Learn Tailscale - Device & Connectivity Management

#Introduction

In episode 3 you successfully connected a single device. Now it's time to scale: add laptops, servers, NAS, and cloud instances to one tailnet. Tailscale's power really shows when these devices — sitting on different networks — can reach each other as if they were on the same LAN.

Episode 4 covers cross-OS device management and connection diagnostics. You'll learn how to add new devices running various operating systems, then verify connectivity with tailscale ping, tailscale status, and tailscale ip — and distinguish between direct and relay paths.

#Connecting Many Devices

#One Tailnet, Many Nodes

Every device that logs into the same account (or is allowed by ACLs) joins the same tailnet. It doesn't matter whether the device is at home, the office, or in the cloud — as long as it can reach the internet, it can join. Each device just needs to be installed and brought up:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --hostname=aws-1

The same commands work on every Linux distribution. For other operating systems, use the official installer and then run tailscale up.

#Cross-OS Connectivity

Tailscale is cross-platform. Common scenarios fully supported:

• Linux: servers, VPS, routers, and headless boxes.
• macOS and Windows: laptops and office workstations.
• Android and iOS: access to home servers from your phone.
• NAS: Synology, QNAP (we cover these further in episode 20).

The important thing to remember: every node in the tailnet can reach every other node as long as the ACL allows it. Once all devices are up, look at the result:

tailscale status

#Connection Diagnostics

#tailscale ping

The fastest way to verify a connection between two nodes is tailscale ping — it sends a probe over the Tailscale path, not a regular internet ICMP:

tailscale ping aws-1
tailscale ping 100.101.102.103

The important part is the tail end of the pong line:

• via direct: a direct connection between nodes succeeded.
• via DERP(region): the connection goes through a relay because direct failed.

The tailscale ping aws-1 command is the first diagnostic you should memorize.

#tailscale status and ip

For an overview of the whole tailnet, use tailscale status — it lists all nodes, IP addresses, OS, and their owners. Meanwhile, tailscale ip shows your own node's addresses:

tailscale status
tailscale ip -4
tailscale ip -6

With tailscale ip -4, you get this node's IPv4 address inside the tailnet — useful when writing firewall rules or application configuration.

#Distinguishing Direct vs Relay Paths

Understanding connection paths matters for performance troubleshooting:

• Direct: traffic flows through a WireGuard tunnel directly between nodes. Low latency, no intermediary server.
• Relay (DERP): traffic flows through an encrypted relay server. Higher latency, usually only when direct isn't possible (symmetric NAT, strict network).

tailscale ping --c 3 node-server
tailscale ping --c 3 aws-1

Try several nodes at once. If almost everything is via DERP, there's a traversal issue that can be investigated with tailscale netcheck (episode 18).

#Device Management at Small Scale

#Tidying Up Names and Identity

With many devices, names become the key to navigation. Use a consistent convention: role-location like web-prod, nas-home, vpn-singapore. Set it via the admin console or at up time:

sudo tailscale up --hostname=web-prod

#Keeping an Eye on Inactive Devices

tailscale status shows which nodes are online and offline. Devices that have been offline for a long time usually signal a retired device — remove it promptly via the admin console or tailscale logout on the device side. Make sure key expiry is enabled so unused nodes automatically require re-authentication.

#Summary

Device management in Tailscale is very simple because of one principle: install, up, and done. What needs more attention is diagnostics — getting used to reading tailscale ping and understanding when a connection uses a direct or relay path.

#Closing

Episode 4 expanded your tailnet into a real network: many cross-OS devices connected in a single mesh, and you have the diagnostic tools to verify every connection.

Key takeaways:

• Every device that is up joins the same tailnet and can reach the others.
• Official installers exist for Linux, macOS, Windows, Android, and iOS.
• tailscale ping verifies connectivity over the tailnet path.
• via direct means a direct connection; via DERP means a relay.
• tailscale status and tailscale ip are must-knows for navigation.
• Use a consistent naming convention for a tidy tailnet.

In the next episode, episode 5, we'll cover tailnet and MagicDNS — the tailnet concept in depth, using MagicDNS hostnames node.tailnet-name.ts.net, 100.x.x.x IP addresses in the CGNAT range, naming with tailscale up --hostname, short hostname resolution, and how to find other devices in the tailnet.