Tailscale1.104.1

Securely connect people, workloads, and even AI agents to anything on the internet with Tailscale, the secure connectivity platform built on WireGuard(R). Tailscale brings identity to the network layer so you can control access based on users, groups, tags, and devices instead of IP addresses, applying Zero Trust principles end-to-end across every environment.

Tailscale transforms your existing network from a legacy hub and spoke model to a modern, lightweight, and responsive mesh networking architecture that eliminates single points of failure and delivers better performance, scalability, and security for your end users, devices, and remote resources.

Tailscale can be used for your Homelab VPN and connectivity, Business VPN, Workload Connectivity across clouds, Kubernetes clusters, regions, and environments, Privileged Access Management (PAM), Edge & IoT, CI/CD, and Securing AI - all on the same platform.

Replace legacy VPNs, connect workloads across on-prem and cloud infrastructure providers, power Zero Trust initiatives, and make remote access secure by simplifying software-defined networking and security operations. Modernize your home, your organization, and your enterprise networking at scale with Tailscale.

Tailscale is hardware-agnostic, so you can make decisions about your hardware independently from decisions about your network. Tailscale creates an overlay network, using your existing network, so you can incrementally deploy Tailscale without needing new network switches or to change your network architecture.

Tailscale integrates with 100+ technologies and dozens of identity providers, and is available on a wide range of platforms - including Apple’s macOS, iOS, and tvOS - so you can securely connect from wherever you work.

Version History New: Devices can be pinned on iOS.
New: Taildrop supports URLs and text selections.
Fixed: An issue that could cause exit notes to not appear when using a custom coordination server is resolved.
Fixed: An issue that could cause public DNS to silently break when Tailscale is the system DNS resolver is resolved.
Changed: WireGuard packet buffering uses less memory while waiting for peer handshakes.
Changed: WireGuard packet queue depth scales with CPU core count, reducing peak memory usage under heavy traffic. 1.104.1 6d ago Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server. 1.102.4 Sep 11 Fixed: Memory usage is reduced for devices on large tailnets.
Fixed: When MagicDNS is disabled, unqualified hostnames are correctly forwarded to the configured nameservers.
Fixed: Resolved an issue where nodes with Tailnet Lock enabled on large tailnets would experience startup failures. 1.102.3 Aug 21 Fixed: A regression causing incoming Tailscale Funnel connections to fail is resolved. 1.102.2 Aug 5 New: A new split-plane layout is used on iPad in both portrait and landscape orientation and on sufficiently wide iPhones in landscape.
New: The status widget supports toggling the active exit node inline.
Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes.
Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface.
Changed: Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets.
Changed: Deprecated formats for 4via6 MagicDNS names are no longer available to use.
Fixed: Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go.
Fixed: A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to immediately connect to the node.
Fixed: A memory leak that occurred after a failed WireGuard handshake has been resolved.
Fixed: Resolved an issue that prevented connectivity via Tailscale Peer Relays after a client restart.
Fixed: Domain matching on-demand rules are evaluated in the correct order.
Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved. 1.102.1 Aug 4 Fixed: Nodes advertising filter and reject packets from service IPs on ports they do not advertise.
Fixed: Tailscale Serve and Tailscale Funnel terminate path walks for non-absolute paths, preventing CPU core pinning.
Fixed: An issue where a user could be logged out of Tailscale when changing the tag on a device via CLI has been resolved. 1.98.9 Jul 15 Fixed: An issue causing connectivity disruptions when the operating system wakes from sleep in wireguard-go is resolved.
Fixed: An issue causing excessive handshake initiation retries in wireguard-go is resolved. 1.98.8 Jun 30 Fixed: An issue causing a deadlock when processing peer changes and disconnecting from the Tailscale control server is resolved. 1.98.5 Jun 1 - Changed: Go is updated to 1.26.3.
- Fixed: A regression from 1.98.0 is patched, ensuring MagicDNS resolves tailnet hostnames after a network change. Windows clients are unaffected. 1.98.2 May 19 Fixed: An issue that could cause the network extension to encounter an out of memory condition on large tailnets is resolved. 1.96.5 Mar 30 Changed: iOS bug report ID displays in its entirety instead of being truncated.
Fixed: The Taildrop Send File action and shortcut do not transmit empty files on iOS version 26 or later. 1.96.2 Mar 18 Fixed: Memory leak caused by high network map response rates is resolved. 1.94.2 Mar 4 Changed: New client metrics are available.
Changed: Identity tokens are automatically generated for workload identities.
Fixed: Ping view is Tailscale Peer Relay aware. 1.94.1 Jan 29 Fixed: WireGuard configuration that occurs automatically in the client, no longer results in a panic. 1.92.3 12/16/2025 - Fixed: Redundant label text for VoiceOver is removed from the exit node picker. 1.92.1 12/10/2025 - Fixed: The client no longer deadlocks during event bursts.
- Fixed: The client no longer hangs after wake up when port mapping is in use and interfaces are slow to become available. 1.90.9 11/26/2025 New: Clients can use configured DNS resolvers for all domains even when the client also uses an exit node using the nameserver settings in the DNS page of the admin console.
New: Node keys will be renewed seamlessly, so clients will maintain existing connections while re-authenticating.
Changed: Go is updated to version 1.25.3.
Fixed: Unnecessary path discovery packets over DERP servers are suppressed.
Fixed: Exit node selection using the iOS Shortcuts app work as expected.
Fixed: Client users preference for automatic/recommended exit node selection is remembered as expected. 1.90.4 10/29/2025 - The macOS system setting Block All incoming connections no longer causes intermittent connectivity disruptions, when enabled. 1.88.4 10/15/2025 Fixed: Devices list can fail to appear on first connect. 1.88.3 09/28/2025 Fixed: UserDefaults, which apps and system policies use to store and read preferences, force string values like true or 1 into Booleans as expected.
Fixed: The Settings button displays correctly when no account is logged in to the client. 1.88.2 09/18/2025 Bug fixes and performance improvements 1.88.1 09/12/2025 * tsStateEncrypted device posture attribute for checking whether the Tailscale client state is encrypted at rest.
* Cross-site request forgery (CSRF) issue that may have resulted in a log in error when accessing the web interface.
* Hostnames are verified as expected when using CONNECT HTTPS proxy to connect to the control plane.
* Recommended exit node when the previously recommended exit node is offline.
* A deadlock issue that may have occurred in the client.
* An occasional crash when establishing a new port mapping with a gateway or firewall. 1.86.4 08/22/2025 new: Setting to toggle subnet routing.
fixed: Issue where Taildrop notifications may not be presented.
fixed: Issue where subnet routing would default to off. 1.84.1 05/30/2025 new: AlwaysOn.Enabled and AlwaysOn.OverrideWithReason policy settings, which enable and configure a Tailscale client mode where the client stays connected at all times, unless an exception applies.
changed: ForceEnabled policy setting is deprecated in favor of the AlwaysOn policy setting.
fixed: Taildrop share sheet displays the correct error page when the tunnel is not connected.
fixed: Tailscale automatically recreates and/or reactivates its VPN configuration on start.
fixed: Client (GUI) logs are properly captured and recorded in bug reports.
fixed: Occasional crash in client during engine updates. 1.84.0 05/22/2025 New: DERP functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use Let's Encrypt or WebPKI certificates.
Fixed: Memory leak issue related to shortcuts is resolved.
Fixed: MagicDNS intermittent configuration failures no longer occur when waking from sleep.
Fixed: Seamless key renewals occur as expected, ensuring the client remains connected.
Fixed: Captive portal detection reliability is improved on some in-flight Wi-Fi networks.
Fixed: Port mapping success rate is improved by retrying in additional error cases.
Changed: NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available, in the event of a slow or misbehaving server. 1.82.0 04/10/2025