Learn Tailscale - Taildrop & File Transfer

#Introduction

Sending files between your own devices is often more cumbersome than you'd think: uploading to cloud storage then downloading again, or setting up SCP with an IP you have to remember. And yet those devices are already connected in a single encrypted tailnet.

Taildrop takes advantage of that connection: sharing files between devices in the tailnet directly and encrypted, with no cloud storage in between. Episode 11 covers how to use it via tailscale file send and tailscale file get, the most beneficial use cases, and Taildrop's limitations and configuration.

#Taildrop: Basics

#Sending Files

The basic command is tailscale file send:

tailscale file send backup.tar.gz server-home

The tailscale file send backup.tar.gz server-home command sends the file directly to the destination node over the tailnet path. In older versions, this command was named tailscale file cp — the new send syntax is more explicit.

#Receiving Files

On the receiving side, incoming files are automatically stored in the Taildrop download directory. To view or write them explicitly:

tailscale file get

tailscale file get retrieves files waiting on this node. If you prefer a specific path, point the target with an argument.

#Interactive and Snapshot Mode

For a quick one-way send, use snapshot mode without specifying a recipient — Tailscale offers interactive choices. Great when you don't remember the exact node name.

#Use Cases

#Transferring Files Between Laptop and Server

The most common scenario: copying logs, backups, or binaries from a laptop to a production server:

tailscale file send app-release.tar.gz web-prod
ssh devnull@web-prod 'ls ~/Downloads'

No need to know the IP, no need to use public file-sharing services — everything runs over the encrypted tunnel.

#Fast Synchronization Without Cloud Storage

Taildrop isn't a two-way sync tool, but for secure one-way file pushes it's very effective. For example, distributing configs to several nodes:

for host in web-prod db-aws nas-home; do
  tailscale file send .env $host
done

The loop above sends the .env file to three nodes at once. Files are available immediately with no additional infrastructure.

#Sharing Between Personal Devices

From phone or tablet to computer and back, Taildrop works cross-platform. The Tailscale Android and iOS apps have an integrated file-sharing interface, so sharing between personal devices feels like AirDrop, but cross-OS and cross-location.

#Limitations and Configuration

#Size and Directory Limits

• File size is limited per file (the default is generous enough for common needs).
• The receiving directory is system-managed, usually a dedicated Taildrop downloads folder.
• Incoming files can only be retrieved by the destination node — no third party on the path.

#Configuring Taildrop Policy

Admins can restrict who can send to specific nodes via ACLs. The rules use a special keyword in the ACL file:

{
  "acls": [
    { "action": "accept",
      "src": ["group:devops"],
      "dst": ["tag:server:5201"] }
  ]
}

Port 5201 is Taildrop's dedicated port. The rule above allows only group:devops to send files to nodes tagged server — a detail often forgotten when securing a tailnet.

#Default Security

Taildrop is only active between nodes already authenticated in the same tailnet, and data is encrypted end-to-end with WireGuard. You don't need to worry about files traveling in plaintext.

#Best Practices

• Use unique file names so they don't get overwritten on the receiver.
• Check tailscale file get on the server before processing files.
• Restrict port 5201 in the ACL to control who can send.
• For sensitive files, combine with disk encryption on the receiving node.

#Closing

Episode 11 added Taildrop to your toolset: sharing files between devices directly, encrypted, and without cloud storage — from laptop to server, between nodes, or between personal devices.

Key takeaways:

• Send files with tailscale file send <file> <node>.
• Receive files with tailscale file get.
• Transfers run directly over the encrypted tunnel.
• Useful for logs, backups, binaries, and config pushes.
• Taildrop's port is 5201 — control it via ACLs.
• No need to know IPs: just the MagicDNS node name.

In the next episode, episode 12, we'll cover encryption and the security model — how WireGuard encrypts traffic end-to-end, public and private key management, why traffic doesn't flow through the control plane, the NAT traversal mechanism, and the role of DERP relays with their privacy implications.