Architecture
How Tailscale Works
Tailscale uses a control plane and data plane separation architecture for secure, efficient networking.
Architecture
Control Plane: Device authentication, key exchange, network configuration
Data Plane: P2P direct connections with DERP relay fallback
DERP Relay Servers
Designated Encrypted Relay for Packets - used when P2P direct connection fails
- Global DERP nodes deployed for low latency
- Data remains encrypted, relays cannot decrypt
- Automatic selection of nearest node
Connection Process
1
Device Registration: Register with control server, get virtual IP (100.x.x.x)
2
Address Discovery: Use STUN protocol to discover public address and NAT type
3
NAT Traversal: Attempt UDP hole punching for P2P direct connection
4
DERP Fallback: Use relay servers when P2P fails
┌─────────────────────────────────────────────────────────────┐
│ Tailscale Architecture │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ Control Plane: Device authentication, key exchange, network configuration │───▶│ undefined │───▶│ undefined │ │
│ └─────────────┘ └─────────────┘ └─────────────┘ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ Tailscale Control Plane: Device authentication, key exchange, network configuration │ │
│ └─────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Tailscale Data Plane: P2P direct connections with DERP relay fallback │
│ │
│ Device A ◀─────P2P Direct─────▶ Device B │
│ (100.x.x.x) (100.x.x.x) │
│ \ / │
│ \ DERP Relay(Backup) / │
│ \__________________/ │
│ │
└─────────────────────────────────────────────────────────────┘