tailscale-cli

Files (1)

• SKILL.md

SKILL.md (first lines)

# Tailscale CLI Reference

> `tailscale` — WireGuard-based zero-config VPN.
> Bin: `/usr/local/bin/tailscale` | Sock: `/var/run/tailscaled.socket`

## Global Flags

```
--socket value   path to tailscaled socket (default /var/run/tailscaled.socket)
```

Most commands also accept `--json` for machine-readable output.

---

## 1. Connection Management

### `tailscale up`
Connect to Tailscale, logging in if needed. **With flags, must specify the complete set** of desired settings (use `--reset` to override).

| Flag | Description |
|------|-------------|
| `--accept-dns` | Accept DNS config from admin panel (default true) |
| `--accept-routes` | Accept routes advertised by other nodes (default false) |
| `--advertise-routes` | Routes to advertise (e.g. `10.0.0.0/8,192.168.0.0/24`) |
| `--advertise-exit-node` | Offer as exit node (default false) |
| `--advertise-connector` | Advertise as app connector (default false) |
| `--advertise-tags` | ACL tags to request (e.g. `tag:eng,tag:ssh`) |
| `--auth-key` | Node authorization key (or `file:/path` to read from file) |
| `--exit-node` | Exit node to use (IP, base name, or `auto:any`) |
| `--exit-node-allow-lan-access` | Allow local LAN when using exit node |
| `--hostname` | Override hostname |
| `--login-server` | Base URL of control server |
| `--operator` | Unix user allowed to operate tailscaled without sudo |
| `--shields-up` | Block incoming connections |
| `--ssh` | Run SSH server per tailnet policy |
| `--force-reauth` | Force reauthentication |
| `--reset` | Reset unspecified settings to defaults |
| `--timeout` | Max time to wait for Running state (0=forever) |
| `--json` | JSON output |
| `--accept-risk` | Skip confirmation for: `lose-ssh`, `mac-app-connector`, `all` |
| `--client-id` / `--client-secret` / `--audience` / `--id-token` | Workload identity federation |
| `--qr` / `--qr-format` | Show QR code for login URLs |

### `tailscale down`
Disconnect from Tailscale.

```
tailscale down [--accept-risk <type>] [--reason <string>]
```

### `tailscale login`
Log in to a Tailscale account (alpha). Supports same flags as `up` for connection options.

### `tailscale logout`
Disconnect and expire current node key (forces reauth on next use).

```
tailscale logout [--reason <string>]
```

### `tailscale switch`
Switch between logged-in accounts (alpha).

```
tailscale switch <id>                  # switch to account
tailscale switch --list [--json]       # list available accounts
```

**Subcommands:**
- `tailscale switch remove <id>` — Remove a stored account

### `tailscale set`
Change specific preferences **without** requiring the full set (unlike `up`).

```
tailscale set --ssh --accept-routes --hostname=foo
```

Additional flags unique to `set`:
- `--auto-update` — Auto-update to latest version
- `--nickname` — Nickname for current account
- `--update-check` — Notify about available updates
- `--webclient` — Expose web UI at port 5252 over tailnet
- `--relay-server-port` — UDP port for relay (empty = disable)
- `--relay-server-static-endpoints` — Static IP:port endpoints for relay
- `--report-posture` — Allow device posture reporting

---

## 2. Status & Diagnostics

### `tailscale status`
Show state of tailscaled and connections.

```
tailscale status [--active] [--web] [--json] [--browser] [--header]
                 [--listen <addr>] [--peers] [--self]
```

- `--web` — Run web server with HTML status (default `127.0.0.1:8384`)
- `--active` — Only peers with active sessions
- `--peers` / `--self` — Show peers / local machine (default true)

### `tailscale netcheck`
Analyze local network conditions (NAT type, DERP latency, etc.).

```
tailscale netcheck [--bind-address <ip>] [--bind-port <port>]
                   [--every <duration>] [--format <json|json-line>]
                   [--verbose]
```

### `tailscale ping`
Ping a peer at the Tailscale layer (shows DERP vs direct path).

```
tailscale ping <hostname-or-IP>
  --c <n>            max pings (0=infinity, default 10)

From minfengyuan/harness-knowledge-base, MIT.

More from minfengyuan/harness-knowledge-base