Tailscale Admin Guide

VPN administrators should first read the Tailscale User Guide and follow the instructions for installing Tailscale on their machine.

Recommended Additional Reading

• How Tailscale works
• How NAT traversal works: Tailscale is smart enough that it will always works but certain scenarios where traffic needs to be relayed or hairpin will significantly increase latency and decrease bandwidth. Understanding NAT traversal can help avoid such situations. This has significant implications for virtual machines which are placed in a NAT by default and create a CGNAT-like scenario for VM to VM communication.
• Tailscale Documentation

Admin Responsibilities

Administrators can manage the VPN by using the Admin Console. They can login by using the team gmail account.

Issuing Pre-auth Keys

The VPN administrator's primary job is to issue Pre-auth Keys. These keys act as one-time passwords that allow users to join the network without needing to sign-in. An admin should always create a new unique "One-off" key for each user joining the network. This practice removes the need to share the team's gmail login credentials and prevents unauthorized users from joining the network.

1. Go to the Admin Console: Keys
2. Click Generate One-off Key
3. Send the unique key to one user