Private networks

What a private network is

A private network is your own mesh network with its own coordination server and its own keys: only your devices are in it, and you decide everything — how many devices, which subnets are reachable through which routers, who reaches whom. It is the same WireGuard mesh as the public network, plus:

• no device limit;
• subnet routers and exit nodes — reach whole LANs, send traffic out through a chosen device;
• access rules — who reaches whom and on which ports;
• publishing services on the internet;
• export, import and backups, overlapping subnets, changing a device's address.

What you need

• The Paid plan. On the Free plan My networks offers to upgrade right there.
• A free reserved name for the network's address: a name of yours in our zones with no DNS records, without dots — like office, not lab.office. Reserve one on Domains with an empty value, see Reserve a name.

Create a network

1. On My networks press Create network at the top right. In Address of the new network pick the name that becomes the network's address: the list has only your free reserved names.
2. Press Create network in the form. In a few seconds the network is running and appears in the list.

With no free reserved name the button is inactive, and the page says You have no free reserved name. with a link to Domains.

The network's address is its coordination server: https://office.mesh-net.space. Devices join it with --login-server set to this address. mesh-net points the name's DNS record at the server itself.

A network can also be created from an export archive or from your own headscale — see Import a network.

The network page

The network's row in My networks opens its page. At the top — the status, Control server: https://office.mesh-net.space and Add device; below them, the tabs Devices, Access, Sites, Publishing (reverse-proxy), Backup, Notifications and Settings. Access (the network's access rules) and Notifications are pages of their own, with the same header and tabs. The open tab is kept in the address, so a link or a reload brings you back to it.

If the network's server doesn't answer, the page says “Network unavailable” with the reason instead of the device list; try again in a minute, and if it lasts, write to support.

Add a device

1. Press Add device at the top right of the network page. In the form type a user name (see Users and join keys; the field suggests the existing ones) and press Add device.
2. The page shows a join key for this user and tabs with commands for Linux, Windows, macOS, iPhone and Android — the key is already in them. To make the device a subnet router, fill in the subnet field above the tabs first; see Advertise a subnet.
3. Run the command on the device. It appears under Devices within seconds.

The commands, with the network's address and the key from the page in place of KEY:

Linux

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --login-server https://office.mesh-net.space --authkey KEY --accept-routes
tailscale status

Windows

1. Install the client: tailscale.com/download/windows.
2. Open PowerShell as administrator: Start → type “PowerShell” → right-click → “Run as administrator”.
3. Join and check:

   tailscale up --login-server https://office.mesh-net.space --authkey KEY --accept-routes
   tailscale status

macOS

brew install tailscale && sudo tailscaled install-system-daemon
sudo tailscale up --login-server https://office.mesh-net.space --authkey KEY --accept-routes

In the GUI app from the App Store instead of the command: “⋯” → “Use a custom coordination server” = https://office.mesh-net.space, then log in as the user with the key.

iPhone and iPad

1. Install Tailscale from the App Store and open it.
2. On the login screen tap “⋯” at the top → “Use custom coordination server”.
3. Enter the network's address, https://office.mesh-net.space, and log in as the user. If the app asks for an auth key, paste the key from the page.

Android

1. Install Tailscale from Google Play and open it.
2. Account menu (three dots) → “Use an alternate server”.
3. Enter the network's address and log in as the user. If the app asks for an auth key, paste the key.

Users and join keys

• A user groups devices inside the network — say, one per person or one for servers. A new name in the field creates the user; the name is lowercase Latin letters, digits and . _ -, up to 63 characters. Devices of one user are listed under that name.
• A join key is single-use and short-lived: it works once and expires in 1 hour. Used and expired keys are removed automatically, so there is nothing to manage — just create a new key for every device.
• Every new key is announced by email and, while the Join keys events are on, in the network's notifications.

Devices

The Devices table shows every device of the network:

• Name — leads to the device's page; the user is written below the name.
• Addresses — the mesh IP (click to copy), and below it the external and local IPs the device reported.
• Status — online or offline, refreshed every 10 seconds without reloading; an HA tag means online/offline tracking is on.
• Routes — the subnets approved on the device; offers routes → means it advertises routes and none of them is approved yet (see Approve routes).

A device named rp-… is the network's reverse-proxy: mesh-net adds it when you publish the first service (see Publishing services). It can't be deleted from the table; when the last service is removed, the proxy stops, and its device stays in the list as offline.

When a device joins or leaves while the page is open, a line suggests refreshing it.

Device names (MagicDNS)

Besides the address, a device can be reached by its name from any device of the network: nas or the full form nas.office.mesh.mesh-net.space (device name, the network's name, mesh, the zone). The client must accept DNS settings from the network — that is the default.

The device page

A device's row in the Devices table opens its page: the name and the state at the top, then:

• Rename at the top right — a new name: lowercase Latin letters, digits and hyphens.
• Device details — user, Mesh address (Change next to it opens the form, see Changing a device's mesh address), IPv6, external and local IPs, Last seen, when it was added, Registration method, Key expiry and Tags (Edit next to them, see below).
• Routes — approving the subnets and exit node the device advertises, see Subnet routers and exit nodes.
• Notifications — the switch Alert me when it goes online/offline (HA), see Online/offline tracking.
• Useful node commands — folded: ready commands for the device, see Useful node commands.
• Delete device — at the bottom, in Danger zone.

Tags

Edit next to Tags opens the field: enter tags separated by spaces or commas (server, db) and press Save tags. A tag has to be declared in tagOwners of the network's policy, otherwise the network rejects it — so tags are for a custom HuJSON policy. The visual access rules don't use tags: they work with devices and groups.

Delete a device

The bin icon in the device's row, or Delete in Danger zone at the bottom of its page, removes it after a confirmation. The device leaves its groups, and access rules where it is the source or the destination are removed; if it was the gateway of sites, they are removed too. To bring the device back, add it again with a new key; on the device itself you can then run sudo tailscale logout.

Delete a network

Delete in Delete network on the Settings tab of the network page (or the bin icon in the network's row in My networks) removes the network after a confirmation: all its devices are disconnected, published services go down, and the network's data is gone. If you may need it again, first download a backup.