tailscale

Configure Tailscale mesh networking, ACLs, MagicDNS, and subnet routes.

1|Updated Mar 11, 2026
One-click install
npx skills add https://github.com/antonyfmunoz/OS --skill tailscale-antonyfmunoz
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: tailscale
Source: https://github.com/antonyfmunoz/OS/tree/main/skills/tools/tailscale
Command: npx skills add https://github.com/antonyfmunoz/OS --skill tailscale-antonyfmunoz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you connect devices reliably over a private mesh network without manually exposing ports or managing brittle firewall rules.

Core Features & Use Cases

  • Identity-based mesh networking (tailnet IPs): Assigns stable 100.x.y.z addresses to devices and enables MagicDNS name resolution across your tailnet.
  • ACL-enforced connectivity: Uses default-deny policy (HuJSON in the admin console) to control which devices can reach which ports and services.
  • Secure service exposure on your terms: Enables private tailnet HTTPS via Serve, optional public HTTPS via Funnel, and tailnet-gated SSH for remote administration.

Quick Start

Use this skill to configure your EOS devices so the VPS hub and your dev surfaces communicate over Tailscale (including setting up ACLs and MagicDNS) instead of opening public network ports.

Frequently Asked Questions about tailscale

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect devices securely without opening public network ports?

You can connect devices securely by establishing an identity-based mesh VPN network, assigning stable 100.x.y.z tailnet IPs, and managing access with default-deny ACL policies.

What is the best way to expose a private HTTPS service to my tailnet?

The best way to expose private HTTPS services is by using Tailscale Serve to route traffic securely over your tailnet, or optionally using Funnel to expose public HTTPS endpoints.

How do I configure ACL policies to restrict access between specific devices?

You configure ACL policies by editing HuJSON in the admin console to enforce a default-deny posture, strictly controlling which devices can reach specific ports and services.

Does mesh VPN support remote administration via tailnet-gated SSH?

Yes, mesh VPN supports remote administration through Tailscale SSH, allowing secure, identity-based shell access to devices without managing traditional SSH keys or firewall rules.

Why does my device rely on DERP connectivity instead of a direct connection?

Devices fall back to DERP relay connectivity when direct peer-to-peer connections fail, and you can troubleshoot this fallback using operational diagnostics like netcheck and ping.