Tailscale

Tailscale is a Zero Trust Network Access (ZTNA) solution that simplifies secure connectivity via a mesh VPN with Wireguard. It’s insanely easy to setup and get working. You get 3 devices with the free version. https://tailscale.com/pricing

---

Setting Up Tailscale

• Install Tailscale on a Server or Device:
  • Download and install the Tailscale client on your device (Linux, macOS, Windows, or mobile).
  • On Linux:

curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up --accept-routes

• On Windows: Download the installer from Tailscale’s website.
• For Mac, it’s in the App Store.
• Log In with Your Identity Provider:
  • Use Google Workspace, Okta, Microsoft, or another SSO to authenticate.
  • Once logged in, the device joins your private mesh network.

---

Inviting Users

• Invite Users from the Admin Panel:
  • Go to the Tailscale Admin Panel: https://login.tailscale.com/admin.
  • Navigate to Users and click Invite Users.
  • Send invitations via email, which will guide users to install Tailscale.
• User Authentication:
  • When users accept the invitation, their devices automatically join your Tailscale network after logging in through the identity provider.

---

Configuring Access Controls

• Define Access Control Lists (ACLs):
  • Go to Access Controls in the Admin Panel.
  • Edit the acl file to specify who can access what:

{
  "ACLs": [
    {"Action": "accept", "Users": ["alice@example.com"], "Ports": ["192.168.1.10:22"]},
    {"Action": "accept", "Users": ["bob@example.com"], "Ports": ["192.168.1.20:3389"]}
  ]
}

• Save the changes. Access permissions update in real time.
• Set Device Tags for Service-Based Access:
  • Tag devices (e.g., tag:webserver) and use them in ACLs:

{
  "ACLs": [
    {"Action": "accept", "Users": ["team@domain.com"], "Ports": ["tag:webserver:*"]}
  ]
}

---

Setting Up Applications and Services

• Expose Applications:
  • Install Tailscale on the app server and enable traffic routing:

sudo tailscale up --advertise-routes=192.168.1.0/24

• Use device tags to secure access (e.g., tag:dbserver for database access).
• Connect Services:
  • Connect to SSH, RDP, or web applications via Tailscale IPs:
    • SSH: ssh username@100.x.x.x
    • RDP: mstsc /v:100.x.x.x.
• Use MagicDNS for Easier Access:
  • Enable MagicDNS in the Admin Panel under DNS Settings.
  • Access devices and services with human-readable names, e.g., dbserver.tailnet.

---

DNS Management

• Custom DNS Servers:
  • Add DNS servers to your Tailnet under DNS Settings:

sudo tailscale up --accept-dns --advertise-dns=192.168.1.1

• Split DNS:
  • Configure split DNS for specific domains in the Admin Panel:
    • Add search domains and assign them to specific DNS servers.

---

Monitoring Logs and Activity

• Access Logs:
  • View connection logs in the Admin Panel under Logs.
  • Monitor user and device activities in real time.
• Export Logs:
  • Integrate logs with tools like Datadog, Splunk, or syslog for centralized monitoring.

---

Advanced Settings

• Enable Key Features:
  • Device Sharing: Share devices with external users temporarily.
  • Taildrop: Transfer files securely between devices in the Tailnet.
• Configure Idle Timeout:
  • Set session expiration and idle timeout policies in Settings > Authentication.
• Audit Device State:
  • Check device health, connectivity, and tags from the Machines tab.

---

Testing the Configuration

• Verify Connectivity:
  • Ping devices by their Tailscale IPs or MagicDNS names.

ping dbserver.tailnet

• Test Access Controls:
  • Attempt to access restricted services and confirm ACLs are effective.

---

Benefits of Tailscale for ZTNA and SASE

• Zero Trust: Enforces identity-based policies and least privilege access.
• SASE Alignment: Combines secure connectivity, DNS filtering, and encrypted tunnels into a single solution.
• Ease of Use: Minimal configuration compared to traditional VPNs or SD-WAN setups.

Tailscale makes implementing ZTNA very straightforward and intuitive. Its lightweight approach aligns with SASE principles, providing a versatile platform for modern networking.