li>\n\n\n\n<li><strong>Keys<\/strong>: create\/revoke auth keys; device expiry policies.<\/li>\n\n\n\n<li><strong>Users\/Groups<\/strong>: invite\/remove users; map groups for ACLs.<\/li>\n\n\n\n<li><strong>Tailscale SSH<\/strong>: turn on; define per-host ssh rules in ACLs.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">12) Quick \u201cOwner\u2019s Safety\u201d Checklist<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep <strong>passwordless SSH<\/strong> set up correctly; disable SSH password auth if you own the server.<\/li>\n\n\n\n<li>Use <strong>NLA<\/strong> for RDP and strong account passwords.<\/li>\n\n\n\n<li>Prefer <strong>deny-by-default<\/strong> ACLs; only allow required ports\/hosts.<\/li>\n\n\n\n<li>Use <code>--shields-up<\/code> on laptops if you don\u2019t want inbound at all.<\/li>\n\n\n\n<li>Offboard fast: disable users\/devices; keys rotate automatically.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">You\u2019re all set \ud83c\udf89<\/h3>\n\n\n\n<p>With this, you can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Install on Windows\/macOS\/Linux,<\/li>\n\n\n\n<li>Add devices to the <strong>same tailnet<\/strong>,<\/li>\n\n\n\n<li>Verify connectivity (ping\/status),<\/li>\n\n\n\n<li>Access services (SSH, RDP, SMB, VNC, HTTP, DBs),<\/li>\n\n\n\n<li>Enable <strong>MagicDNS<\/strong>, <strong>exit nodes<\/strong>, <strong>subnet routers<\/strong>,<\/li>\n\n\n\n<li>Understand <strong>ACLs<\/strong>, <strong>admin capabilities<\/strong>, and <strong>security<\/strong>,<\/li>\n\n\n\n<li>Fix common macOS install\/auth issues,<\/li>\n\n\n\n<li>And keep your environment locked down.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>0) What Tailscale Is (30-second refresher) 1) Tailnet Basics (org vs personal) Privacy lever (local):To block all inbound connections to your device while staying online: (Works on macOS\/Linux CLI; on Windows\/macOS you can also toggle via the app UI.) 2) Install Tailscale (per OS) Windows 10\/11 macOS (App + CLI) Recommended (GUI + helper): If &#8230; <a title=\"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS?\" class=\"read-more\" href=\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\" aria-label=\"Read more about How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS?\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-639","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS? - DevSecOps School<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS? - DevSecOps School\" \/>\n<meta property=\"og:description\" content=\"0) What Tailscale Is (30-second refresher) 1) Tailnet Basics (org vs personal) Privacy lever (local):To block all inbound connections to your device while staying online: (Works on macOS\/Linux CLI; on Windows\/macOS you can also toggle via the app UI.) 2) Install Tailscale (per OS) Windows 10\/11 macOS (App + CLI) Recommended (GUI + helper): If ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\" \/>\n<meta property=\"og:site_name\" content=\"DevSecOps School\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-21T12:18:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-21T12:18:14+00:00\" \/>\n<meta name=\"author\" content=\"Rajesh Kumar\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rajesh Kumar\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\"},\"author\":{\"name\":\"Rajesh Kumar\",\"@id\":\"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/e414b640530af05905c2162ba4259f6c\"},\"headline\":\"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS?\",\"datePublished\":\"2025-10-21T12:18:13+00:00\",\"dateModified\":\"2025-10-21T12:18:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\"},\"wordCount\":1199,\"commentCount\":0,\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\",\"url\":\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\",\"name\":\"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS? - DevSecOps School\",\"isPartOf\":{\"@id\":\"https:\/\/devsecopsschool.com\/blog\/#website\"},\"datePublished\":\"2025-10-21T12:18:13+00:00\",\"dateModified\":\"2025-10-21T12:18:14+00:00\",\"author\":{\"@id\":\"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/e414b640530af05905c2162ba4259f6c\"},\"breadcrumb\":{\"@id\":\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#breadcrumb\"},\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/devsecopsschool.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/devsecopsschool.com\/blog\/#website\",\"url\":\"https:\/\/devsecopsschool.com\/blog\/\",\"name\":\"DevSecOps School\",\"description\":\"DevSecOps Redefined\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/devsecopsschool.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/e414b640530af05905c2162ba4259f6c\",\"name\":\"Rajesh Kumar\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b02d9501846e698677d30ae5e3d8648980cdd60ebaab000d5001f4612c9f0ff7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b02d9501846e698677d30ae5e3d8648980cdd60ebaab000d5001f4612c9f0ff7?s=96&d=mm&r=g\",\"caption\":\"Rajesh Kumar\"},\"sameAs\":[\"http:\/\/devsecopsschool.com\/blog\"],\"url\":\"https:\/\/devsecopsschool.com\/blog\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS? - DevSecOps School","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/","og_locale":"en_US","og_type":"article","og_title":"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS? - DevSecOps School","og_description":"0) What Tailscale Is (30-second refresher) 1) Tailnet Basics (org vs personal) Privacy lever (local):To block all inbound connections to your device while staying online: (Works on macOS\/Linux CLI; on Windows\/macOS you can also toggle via the app UI.) 2) Install Tailscale (per OS) Windows 10\/11 macOS (App + CLI) Recommended (GUI + helper): If ... Read more","og_url":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/","og_site_name":"DevSecOps School","article_published_time":"2025-10-21T12:18:13+00:00","article_modified_time":"2025-10-21T12:18:14+00:00","author":"Rajesh Kumar","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rajesh Kumar","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#article","isPartOf":{"@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/"},"author":{"name":"Rajesh Kumar","@id":"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/e414b640530af05905c2162ba4259f6c"},"headline":"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS?","datePublished":"2025-10-21T12:18:13+00:00","dateModified":"2025-10-21T12:18:14+00:00","mainEntityOfPage":{"@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/"},"wordCount":1199,"commentCount":0,"inLanguage":"en","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/","url":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/","name":"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS? - DevSecOps School","isPartOf":{"@id":"https:\/\/devsecopsschool.com\/blog\/#website"},"datePublished":"2025-10-21T12:18:13+00:00","dateModified":"2025-10-21T12:18:14+00:00","author":{"@id":"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/e414b640530af05905c2162ba4259f6c"},"breadcrumb":{"@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#breadcrumb"},"inLanguage":"en","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-configure-tailscale-in-linux-windows-macos\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devsecopsschool.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to install &amp; Configure Tailscale in Linux, Windows &amp; MacOS?"}]},{"@type":"WebSite","@id":"https:\/\/devsecopsschool.com\/blog\/#website","url":"https:\/\/devsecopsschool.com\/blog\/","name":"DevSecOps School","description":"DevSecOps Redefined","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devsecopsschool.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en"},{"@type":"Person","@id":"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/e414b640530af05905c2162ba4259f6c","name":"Rajesh Kumar","image":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b02d9501846e698677d30ae5e3d8648980cdd60ebaab000d5001f4612c9f0ff7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b02d9501846e698677d30ae5e3d8648980cdd60ebaab000d5001f4612c9f0ff7?s=96&d=mm&r=g","caption":"Rajesh Kumar"},"sameAs":["http:\/\/devsecopsschool.com\/blog"],"url":"https:\/\/devsecopsschool.com\/blog\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=639"}],"version-history":[{"count":1,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/639\/revisions"}],"predecessor-version":[{"id":642,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/639\/revisions\/642"}],"wp:attachment":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}