LFCE 93 🐧 Tailscale — Setup and Mesh Networking - KandZ

⏱️ Estimated read: 12 min | |

The previous chapter covered the concepts: the tailnet, the coordination service, and the data plane. This chapter is the operational sequence. It covers the installation, the authentication, the mesh connectivity that connects every device to every other device, and the three routing features that extend the tailnet beyond its own devices: the subnet router, the exit node, and Tailscale SSH. The LFCE exam expects the candidate to configure network traffic tunneling, and Tailscale is the managed mesh that makes WireGuard practical at scale.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The setup is a single install command and a tailscale up that opens a browser for authentication. The mesh is automatic: once two devices are authenticated to the same tailnet, they can reach each other by their 100.x.y.z addresses or their MagicDNS names. The routing features are opt-in: the subnet router advertises a local subnet, the exit node advertises itself as an internet gateway, and Tailscale SSH replaces the public SSH port with the identity-based access control. Each feature requires the device to advertise the capability and the admin to approve it in the console.

Key point: The tailscale up command authenticates the device and joins it to the tailnet. The subnet router advertises the routes with --advertise-routes, and the admin must approve the routes in the Machines page before the other devices can use them . The exit node advertises itself with --advertise-exit-node, and the admin must enable the “Use as exit node” option in the route settings . The Tailscale SSH is enabled with tailscale set --ssh, and the access is controlled by the ssh section of the tailnet policy file, not by the public SSH port .

Why the mesh requires explicit routing approval

The route-approval problem.

A subnet router advertises the routes, but the routes are not active until the admin approves them in the admin console. The approval is the security boundary: a device that advertises a route does not automatically expose the subnet to the tailnet. The admin must review the route and enable it in the Machines page . The same applies to the exit node: the device advertises itself, but the admin must check the “Use as exit node” box in the route settings before the other devices can route their traffic through it .

The policy problem.

The default tailnet policy allows all devices to communicate with each other. The subnet router and the exit node are reachable, and the devices can use them, unless the policy is customized. The autogroup:internet is the destination that grants the permission to use an exit node. If the policy does not grant access to autogroup:internet, the devices cannot route their internet traffic through the exit node, even if the exit node is configured . The Tailscale SSH is controlled by the ssh section of the policy, which defines the users and the local accounts that can connect .

The NAT problem.

The direct connection between two devices requires the NAT traversal to succeed. The tailscale netcheck command shows the NAT type and the DERP latency, and the tailscale ping command shows whether the connection to a specific peer is direct or relayed . A device behind a hard NAT cannot accept a direct connection, and the traffic is relayed through the DERP servers. The relay is slower, but it works, and the traffic remains encrypted.

a. The installation and the mesh connectivity

The installation is the curl | sh script, and the authentication is the tailscale up command.

# Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh

# Authenticate and join the tailnet
sudo tailscale up

# The command prints a URL; open it and log in with the identity provider

The install script works on the mainstream distributions, including Ubuntu, Debian, RHEL, Fedora, and Amazon Linux . The tailscale up command starts the authentication flow, and the URL it prints must be opened in a browser to complete the login. After the authentication, the device appears in the Machines page of the admin console .

The mesh is the set of devices that are authenticated to the same tailnet. Each device receives a 100.x.y.z address, and the devices can reach each other by that address or by the MagicDNS name.

# Show the devices in the tailnet
tailscale status

# Check the connection type to a specific peer
tailscale ping <peer-hostname>

# Show the NAT type and the DERP latency
tailscale netcheck

The tailscale status command lists the devices, their addresses, and the connection type . The tailscale ping command shows whether the connection is direct or relayed, and the tailscale netcheck command shows the NAT type that determines it.

b. The subnet router and the exit node

The subnet router exposes a local subnet to the tailnet, and the exit node routes the internet traffic through a device in the tailnet.

# Advertise a local subnet
sudo tailscale up --advertise-routes=192.168.1.0/24

# Advertise the device as an exit node
sudo tailscale up --advertise-exit-node

# Enable IP forwarding on the device
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding=1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

The --advertise-routes option tells the device to advertise the subnet to the tailnet, and the --advertise-exit-node option tells it to advertise itself as an internet gateway . The IP forwarding must be enabled on the device, or the packets are not forwarded . The routes and the exit node must be approved in the admin console before the other devices can use them.

On the client, the exit node is selected with the --exit-node option or the tailscale set command.

# Use the exit node for all the internet traffic
sudo tailscale set --exit-node=<exit-node-ip>

# Use the exit node and keep the local network access
sudo tailscale set --exit-node=<exit-node-ip> --exit-node-allow-lan-access

The --exit-node option routes the internet traffic through the exit node, and the --exit-node-allow-lan-access option keeps the local network reachable . The exit node can also be selected from the Tailscale client’s menu, and the “Recommended” option chooses the exit node based on the location and the latency .

c. The Tailscale SSH and the policy file

The Tailscale SSH replaces the public SSH port with the identity-based access control. The device advertises the SSH capability, and the policy file defines who can connect.

# Enable Tailscale SSH on the device
tailscale set --ssh

The tailscale set --ssh command tells the device to accept the SSH connections through the tailnet . The access is controlled by the ssh section of the tailnet policy file, which defines the source users and the destination users.

{
  "ssh": [
    {
      "action": "accept",
      "src": ["autogroup:member"],
      "dst": ["autogroup:self"],
      "users": ["root", "autogroup:nonroot"]
    }
  ]
}

The ssh section defines the rules. The src is the source user or group, the dst is the destination device, and the users is the local accounts that the remote user can log in as . The autogroup:member is all the tailnet members, and the autogroup:self is the device’s own owner. The autogroup:nonroot is the non-root local accounts . The Tailscale SSH does not use the SSH keys or the passwords; the identity provider authenticates the user, and the policy file authorizes the access.

Complete Example Session

# ============================================
# PART 1: INSTALL TAILSCALE
# ============================================
curl -fsSL https://tailscale.com/install.sh | sh

# ============================================
# PART 2: AUTHENTICATE
# ============================================
sudo tailscale up
# Open the URL and log in

# ============================================
# PART 3: CHECK THE MESH
# ============================================
tailscale status
tailscale ip

# ============================================
# PART 4: ADVERTISE A SUBNET
# ============================================
sudo tailscale up --advertise-routes=192.168.1.0/24
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

# ============================================
# PART 5: APPROVE THE ROUTE IN THE CONSOLE
# ============================================
# Machines page → the device → Edit route settings → Enable the route

# ============================================
# PART 6: ADVERTISE AN EXIT NODE
# ============================================
sudo tailscale up --advertise-exit-node

# ============================================
# PART 7: APPROVE THE EXIT NODE
# ============================================
# Machines page → the device → Edit route settings → Use as exit node

# ============================================
# PART 8: USE THE EXIT NODE
# ============================================
sudo tailscale set --exit-node=<exit-node-ip>

# ============================================
# PART 9: ENABLE TAILSCALE SSH
# ============================================
tailscale set --ssh

# ============================================
# PART 10: CONNECT VIA TAILSCALE SSH
# ============================================
ssh <vm-tailscale-ip>

The ten parts demonstrate the complete Tailscale setup: the installation, the authentication, the mesh check, the subnet router, the route approval, the exit node, the exit node approval, the exit node use, the Tailscale SSH, and the SSH connection. The critical steps are Parts 5 and 7: the routes and the exit node are advertised by the device, but they are not active until the admin approves them in the console.

Quick Reference

Installation and Authentication

Command	Purpose
`curl -fsSL https://tailscale.com/install.sh \| sh`	Install
`tailscale up`	Authenticate and join
`tailscale status`	Show the mesh
`tailscale ip`	Show the device’s `100.x.y.z` address
`tailscale ping <peer>`	Check the connection type
`tailscale netcheck`	Show the NAT type

Subnet Router

Command	Purpose
`tailscale up --advertise-routes=<cidr>`	Advertise a subnet
`sysctl -w net.ipv4.ip_forward=1`	Enable forwarding
Admin console → Edit route settings	Approve the route

Exit Node

Command	Purpose
`tailscale up --advertise-exit-node`	Advertise as an exit node
`tailscale set --exit-node=<ip>`	Use the exit node
`tailscale set --exit-node-allow-lan-access`	Keep the local network access
Admin console → Use as exit node	Approve the exit node

Tailscale SSH

Command	Purpose
`tailscale set --ssh`	Enable Tailscale SSH
Policy file `ssh` section	Define the allowed users

Best Practices

✅ Do This:

# Enable IP forwarding on the subnet router and the exit node
sysctl -w net.ipv4.ip_forward=1                                # ✅

# Approve the routes in the admin console
# The routes are not active until the admin approves them         # ✅

# Use the --exit-node-allow-lan-access with the exit node
tailscale set --exit-node=<ip> --exit-node-allow-lan-access     # ✅

# Use the Tailscale SSH instead of the public SSH port
tailscale set --ssh                                            # ✅

# Check the connection type before troubleshooting
tailscale ping <peer>                                          # ✅

❌ Don’t Do This:

# Advertise the routes without the IP forwarding
tailscale up --advertise-routes=192.168.1.0/24    # Not forwarded # ❌

# Expect the routes to be active without the approval
# The admin must enable them in the console                     # ❌

# Use the exit node without the autogroup:internet grant
# The policy must allow the internet routing                    # ❌

# Keep the public SSH port open after enabling the Tailscale SSH
# Close the port and use the tailnet instead                    # ❌

# Assume the connection is direct
# The hard NAT forces the relayed connection                    # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Subnet route not working	IP forwarding disabled or route not approved	Enable forwarding; approve in the console
Exit node not available	Not approved in the console	Check “Use as exit node”
Slow connection	Relayed through DERP	Check `tailscale ping`
Tailscale SSH connection refused	Policy file missing the `ssh` rule	Add the rule
Device not in the tailnet	Authentication not completed	Run `tailscale up`

Real-World Examples

1. Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh

2. Authenticate

sudo tailscale up

3. Show the mesh

tailscale status

4. Advertise a subnet

sudo tailscale up --advertise-routes=192.168.1.0/24

5. Advertise an exit node

sudo tailscale up --advertise-exit-node

6. Use the exit node

sudo tailscale set --exit-node=<ip>

7. Use the exit node with the LAN access

sudo tailscale set --exit-node=<ip> --exit-node-allow-lan-access

8. Enable Tailscale SSH

tailscale set --ssh

9. Connect via Tailscale SSH

ssh <vm-tailscale-ip>

10. Check the connection type

tailscale ping <peer>

Visual

The Mesh and the Routing Features

┌──────────────────────────────────────────────────────────────┐
│  THE MESH CONNECTS THE DEVICES; THE ROUTING FEATURES EXTEND IT│
│                                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Tailnet                                                │  │
│  │                                                        │  │
│  │ Laptop (100.64.0.1) ◀────▶ Server (100.64.0.2)         │  │
│  │       │                          │                     │  │
│  │       │                          │                     │  │
│  │       ▼                          ▼                     │  │
│  │ Subnet router (100.64.0.3)   Exit node (100.64.0.4)    │  │
│  │       │                          │                     │  │
│  │       ▼                          ▼                     │  │
│  │ 192.168.1.0/24              Internet                   │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

The Route Approval

┌──────────────────────────────────────────────────────────────┐
│  THE DEVICE ADVERTISES; THE ADMIN APPROVES                   │
│                                                              │
│  Device: tailscale up --advertise-routes=192.168.1.0/24      │
│       │                                                      │
│       ▼                                                      │
│  Admin console → Machines → Edit route settings              │
│       │                                                      │
│       ▼                                                      │
│  Enable the route                                            │
│       │                                                      │
│       ▼                                                      │
│  The route is distributed to the tailnet                     │
└──────────────────────────────────────────────────────────────┘

The Tailscale SSH

┌──────────────────────────────────────────────────────────────┐
│  THE IDENTITY PROVIDER AUTHENTICATES; THE POLICY AUTHORIZES  │
│                                                              │
│  Client ──▶ Tailscale coordination ──▶ Policy check          │
│       │                                                      │
│       ▼                                                      │
│  The `ssh` section of the policy file                        │
│       │                                                      │
│       ▼                                                      │
│  Accept → the SSH connection is established                  │
│                                                              │
│  No public port, no SSH keys, no passwords.                  │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Install	`curl -fsSL https://tailscale.com/install.sh \| sh`
Authenticate	`tailscale up`
Mesh status	`tailscale status`
Subnet router	`tailscale up --advertise-routes=<cidr>`
Exit node	`tailscale up --advertise-exit-node`
Use exit node	`tailscale set --exit-node=<ip>`
LAN access with exit node	`--exit-node-allow-lan-access`
Tailscale SSH	`tailscale set --ssh`
Route approval	Admin console → Edit route settings
Exit node approval	Admin console → Use as exit node

Key takeaways:

The installation is the install script, and the authentication is tailscale up. The command prints a URL that must be opened in a browser to complete the login. After the authentication, the device appears in the Machines page and receives a 100.x.y.z address .
The subnet router advertises the routes, and the admin approves them. The --advertise-routes option tells the device to advertise the subnet, and the IP forwarding must be enabled. The routes are not active until the admin enables them in the Machines page .
The exit node advertises itself, and the admin approves it. The --advertise-exit-node option tells the device to act as an internet gateway, and the admin must check the “Use as exit node” box in the route settings. The client selects the exit node with the --exit-node option .
The Tailscale SSH replaces the public SSH port. The tailscale set --ssh command enables the SSH capability, and the ssh section of the policy file defines the allowed users. The identity provider authenticates the user, and the policy authorizes the access .
The autogroup:internet is the exit node permission. The policy must grant access to autogroup:internet for the devices to use the exit node. The exit node device itself is not the destination; the internet is .
The connection type determines the performance. The direct connection is the fastest, and the DERP relay is the fallback. The tailscale ping command shows whether the connection is direct or relayed, and the tailscale netcheck command shows the NAT type .

Remember: Tailscale setup is the install, the authentication, and the routing features. The mesh is automatic once the devices are authenticated. The subnet router and the exit node require the IP forwarding and the admin approval. The Tailscale SSH requires the policy file. The 100.x.y.z address is stable, and the MagicDNS resolves the hostnames. The result is a mesh that connects the devices without the port forwarding, the key exchange, or the firewall rules, and it authenticates the users through the identity provider they already use.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!