Tailscale Mesh VPN AI Skill Guide (Claude)

Overview & Engine Architecture

Tailscale is a coordination-plane + WireGuard data-plane mesh VPN. Nodes register with a control server (Tailscale SaaS or self-hosted Headscale), exchange keys and ACL policy, then encrypt traffic peer-to-peer. When UDP hole-punching fails (symmetric NAT, locked-down firewalls), encrypted packets fall back through DERP relays (or optional peer relays). Agents should treat route advertisement and admin approval as a double opt-in, treat MagicDNS as an OS DNS integration problem, and never invent auth keys or ACL principals.