Learn Tailscale - CLI Configuration & Options

#Introduction

Over the last five episodes you've run tailscale up repeatedly with different flags: --hostname, --ssh, --advertise-tags. Every time you run up, the connection drops and reconnects — not ideal for a node currently serving traffic.

Episode 8 introduces tailscale set, the modern command for changing configuration without disconnecting. We'll also dissect all the important flags used throughout the series, and understand how Tailscale stores per-device preferences via the prefs file.

#The tailscale set Command

#Changing Configuration Without a Disconnect

tailscale set changes settings on a running node without repeating the up flow:

sudo tailscale set --hostname=web-prod
sudo tailscale set --ssh
sudo tailscale set --auto-update

Each line above modifies a node preference and takes effect immediately. The sudo tailscale set --ssh command has the same effect as tailscale up --ssh, but without disturbing active connections.

#The Difference Between up and set

• tailscale up: activates the connection and applies all flags at once — required the first time.
• tailscale set: changes specific flags on an already-active node.

# first time: up with all flags
sudo tailscale up --hostname=web-prod --advertise-tags=tag:server
 
# afterwards: set additional flags
sudo tailscale set --accept-routes=true

#Key Flags

#Identity and Connection

• --hostname: the node's MagicDNS name.
• --login-server: the authentication server address (for Headscale, episode 20).
• --auth-key: a key for automated provisioning without a browser (episode 13).

sudo tailscale up --login-server=https://headscale.example.com

#Routing

• --accept-routes: accepts routes advertised by other nodes (needed for subnet routers).
• --advertise-routes: advertises a local subnet to the whole tailnet.
• --advertise-exit-node: offers the node as an exit node.

sudo tailscale up --advertise-routes=192.168.1.0/24

The sudo tailscale up --advertise-routes=192.168.1.0/24 command tells the control plane that this node can bridge the 192.168.1.0/24 network into the tailnet — we cover the details in episode 9.

#Additional Features

• --ssh: enables Tailscale SSH.
• --auto-update: enables automatic updates to the latest stable version.
• --exit-node: forces all traffic out through a specific node.
• --advertise-tags: requests tags for automated devices.

sudo tailscale set --auto-update
sudo tailscale set --exit-node=node-vpn

#Configuration Persistence

#Prefs File and State

Tailscale stores all node preferences in the state file — on Linux at /var/lib/tailscale/tailscaled.state. Its contents are encrypted configuration: node keys, prefs, and connection state. When you run tailscale set, changes are written to this file so they survive reboots.

sudo tailscale debug prefs

The output of tailscale debug prefs shows all node preferences as JSON: hostname, accept-routes, exit-node, and more. Notice the flags we've covered appearing here.

#Reconfiguring Without Disconnecting

The most valuable benefit of tailscale set in production: changing configuration while a node serves traffic, with no downtime. A real example — adding a subnet router without restarting:

sudo tailscale set --advertise-routes=192.168.1.0/24,10.0.0.0/8
tailscale status

The sudo tailscale set --advertise-routes=192.168.1.0/24,10.0.0.0/8 command replaces the list of advertised routes. After approval in the admin console, the routes take effect immediately.

#Reading the Configuration

#Verifying Changes

Always verify the result of changes:

sudo tailscale debug prefs | grep -i ssh
tailscale status

The combination of tailscale debug prefs and tailscale status gives you a complete picture of the node configuration. Make checking both a habit after every change.

#Closing

Episode 8 gave you full per-device configuration control: tailscale set for no-downtime changes, an understanding of all the key flags, and the knowledge that all preferences persist in the prefs file.

Key takeaways:

• tailscale up for the first time; tailscale set for later changes.
• set doesn't disconnect — crucial in production.
• Routing flags: --accept-routes, --advertise-routes, --advertise-exit-node.
• --login-server for a custom control plane, --auto-update for automatic updates.
• Preferences live in the state file /var/lib/tailscale/tailscaled.state.
• tailscale debug prefs reads the full configuration.

In the next episode, episode 9, we'll cover exit nodes and subnet routers — using a server or VPS as an exit node to route all traffic out, bridging a local LAN into the tailnet with --advertise-routes, and enabling --accept-routes on the client side.