[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE8CPBHF443CDZ6P78AQ56":3,"skill-same:01M6AE8CPBHF443CDZ6P78AQ56":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AE8CPBHF443CDZ6P78AQ56","deploying-tailscale-for-zero-trust-vpn",null,"Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet routers, and MagicDNS for encrypted peer-to-peer connectivity. Use when replacing traditional VPN servers with an identity-authenticated mesh network or enforcing granular per-device access control lists.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"deploying tailscale for zero trust vpn","ZeRO","zero-trust","headscale","identity-aware","peer-to-peer","mesh-vpn","wireguard","tailscale","ztna","mesh","ACL","network","pr","identity","architecture","cybersecurity","mesh network","2026-11-10 10:12:30",false,"---\nname: deploying-tailscale-for-zero-trust-vpn\ndescription: Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet routers, and MagicDNS for encrypted peer-to-peer connectivity. Use when replacing traditional VPN servers with an identity-authenticated mesh network or enforcing granular per-device access control lists.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- tailscale\n- wireguard\n- mesh-vpn\n- ztna\n- peer-to-peer\n- acl\n- identity-aware\n- headscale\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1133\n- T1078\n- T1021\n- T1572\n---\n\n# Deploying Tailscale for Zero Trust VPN\n\n## Overview\n\nTailscale is a zero trust mesh VPN built on WireGuard that creates encrypted peer-to-peer connections between devices without requiring traditional VPN servers or complex network configuration. Every connection in a Tailscale network (tailnet) is end-to-end encrypted using WireGuard's Noise protocol framework with Curve25519 key exchange. Tailscale implements zero trust networking by authenticating every connection request through identity providers, enforcing granular Access Control Lists (ACLs), and supporting features like exit nodes, subnet routers, MagicDNS, and Tailscale SSH. For organizations preferring self-hosted infrastructure, Headscale provides an open-source implementation of the Tailscale control server.\n\n\n## When to Use\n\n- When deploying or configuring deploying tailscale for zero trust vpn capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Identity provider (Okta, Azure AD, Google Workspace, GitHub, or OIDC-compatible)\n- Devices running supported OS (Linux, Windows, macOS, iOS, Android, FreeBSD)\n- Administrative access to configure DNS and firewall rules\n- Understanding of WireGuard protocol fundamentals\n- Network planning documentation for subnet routing requirements\n\n## Architecture\n\n```\n                    Tailscale Coordination Server\n                    (or self-hosted Headscale)\n                           |\n                    Key Distribution\n                    & NAT Traversal\n                           |\n         +-----------------+-----------------+\n         |                 |                 |\n    +----+----+      +----+----+      +----+----+\n    | Node A  |\u003C---->| Node B  |\u003C---->| Node C  |\n    | (Linux) |      | (macOS) |      |(Windows)|\n    +---------+      +---------+      +---------+\n    WireGuard         WireGuard        WireGuard\n    Encrypted         Encrypted        Encrypted\n    P2P Tunnel        P2P Tunnel       P2P Tunnel\n\n    Each node connects directly to every other node.\n    DERP relay servers used only when direct P2P fails.\n```\n\n## Installation and Setup\n\n### Linux Installation\n\n```bash\n# Add Tailscale repository and install\ncurl -fsSL https:\u002F\u002Ftailscale.com\u002Finstall.sh | sh\n\n# Start Tailscale and authenticate\nsudo tailscale up\n\n# Check connection status\ntailscale status\n\n# View assigned IP address\ntailscale ip -4\ntailscale ip -6\n```\n\n### Windows \u002F macOS Installation\n\n```bash\n# Windows: Download from https:\u002F\u002Ftailscale.com\u002Fdownload\u002Fwindows\n# macOS: Install via Homebrew\nbrew install --cask tailscale\n\n# Or download from https:\u002F\u002Ftailscale.com\u002Fdownload\u002Fmac\n```\n\n### Docker Deployment\n\n```yaml\n# docker-compose.yml for Tailscale sidecar\nversion: '3.8'\nservices:\n  tailscale:\n    image: tailscale\u002Ftailscale:latest\n    container_name: tailscale\n    hostname: my-service\n    environment:\n      - TS_AUTHKEY=tskey-auth-xxxxx  # Pre-auth key\n      - TS_STATE_DIR=\u002Fvar\u002Flib\u002Ftailscale\n      - TS_EXTRA_ARGS=--advertise-tags=tag:container\n    volumes:\n      - tailscale-state:\u002Fvar\u002Flib\u002Ftailscale\n      - \u002Fdev\u002Fnet\u002Ftun:\u002Fdev\u002Fnet\u002Ftun\n    cap_add:\n      - net_admin\n      - sys_module\n    restart: unless-stopped\n\nvolumes:\n  tailscale-state:\n```\n\n### Kubernetes Deployment\n\n```yaml\n# Tailscale operator for Kubernetes\napiVersion: v1\nkind: Secret\nmetadata:\n  name: tailscale-auth\n  namespace: tailscale\ntype: Opaque\nstringData:\n  TS_AUTHKEY: \"tskey-auth-xxxxx\"\n---\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: tailscale\n  namespace: tailscale\nspec:\n  selector:\n    matchLabels:\n      app: tailscale\n  template:\n    metadata:\n      labels:\n        app: tailscale\n    spec:\n      containers:\n      - name: tailscale\n        image: tailscale\u002Ftailscale:latest\n        env:\n        - name: TS_AUTHKEY\n          valueFrom:\n            secretKeyRef:\n              name: tailscale-auth\n              key: TS_AUTHKEY\n        - name: TS_KUBE_SECRET\n          value: tailscale-state\n        - name: TS_USERSPACE\n          value: \"true\"\n        securityContext:\n          capabilities:\n            add: [\"NET_ADMIN\"]\n```\n\n## Access Control Lists (ACLs)\n\nTailscale ACLs define who can access what within your tailnet using a declarative JSON format. The default policy is deny-all, making it zero trust by design.\n\n```json\n{\n  \"acls\": [\n    \u002F\u002F Engineering team can access development servers\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:engineering\"],\n      \"dst\": [\"tag:dev-server:*\"]\n    },\n    \u002F\u002F SRE team can access production infrastructure\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:sre\"],\n      \"dst\": [\"tag:production:22,443,8080\"]\n    },\n    \u002F\u002F Database access restricted to backend services\n    {\n      \"action\": \"accept\",\n      \"src\": [\"tag:backend\"],\n      \"dst\": [\"tag:database:5432,3306,27017\"]\n    },\n    \u002F\u002F All employees can access internal tools\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:employees\"],\n      \"dst\": [\"tag:internal-tools:443\"]\n    }\n  ],\n\n  \"groups\": {\n    \"group:engineering\": [\"user@company.com\", \"dev@company.com\"],\n    \"group:sre\": [\"sre@company.com\", \"oncall@company.com\"],\n    \"group:employees\": [\"autogroup:members\"]\n  },\n\n  \"tagOwners\": {\n    \"tag:dev-server\": [\"group:engineering\"],\n    \"tag:production\": [\"group:sre\"],\n    \"tag:backend\": [\"group:sre\"],\n    \"tag:database\": [\"group:sre\"],\n    \"tag:internal-tools\": [\"group:sre\"],\n    \"tag:container\": [\"group:sre\"]\n  },\n\n  \"ssh\": [\n    {\n      \"action\": \"check\",\n      \"src\": [\"group:sre\"],\n      \"dst\": [\"tag:production\"],\n      \"users\": [\"root\", \"admin\"]\n    },\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:engineering\"],\n      \"dst\": [\"tag:dev-server\"],\n      \"users\": [\"autogroup:nonroot\"]\n    }\n  ],\n\n  \"nodeAttrs\": [\n    {\n      \"target\": [\"autogroup:members\"],\n      \"attr\": [\"funnel:deny\"]\n    }\n  ]\n}\n```\n\n## Exit Nodes and Subnet Routing\n\n### Configure Exit Node\n\n```bash\n# On the exit node machine\nsudo tailscale up --advertise-exit-node\n\n# On the client machine, use the exit node\nsudo tailscale up --exit-node=\u003Cexit-node-ip>\n\n# Verify exit node routing\ncurl ifconfig.me  # Should show exit node's public IP\n```\n\n### Subnet Router Configuration\n\n```bash\n# Advertise local subnets through Tailscale\nsudo tailscale up --advertise-routes=10.0.0.0\u002F24,192.168.1.0\u002F24\n\n# Enable IP forwarding on Linux\necho 'net.ipv4.ip_forward = 1' | sudo tee -a \u002Fetc\u002Fsysctl.conf\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a \u002Fetc\u002Fsysctl.conf\nsudo sysctl -p\n\n# Accept routes on client\nsudo tailscale up --accept-routes\n```\n\n## Tailscale SSH (Zero Trust SSH)\n\nTailscale SSH replaces traditional SSH key management with identity-based access.\n\n```bash\n# Enable Tailscale SSH on a server\nsudo tailscale up --ssh\n\n# Connect using Tailscale SSH (no SSH keys needed)\nssh user@hostname  # Authenticates via Tailscale identity\n\n# Session recording (audit logging)\n# Configure in ACL policy:\n# \"ssh\": [{\"action\": \"check\", \"src\": [...], \"dst\": [...], \"users\": [...]}]\n# \"check\" action requires re-authentication and records sessions\n```\n\n## MagicDNS Configuration\n\n```bash\n# MagicDNS is enabled by default in new tailnets\n# Access devices by hostname instead of IP\nping my-server  # Resolves via MagicDNS\n\n# Custom DNS configuration via admin console\n# Split DNS: route specific domains to internal DNS servers\n# Global nameservers: override default DNS resolution\n```\n\n## Self-Hosted with Headscale\n\n```bash\n# Install Headscale (open-source Tailscale control server)\nwget https:\u002F\u002Fgithub.com\u002Fjuanfont\u002Fheadscale\u002Freleases\u002Flatest\u002Fdownload\u002Fheadscale_linux_amd64\nchmod +x headscale_linux_amd64\nsudo mv headscale_linux_amd64 \u002Fusr\u002Flocal\u002Fbin\u002Fheadscale\n\n# Create configuration\nsudo mkdir -p \u002Fetc\u002Fheadscale\nsudo headscale generate config > \u002Fetc\u002Fheadscale\u002Fconfig.yaml\n\n# Edit config for your environment\n# Key settings:\n#   server_url: https:\u002F\u002Fheadscale.example.com\n#   listen_addr: 0.0.0.0:8080\n#   private_key_path: \u002Fetc\u002Fheadscale\u002Fprivate.key\n#   db_type: sqlite3\n#   db_path: \u002Fvar\u002Flib\u002Fheadscale\u002Fdb.sqlite\n\n# Start Headscale\nsudo headscale serve\n\n# Create user and pre-auth key\nheadscale users create myorg\nheadscale preauthkeys create --user myorg --reusable --expiration 24h\n\n# Connect Tailscale client to Headscale\ntailscale up --login-server https:\u002F\u002Fheadscale.example.com\n```\n\n## Security Hardening\n\n### Key Expiry and Rotation\n\n```bash\n# Set key expiry in admin console (default: 180 days)\n# Force re-authentication periodically\n\n# Disable key expiry for servers (use auth keys instead)\nsudo tailscale up --authkey=tskey-auth-xxxxx\n\n# Pre-auth keys for automated deployment\n# Create ephemeral, single-use keys for CI\u002FCD\n```\n\n### Device Authorization\n\n```json\n{\n  \"nodeAttrs\": [\n    {\n      \"target\": [\"autogroup:members\"],\n      \"attr\": [\n        \"mullvad:deny\",\n        \"funnel:deny\"\n      ]\n    }\n  ],\n  \"autoApprovers\": {\n    \"routes\": {\n      \"10.0.0.0\u002F24\": [\"group:sre\"],\n      \"192.168.0.0\u002F16\": [\"group:sre\"]\n    },\n    \"exitNode\": [\"group:sre\"]\n  }\n}\n```\n\n### Network Lock (Tailnet Lock)\n\n```bash\n# Initialize network lock with signing keys\ntailscale lock init\n\n# Add trusted signing keys\ntailscale lock add nodekey:xxxxx\n\n# All new nodes require signing before joining\n# Prevents unauthorized nodes from joining the tailnet\n```\n\n## Monitoring and Observability\n\n```bash\n# View network status\ntailscale status --json | jq '.Peer | to_entries[] | {name: .value.HostName, online: .value.Online, os: .value.OS}'\n\n# Check connection quality\ntailscale ping \u003Cpeer-ip>\n\n# View network map\ntailscale netcheck\n\n# Audit logs available in Tailscale admin console\n# Integration with SIEM via webhook or API\n```\n\n## Integration Patterns\n\n### Service Mesh Integration\n\n```bash\n# Tailscale as sidecar for service-to-service communication\n# Each service gets a Tailscale identity\n# ACLs enforce service-to-service access policies\n\n# Example: API service can only reach database service\n# ACL: tag:api -> tag:database:5432\n```\n\n### CI\u002FCD Pipeline Integration\n\n```bash\n# Use ephemeral auth keys in CI\u002FCD\nexport TS_AUTHKEY=tskey-auth-xxxxx-ephemeral\ntailscale up --authkey=$TS_AUTHKEY --hostname=ci-runner-$CI_JOB_ID\n\n# Access internal resources during build\u002Fdeploy\n# Node automatically removed when container stops\n```\n\n## References\n\n- [Tailscale Documentation](https:\u002F\u002Ftailscale.com\u002Fkb\u002F)\n- [How Tailscale Works](https:\u002F\u002Ftailscale.com\u002Fblog\u002Fhow-tailscale-works)\n- [Tailscale ACL Documentation](https:\u002F\u002Ftailscale.com\u002Fkb\u002F1018\u002Facls\u002F)\n- [Headscale - Open Source Control Server](https:\u002F\u002Fgithub.com\u002Fjuanfont\u002Fheadscale)\n- [WireGuard Protocol](https:\u002F\u002Fwww.wireguard.com\u002Fprotocol\u002F)\n- [Tailscale SSH](https:\u002F\u002Ftailscale.com\u002Fkb\u002F1193\u002Ftailscale-ssh\u002F)\n","# Deploying Tailscale for Zero Trust VPN\n\n## Overview\n\nTailscale is a zero trust mesh VPN built on WireGuard that creates encrypted peer-to-peer connections between devices without requiring traditional VPN servers or complex network configuration. Every connection in a Tailscale network (tailnet) is end-to-end encrypted using WireGuard's Noise protocol framework with Curve25519 key exchange. Tailscale implements zero trust networking by authenticating every connection request through identity providers, enforcing granular Access Control Lists (ACLs), and supporting features like exit nodes, subnet routers, MagicDNS, and Tailscale SSH. For organizations preferring self-hosted infrastructure, Headscale provides an open-source implementation of the Tailscale control server.\n\n\n## When to Use\n\n- When deploying or configuring deploying tailscale for zero trust vpn capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Identity provider (Okta, Azure AD, Google Workspace, GitHub, or OIDC-compatible)\n- Devices running supported OS (Linux, Windows, macOS, iOS, Android, FreeBSD)\n- Administrative access to configure DNS and firewall rules\n- Understanding of WireGuard protocol fundamentals\n- Network planning documentation for subnet routing requirements\n\n## Architecture\n\n```\n                    Tailscale Coordination Server\n                    (or self-hosted Headscale)\n                           |\n                    Key Distribution\n                    & NAT Traversal\n                           |\n         +-----------------+-----------------+\n         |                 |                 |\n    +----+----+      +----+----+      +----+----+\n    | Node A  |\u003C---->| Node B  |\u003C---->| Node C  |\n    | (Linux) |      | (macOS) |      |(Windows)|\n    +---------+      +---------+      +---------+\n    WireGuard         WireGuard        WireGuard\n    Encrypted         Encrypted        Encrypted\n    P2P Tunnel        P2P Tunnel       P2P Tunnel\n\n    Each node connects directly to every other node.\n    DERP relay servers used only when direct P2P fails.\n```\n\n## Installation and Setup\n\n### Linux Installation\n\n```bash\n# Add Tailscale repository and install\ncurl -fsSL https:\u002F\u002Ftailscale.com\u002Finstall.sh | sh\n\n# Start Tailscale and authenticate\nsudo tailscale up\n\n# Check connection status\ntailscale status\n\n# View assigned IP address\ntailscale ip -4\ntailscale ip -6\n```\n\n### Windows \u002F macOS Installation\n\n```bash\n# Windows: Download from https:\u002F\u002Ftailscale.com\u002Fdownload\u002Fwindows\n# macOS: Install via Homebrew\nbrew install --cask tailscale\n\n# Or download from https:\u002F\u002Ftailscale.com\u002Fdownload\u002Fmac\n```\n\n### Docker Deployment\n\n```yaml\n# docker-compose.yml for Tailscale sidecar\nversion: '3.8'\nservices:\n  tailscale:\n    image: tailscale\u002Ftailscale:latest\n    container_name: tailscale\n    hostname: my-service\n    environment:\n      - TS_AUTHKEY=tskey-auth-xxxxx  # Pre-auth key\n      - TS_STATE_DIR=\u002Fvar\u002Flib\u002Ftailscale\n      - TS_EXTRA_ARGS=--advertise-tags=tag:container\n    volumes:\n      - tailscale-state:\u002Fvar\u002Flib\u002Ftailscale\n      - \u002Fdev\u002Fnet\u002Ftun:\u002Fdev\u002Fnet\u002Ftun\n    cap_add:\n      - net_admin\n      - sys_module\n    restart: unless-stopped\n\nvolumes:\n  tailscale-state:\n```\n\n### Kubernetes Deployment\n\n```yaml\n# Tailscale operator for Kubernetes\napiVersion: v1\nkind: Secret\nmetadata:\n  name: tailscale-auth\n  namespace: tailscale\ntype: Opaque\nstringData:\n  TS_AUTHKEY: \"tskey-auth-xxxxx\"\n---\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: tailscale\n  namespace: tailscale\nspec:\n  selector:\n    matchLabels:\n      app: tailscale\n  template:\n    metadata:\n      labels:\n        app: tailscale\n    spec:\n      containers:\n      - name: tailscale\n        image: tailscale\u002Ftailscale:latest\n        env:\n        - name: TS_AUTHKEY\n          valueFrom:\n            secretKeyRef:\n              name: tailscale-auth\n              key: TS_AUTHKEY\n        - name: TS_KUBE_SECRET\n          value: tailscale-state\n        - name: TS_USERSPACE\n          value: \"true\"\n        securityContext:\n          capabilities:\n            add: [\"NET_ADMIN\"]\n```\n\n## Access Control Lists (ACLs)\n\nTailscale ACLs define who can access what within your tailnet using a declarative JSON format. The default policy is deny-all, making it zero trust by design.\n\n```json\n{\n  \"acls\": [\n    \u002F\u002F Engineering team can access development servers\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:engineering\"],\n      \"dst\": [\"tag:dev-server:*\"]\n    },\n    \u002F\u002F SRE team can access production infrastructure\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:sre\"],\n      \"dst\": [\"tag:production:22,443,8080\"]\n    },\n    \u002F\u002F Database access restricted to backend services\n    {\n      \"action\": \"accept\",\n      \"src\": [\"tag:backend\"],\n      \"dst\": [\"tag:database:5432,3306,27017\"]\n    },\n    \u002F\u002F All employees can access internal tools\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:employees\"],\n      \"dst\": [\"tag:internal-tools:443\"]\n    }\n  ],\n\n  \"groups\": {\n    \"group:engineering\": [\"user@company.com\", \"dev@company.com\"],\n    \"group:sre\": [\"sre@company.com\", \"oncall@company.com\"],\n    \"group:employees\": [\"autogroup:members\"]\n  },\n\n  \"tagOwners\": {\n    \"tag:dev-server\": [\"group:engineering\"],\n    \"tag:production\": [\"group:sre\"],\n    \"tag:backend\": [\"group:sre\"],\n    \"tag:database\": [\"group:sre\"],\n    \"tag:internal-tools\": [\"group:sre\"],\n    \"tag:container\": [\"group:sre\"]\n  },\n\n  \"ssh\": [\n    {\n      \"action\": \"check\",\n      \"src\": [\"group:sre\"],\n      \"dst\": [\"tag:production\"],\n      \"users\": [\"root\", \"admin\"]\n    },\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:engineering\"],\n      \"dst\": [\"tag:dev-server\"],\n      \"users\": [\"autogroup:nonroot\"]\n    }\n  ],\n\n  \"nodeAttrs\": [\n    {\n      \"target\": [\"autogroup:members\"],\n      \"attr\": [\"funnel:deny\"]\n    }\n  ]\n}\n```\n\n## Exit Nodes and Subnet Routing\n\n### Configure Exit Node\n\n```bash\n# On the exit node machine\nsudo tailscale up --advertise-exit-node\n\n# On the client machine, use the exit node\nsudo tailscale up --exit-node=\u003Cexit-node-ip>\n\n# Verify exit node routing\ncurl ifconfig.me  # Should show exit node's public IP\n```\n\n### Subnet Router Configuration\n\n```bash\n# Advertise local subnets through Tailscale\nsudo tailscale up --advertise-routes=10.0.0.0\u002F24,192.168.1.0\u002F24\n\n# Enable IP forwarding on Linux\necho 'net.ipv4.ip_forward = 1' | sudo tee -a \u002Fetc\u002Fsysctl.conf\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a \u002Fetc\u002Fsysctl.conf\nsudo sysctl -p\n\n# Accept routes on client\nsudo tailscale up --accept-routes\n```\n\n## Tailscale SSH (Zero Trust SSH)\n\nTailscale SSH replaces traditional SSH key management with identity-based access.\n\n```bash\n# Enable Tailscale SSH on a server\nsudo tailscale up --ssh\n\n# Connect using Tailscale SSH (no SSH keys needed)\nssh user@hostname  # Authenticates via Tailscale identity\n\n# Session recording (audit logging)\n# Configure in ACL policy:\n# \"ssh\": [{\"action\": \"check\", \"src\": [...], \"dst\": [...], \"users\": [...]}]\n# \"check\" action requires re-authentication and records sessions\n```\n\n## MagicDNS Configuration\n\n```bash\n# MagicDNS is enabled by default in new tailnets\n# Access devices by hostname instead of IP\nping my-server  # Resolves via MagicDNS\n\n# Custom DNS configuration via admin console\n# Split DNS: route specific domains to internal DNS servers\n# Global nameservers: override default DNS resolution\n```\n\n## Self-Hosted with Headscale\n\n```bash\n# Install Headscale (open-source Tailscale control server)\nwget https:\u002F\u002Fgithub.com\u002Fjuanfont\u002Fheadscale\u002Freleases\u002Flatest\u002Fdownload\u002Fheadscale_linux_amd64\nchmod +x headscale_linux_amd64\nsudo mv headscale_linux_amd64 \u002Fusr\u002Flocal\u002Fbin\u002Fheadscale\n\n# Create configuration\nsudo mkdir -p \u002Fetc\u002Fheadscale\nsudo headscale generate config > \u002Fetc\u002Fheadscale\u002Fconfig.yaml\n\n# Edit config for your environment\n# Key settings:\n#   server_url: https:\u002F\u002Fheadscale.example.com\n#   listen_addr: 0.0.0.0:8080\n#   private_key_path: \u002Fetc\u002Fheadscale\u002Fprivate.key\n#   db_type: sqlite3\n#   db_path: \u002Fvar\u002Flib\u002Fheadscale\u002Fdb.sqlite\n\n# Start Headscale\nsudo headscale serve\n\n# Create user and pre-auth key\nheadscale users create myorg\nheadscale preauthkeys create --user myorg --reusable --expiration 24h\n\n# Connect Tailscale client to Headscale\ntailscale up --login-server https:\u002F\u002Fheadscale.example.com\n```\n\n## Security Hardening\n\n### Key Expiry and Rotation\n\n```bash\n# Set key expiry in admin console (default: 180 days)\n# Force re-authentication periodically\n\n# Disable key expiry for servers (use auth keys instead)\nsudo tailscale up --authkey=tskey-auth-xxxxx\n\n# Pre-auth keys for automated deployment\n# Create ephemeral, single-use keys for CI\u002FCD\n```\n\n### Device Authorization\n\n```json\n{\n  \"nodeAttrs\": [\n    {\n      \"target\": [\"autogroup:members\"],\n      \"attr\": [\n        \"mullvad:deny\",\n        \"funnel:deny\"\n      ]\n    }\n  ],\n  \"autoApprovers\": {\n    \"routes\": {\n      \"10.0.0.0\u002F24\": [\"group:sre\"],\n      \"192.168.0.0\u002F16\": [\"group:sre\"]\n    },\n    \"exitNode\": [\"group:sre\"]\n  }\n}\n```\n\n### Network Lock (Tailnet Lock)\n\n```bash\n# Initialize network lock with signing keys\ntailscale lock init\n\n# Add trusted signing keys\ntailscale lock add nodekey:xxxxx\n\n# All new nodes require signing before joining\n# Prevents unauthorized nodes from joining the tailnet\n```\n\n## Monitoring and Observability\n\n```bash\n# View network status\ntailscale status --json | jq '.Peer | to_entries[] | {name: .value.HostName, online: .value.Online, os: .value.OS}'\n\n# Check connection quality\ntailscale ping \u003Cpeer-ip>\n\n# View network map\ntailscale netcheck\n\n# Audit logs available in Tailscale admin console\n# Integration with SIEM via webhook or API\n```\n\n## Integration Patterns\n\n### Service Mesh Integration\n\n```bash\n# Tailscale as sidecar for service-to-service communication\n# Each service gets a Tailscale identity\n# ACLs enforce service-to-service access policies\n\n# Example: API service can only reach database service\n# ACL: tag:api -> tag:database:5432\n```\n\n### CI\u002FCD Pipeline Integration\n\n```bash\n# Use ephemeral auth keys in CI\u002FCD\nexport TS_AUTHKEY=tskey-auth-xxxxx-ephemeral\ntailscale up --authkey=$TS_AUTHKEY --hostname=ci-runner-$CI_JOB_ID\n\n# Access internal resources during build\u002Fdeploy\n# Node automatically removed when container stops\n```\n\n## References\n\n- [Tailscale Documentation](https:\u002F\u002Ftailscale.com\u002Fkb\u002F)\n- [How Tailscale Works](https:\u002F\u002Ftailscale.com\u002Fblog\u002Fhow-tailscale-works)\n- [Tailscale ACL Documentation](https:\u002F\u002Ftailscale.com\u002Fkb\u002F1018\u002Facls\u002F)\n- [Headscale - Open Source Control Server](https:\u002F\u002Fgithub.com\u002Fjuanfont\u002Fheadscale)\n- [WireGuard Protocol](https:\u002F\u002Fwww.wireguard.com\u002Fprotocol\u002F)\n- [Tailscale SSH](https:\u002F\u002Ftailscale.com\u002Fkb\u002F1193\u002Ftailscale-ssh\u002F)\n",{"name":5,"tags":47,"author":49,"domain":40,"license":15,"version":50,"nist_csf":51,"subdomain":56,"description":7,"mitre_attack":57},[26,32,31,30,33,29,48,28,27],"acl","mahipal","1.0",[52,53,54,55],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[58,59,60,61],"T1133","T1078","T1021","T1572","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdeploying-tailscale-for-zero-trust-vpn",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-tailscale-for-zero-trust-vpn",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-tailscale-for-zero-trust-vpn",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-tailscale-for-zero-trust-vpn","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002FSKILL.md",true,[86,92,97,103,107,111,117],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"assets\u002Ftemplate.md","ASSET","资产文件",2377,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002Fassets\u002Ftemplate.md",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",1815,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fstandards.md",1986,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002Freferences\u002Fstandards.md",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fworkflows.md",3334,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002Freferences\u002Fworkflows.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fagent.py","SCRIPT","脚本",5131,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002Fscripts\u002Fagent.py",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fprocess.py",11884,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-tailscale-for-zero-trust-vpn\u002Fscripts\u002Fprocess.py",[122,149,172,200,226,253],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":131,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[132,133,134,135,136,40,137,38,37,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,136,160,40,37,161,25,162,163,164,165,166,167,168,169,170,171],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[178,181],{"categoryNo":179,"categoryName":180,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[166,183,184,185,186,40,187,188,161,189,190,191,192,193,194,195,196,197,198,199],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":207,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[206],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[208,209,210,40,211,212,213,214,215,216,217,218,219,220,221,222,163,223,224,225],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":233,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[232],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[234,235,236,40,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[259],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[136,261,40,262,263,264,265,266,267,268,269,195,270,196,271,272,273,274,275,276],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]