Learn Tailscale - First Setup & Onboarding

#Introduction

In episode 2 you understood Tailscale's architecture. Now it's time to complete your first onboarding properly. Many beginners jump straight to advanced commands before mastering the basic flow: login, node verification, and device management in the admin console.

Episode 3 guides you step by step: running tailscale up and completing authentication in the browser, reading tailscale status, and then getting familiar with the admin console — especially the Machines page for naming devices, configuring key expiry, and removing unused devices.

#Installation and First Login

#Running tailscale up

After installing in episode 0, activate the connection with Tailscale's main command:

sudo tailscale up

The output of this command shows a URL like https://login.tailscale.com/a/abcd1234 and, if a browser is available, opens it automatically. The sudo tailscale up command is the gateway to the entire Tailscale machine: it registers your node keys with the control plane and waits for you to log in.

#Completing Authentication in the Browser

On the login page, you choose a provider (Google, GitHub, Microsoft, or another) and grant access. If this is your first device, the admin console will offer to create a new tailnet. Once approved, the terminal shows a success message like Success. — your device has joined the tailnet.

Verify the connection:

tailscale status

The output shows a table of nodes: name, tailnet IP, and status. A single row for your device is enough at this step.

#Get to Know Two Other Basic Commands

• tailscale login: re-authenticates a node that's already installed.
• tailscale logout: disconnects and removes the node from the tailnet.

tailscale login
tailscale logout

Don't run tailscale logout now if you haven't finished experimenting — use it when you genuinely want to release a device.

#Getting to Know the Admin Console

#The Machines Page

The admin console at login.tailscale.com is the control center of your tailnet. The main page shows Machines: a list of all connected devices. Each row contains important information:

• Device name: the hostname used by MagicDNS.
• Address: the tailnet IP 100.x.x.x.
• Owner: the account that authenticated the device.
• Key expiry: the date the node key expires.

#Naming Devices

The default device name is taken from the OS hostname. In the admin console, click the three-dot menu on a device row and select Edit name — or set it from the CLI when connecting:

sudo tailscale up --hostname=lab-server

After that, MagicDNS names it lab-server.<tailnet-name>.ts.net. Descriptive names are a huge help once your tailnet has dozens of nodes.

#Configuring Key Expiry

Key expiry is the validity period of a node key. When it expires, the node needs to log in again — this is a security mechanism so unused devices don't accumulate forever. In the admin console, the Settings page lets you change the default duration (for example from 180 days to 30 days) or disable key expiry for specific devices.

#Removing Devices

When a device is no longer used — an old laptop, a retired server — remove it promptly:

sudo tailscale logout

Or from the admin console: click the three-dot menu on the device row, then Remove device. A removed device can no longer be accessed and must log in again to come back.

#The Correct Onboarding Flow

#New Device Checklist

Follow this order every time you add a new device:

1. Install Tailscale with the official installer for your OS.
2. Run sudo tailscale up and complete the login in the browser.
3. Give it a descriptive name via --hostname or the admin console.
4. Make sure tailscale status shows the correct node.
5. Set up tags and ACLs (episode 6) if the device has a special role.

sudo tailscale up --hostname=worker-01
tailscale status
tailscale ip
tailscale set --accept-routes=true

The tailscale set --accept-routes=true command enables route acceptance — we'll cover it in episodes 8 and 9.

#Common Beginner Mistakes

• Running tailscale up without sudo on Linux — the daemon needs root access.
• Naming all devices with confusing default hostnames.
• Not configuring key expiry, so dead nodes pile up.
• Running tailscale logout while you still need remote access.

#Onboarding Summary

First onboarding is the gateway to all of Tailscale's features. Once you've been through the login flow, verification, and Machines management, you'll have the same habits as experienced tailnet administrators.

#Closing

Episode 3 completed your first setup: tailscale up and browser authentication, reading tailscale status, and mastering the Machines page to name devices, configure key expiry, and remove devices.

Key takeaways:

• tailscale up is the main gateway to join a tailnet.
• Authentication happens in the browser via the admin console.
• Give every device a descriptive name.
• Key expiry is a security mechanism — configure it wisely.
• Remove unused devices via logout or the admin console.

In the next episode, episode 4, we'll cover device & connectivity management — connecting many devices across operating systems (Linux, macOS, Windows, Android, iOS) to a single tailnet, plus connection diagnostics with tailscale ping, tailscale status, tailscale ip, and how to read direct versus relay paths.