What is Tailscale?

What it is

Each device runs a small app and joins your private network. Devices then reach each other over encrypted WireGuard tunnels, directly where the networks allow it and through Tailscale's relay servers where they do not. Because devices connect outward, you do not need to open ports in the office firewall.

Sign-in goes through an identity provider, such as Microsoft Entra ID, the account staff already use. Multi-factor sign-in and account removal then follow the person's account, and there is no shared VPN password. It is one way of delivering a VPN.

Why it matters to a business

• No open ports: the office firewall does not have to accept inbound connections for remote access.
• Access by person: rules say which people or groups can reach which systems, instead of everyone seeing everything.
• Clean offboarding: disabling a person's account in the identity provider cuts their access.
• A hosted service: sign-in, keys and access rules are handled by a coordination server that Tailscale runs, so the vendor becomes part of your remote access.

How KawaConnect works with Tailscale

We set up Tailscale remote access for staff, with multi-factor sign-in, alongside site-to-site VPN between offices. The work runs on OPNsense firewalls, so the network edge and remote access are planned together.

The same approach covers camera systems: recorders are viewed remotely through the VPN, so none of them is exposed to the public internet.

Learn more

• Tailscale on WikipediaA neutral overview of the company and product.
• TailscaleThe vendor's own site, with plans and an explanation of how it works.
• Tailscale documentationHelp articles for teams planning a rollout and the access rules behind it.