Is Tailscale fully open source?

The core daemon (`tailscaled`) and CLI (`tailscale`) in this repo are open source under BSD-3-Clause. Some platform-specific GUI wrappers (macOS, iOS, Windows) are closed source, and parts of the coordination/control service are not included in this repository.

What platforms does tailscaled support?

It runs on Linux, Windows, and macOS, with partial support on FreeBSD and OpenBSD. The same underlying code also powers the iOS and Android apps, though their GUIs are in separate repos.

Do I need a Go toolchain to install Tailscale?

No. Prebuilt packages for most distros and platforms are available at pkgs.tailscale.com. Building from source with Go is only needed if you want to compile it yourself or package it for a distro.

How does Tailscale handle authentication and 2FA?

Devices join a network by authenticating through an SSO/OAuth identity provider rather than static keys, which lets you inherit 2FA protections already configured on that provider.

How is this different from running plain WireGuard?

Tailscale adds automatic key distribution, NAT traversal, and identity-based access control on top of WireGuard's encrypted transport, removing the need to manually configure peers and firewall rules.

Can I use this without relying on Tailscale's hosted service?

This repo contains the client daemon and CLI, but full self-hosting of the coordination server isn't covered here; check the linked opensource.tailscale.com page for details on what's open versus hosted.

Tailscale: Open source WireGuard mesh VPN

Tailscale is a mesh VPN built on top of WireGuard. This repository holds the core open source code: the tailscaled daemon and the tailscale CLI, which run on Linux, Windows, macOS, and (with varying support) FreeBSD and OpenBSD. The same code powers the iOS and Android apps, though their GUI wrappers live in separate repos. It's aimed at developers, sysadmins, and teams who want private networking between machines without dealing with firewall rules, port forwarding, or a central VPN gateway.

Instead of a traditional hub-and-spoke VPN, Tailscale creates direct encrypted connections between devices using WireGuard, and layers identity-based access control on top. Authentication happens through SSO providers rather than shared keys or certificates you manage by hand.

Key features

WireGuard transport: All traffic between devices runs over WireGuard, giving you modern, audited encryption without hand-rolling key management.
SSO-based identity: Devices join your network by authenticating through an identity provider (OAuth/SSO), not static pre-shared keys.
2FA support: Because auth flows through your identity provider, you get two-factor protection on network access for free.
Cross-platform daemon: tailscaled runs on Linux, Windows, macOS, and partially on FreeBSD/OpenBSD, with the same core code driving iOS and Android clients.
NAT traversal: Devices connect directly to each other where possible, cutting out the need to expose ports or run a central relay for most traffic.
CLI-first control: The tailscale command gives you scriptable control over network status, connections, and configuration.
Open core: The daemon and CLI are open source under BSD-3-Clause; platform GUI wrappers on some OSes are closed, but the networking logic is not.

Ideal use cases

Tailscale fits well if you need to connect servers, laptops, and personal devices into one private network without managing your own VPN server or juggling firewall exceptions. It's a good match for remote teams accessing internal services, homelab setups exposing NAS or dev boxes securely, and CI/build agents that need to reach private infrastructure without opening it to the internet.

It's also useful for anyone who wants 2FA-gated network access tied to an existing SSO provider rather than distributing VPN certificates by hand.

It's less of a fit if you need a fully self-hosted, closed-network solution with zero dependency on external identity providers or coordination servers, or if your environment can't tolerate any reliance on Tailscale's control plane for device coordination (some coordination server functionality is not part of this open source repo). If you just need a point-to-point WireGuard tunnel with static config and no identity layer, plain WireGuard alone may be simpler.

Installation

Prebuilt packages for most distros and platforms are available at pkgs.tailscale.com. This is the recommended path for most users.

To build from source, you need the latest Go release (the project tracks current Go versions closely):

go install tailscale.com/cmd/tailscale{,d}

If you're packaging Tailscale for distribution, use the provided build script instead, so version and commit info gets embedded in the binaries:

./build_dist.sh tailscale.com/cmd/tailscale
./build_dist.sh tailscale.com/cmd/tailscaled

If your distro's conventions don't allow build_dist.sh, replicate what it does manually so bug reports include accurate version information.

The macOS, iOS, and Windows apps use this repository's code but add small GUI wrappers; those wrappers are not open source on non-open platforms. The Android app, Synology package, QNAP package, and Chocolatey packaging each live in their own separate repositories under the Tailscale GitHub org.