CINXE.COM

<!DOCTYPE html><html lang="en" class="__className_943d4e"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/503dd21c3e9aa947-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/59aafc96071162d7-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/6190d09d67eb8e2d-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/6267f766bc823bf8-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/ce17880c21b59d21-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/d3470cfc68a51edd-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="stylesheet" href="/_next/static/css/425118351a398cbb.css" data-precedence="next"/><link rel="stylesheet" href="/_next/static/css/a0e3644f19e455e6.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-404272c67fa5cfdf.js"/><script src="/_next/static/chunks/fd9d1056-e2c756ac8808f8eb.js" async=""></script><script src="/_next/static/chunks/2117-45cfe96257eb3a9a.js" async=""></script><script src="/_next/static/chunks/main-app-93aa01555515a494.js" async=""></script><script src="/_next/static/chunks/8003-0833c71e6161cb44.js" async=""></script><script src="/_next/static/chunks/app/layout-54c1176bfefb7426.js" async=""></script><script src="/_next/static/chunks/2972-04611c7b37409cb4.js" async=""></script><script src="/_next/static/chunks/app/(marketing)/changelog/page-4734b55cb7463df0.js" async=""></script><script src="/_next/static/chunks/4302-c45bec305c844d62.js" async=""></script><script src="/_next/static/chunks/8650-0409a4c5d9e604e6.js" async=""></script><script src="/_next/static/chunks/919-dccbcd839ca206cc.js" async=""></script><script src="/_next/static/chunks/app/(marketing)/layout-9b4adc9075c01155.js" async=""></script><link rel="preload" href="https://widget.kapa.ai/kapa-widget.bundle.js" as="script"/><meta name="theme-color" content="#fff"/><title>Changelog · Tailscale</title><meta name="description" content="View changes to the Tailscale client and service."/><link rel="alternate" type="application/rss+xml" title="Tailscale Blog" href="https://tailscale.com/blog/index.xml"/><link rel="alternate" type="application/rss+xml" title="Tailscale Changelog" href="https://tailscale.com/changelog/index.xml"/><link rel="alternate" type="application/rss+xml" title="Tailscale Security Bulletins" href="https://tailscale.com/security-bulletins/index.xml"/><meta property="og:title" content="Tailscale"/><meta property="og:description" content="View changes to the Tailscale client and service."/><meta property="og:image" content="https://tailscale.com/files/images/og-image.png"/><meta property="og:type" content="website"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:creator" content="@tailscale"/><meta name="twitter:title" content="Tailscale"/><meta name="twitter:description" content="View changes to the Tailscale client and service."/><meta name="twitter:image" content="https://tailscale.com/files/images/og-image.png"/><link rel="icon" href="/favicon.png" type="image/png"/><link rel="icon" href="/favicon.svg" type="image/svg+xml"/><meta name="next-size-adjust"/><script src="/_next/static/chunks/polyfills-42372ed130431b0a.js" noModule=""></script></head><body><header class="left-0 right-0 top-0 z-[100] h-[60px] transition-colors duration-300 xl-small:h-[66px] sticky bg-transparent"><div class="is-wide container flex items-center justify-between py-4 xl-small:py-3"><div class="flex gap-[35px]"><a class="w-[110px] transition-colors duration-200 text-heading-black" title="Homepage" href="/"><svg class="transition-colors duration-200 " width="100%" height="100%" viewBox="0 0 110 20" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="2.44719" cy="10.1796" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse cx="9.79094" cy="10.1796" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="2.44719" cy="17.5077" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="17.1269" cy="17.5077" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse cx="9.79094" cy="17.5077" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse cx="17.1269" cy="10.1796" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="2.44719" cy="2.85924" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="9.79094" cy="2.85924" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="17.1269" cy="2.85924" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><path d="M34.3979 18.458C35.0907 18.458 35.6536 18.3933 36.3248 18.2637V15.7584C35.9134 15.9096 35.4588 15.9528 35.0258 15.9528C33.965 15.9528 33.5753 15.4344 33.5753 14.441V9.34402H36.3248V6.83875H33.5753V3.12403H30.5443V6.83875H28.5742V9.34402H30.5443V14.7217C30.5443 17.0974 31.8 18.458 34.3979 18.458Z" fill="#1F1E1E"></path><path d="M41.2747 18.458C42.8984 18.458 43.9809 17.9181 44.5222 17.0758C44.5655 17.443 44.6954 17.9397 44.8686 18.2421H47.5964C47.4449 17.7237 47.3366 16.903 47.3366 16.3631V10.4455C47.3366 8.005 45.583 6.62277 42.617 6.62277C40.3654 6.62277 38.6118 7.46507 37.6376 8.69611L39.3696 10.4023C40.149 9.5384 41.1448 9.08486 42.3572 9.08486C43.8294 9.08486 44.4789 9.58159 44.4789 10.3159C44.4789 10.9422 44.0459 11.3742 41.7077 11.3742C39.4562 11.3742 37.183 12.3028 37.183 14.8945C37.183 17.2918 38.9149 18.458 41.2747 18.458ZM41.8809 16.1687C40.7118 16.1687 40.1706 15.672 40.1706 14.7865C40.1706 14.009 40.8201 13.4907 41.9026 13.4907C43.6345 13.4907 44.1108 13.3827 44.4789 13.0155V13.9442C44.4789 15.1753 43.4397 16.1687 41.8809 16.1687Z" fill="#1F1E1E"></path><path d="M49.3069 5.39173H52.4677V2.5625H49.3069V5.39173ZM49.3718 18.2421H52.4028V6.83875H49.3718V18.2421Z" fill="#1F1E1E"></path><path d="M54.6109 18.2421H57.6418V2.90805H54.6109V18.2421Z" fill="#1F1E1E"></path><path d="M63.9416 18.458C67.2757 18.458 68.986 16.7087 68.986 14.8729C68.986 13.2099 68.1417 11.9789 65.3705 11.4821C63.4221 11.1366 62.2097 10.7046 62.2097 10.0351C62.2097 9.45201 62.9025 9.04166 64.0715 9.04166C65.1107 9.04166 65.9767 9.38722 66.6262 10.1431L68.553 8.52333C67.5788 7.31389 65.9767 6.62277 64.0715 6.62277C61.1489 6.62277 59.3303 8.17777 59.3303 10.0783C59.3303 12.1517 61.2354 13.0803 63.2922 13.4475C65.0025 13.7499 65.9551 14.0738 65.9551 14.8081C65.9551 15.4344 65.2839 15.9528 64.0066 15.9528C62.7509 15.9528 61.7767 15.3696 61.322 14.5058L58.7674 15.7152C59.3952 17.2702 61.5385 18.458 63.9416 18.458Z" fill="#1F1E1E"></path><path d="M75.7621 18.458C77.9271 18.458 79.4859 17.5942 80.6549 15.6504L78.2302 14.4194C77.7755 15.3265 77.0395 15.9528 75.7621 15.9528C73.8353 15.9528 72.7961 14.3978 72.7961 12.5188C72.7961 10.6399 73.9003 9.12805 75.7621 9.12805C76.9312 9.12805 77.7106 9.75437 78.1652 10.7046L80.6116 9.40882C79.7889 7.61625 78.1652 6.62277 75.7621 6.62277C71.8003 6.62277 69.7652 9.5168 69.7652 12.5188C69.7652 15.78 72.2333 18.458 75.7621 18.458Z" fill="#1F1E1E"></path><path d="M85.4829 18.458C87.1067 18.458 88.1891 17.9181 88.7304 17.0758C88.7737 17.443 88.9036 17.9397 89.0768 18.2421H91.8046C91.6531 17.7237 91.5448 16.903 91.5448 16.3631V10.4455C91.5448 8.005 89.7912 6.62277 86.8252 6.62277C84.5737 6.62277 82.8201 7.46507 81.8458 8.69611L83.5778 10.4023C84.3572 9.5384 85.353 9.08486 86.5654 9.08486C88.0376 9.08486 88.6871 9.58159 88.6871 10.3159C88.6871 10.9422 88.2541 11.3742 85.9159 11.3742C83.6644 11.3742 81.3912 12.3028 81.3912 14.8945C81.3912 17.2918 83.1231 18.458 85.4829 18.458ZM86.0891 16.1687C84.9201 16.1687 84.3788 15.672 84.3788 14.7865C84.3788 14.009 85.0283 13.4907 86.1108 13.4907C87.8427 13.4907 88.319 13.3827 88.6871 13.0155V13.9442C88.6871 15.1753 87.6479 16.1687 86.0891 16.1687Z" fill="#1F1E1E"></path><path d="M93.3263 18.2421H96.3573V2.90805H93.3263V18.2421Z" fill="#1F1E1E"></path><path d="M103.631 18.458C105.861 18.458 107.658 17.5726 108.654 15.996L106.359 14.5274C105.753 15.4776 104.952 15.996 103.631 15.996C102.138 15.996 101.055 15.1753 100.774 13.5771H109.39V12.5188C109.39 9.5168 107.55 6.62277 103.61 6.62277C99.8643 6.62277 97.8293 9.5384 97.8293 12.5404C97.8293 16.8167 101.055 18.458 103.631 18.458ZM100.882 11.2014C101.358 9.75437 102.354 9.08486 103.675 9.08486C105.168 9.08486 106.078 9.97034 106.381 11.2014H100.882Z" fill="#1F1E1E"></path></svg></a><nav class="relative hidden lg:gap-6 xl-small:flex"><div class="fixed bottom-0 left-0 right-0 z-[90] h-screen w-full transition duration-200 pointer-events-none opacity-0 top-[120px] bg-transparent"></div><div role="button" aria-haspopup="true" tabindex="0" class="group relative text-[14px] font-medium leading-normal tracking-[-0.28px] transition-colors duration-300 text-heading-black/80 hover:text-heading-black/100" data-track="Link Clicked" data-track-properties="{"label": "Product"}"><span>Product</span><div class="absolute bottom-[-6px] left-[25%] right-0 z-[100] flex h-[3px] w-[50%] items-center justify-center rounded-[5px] opacity-0 group-hover:opacity-100 bg-heading-black/80"></div></div><div role="button" aria-haspopup="true" tabindex="0" class="group relative text-[14px] font-medium leading-normal tracking-[-0.28px] transition-colors duration-300 text-heading-black/80 hover:text-heading-black/100" data-track="Link Clicked" data-track-properties="{"label": "Solutions"}"><span>Solutions</span><div class="absolute bottom-[-6px] left-[25%] right-0 z-[100] flex h-[3px] w-[50%] items-center justify-center rounded-[5px] opacity-0 group-hover:opacity-100 bg-heading-black/80"></div></div><a class="group relative text-[14px] font-medium leading-normal tracking-[-0.28px] transition-colors duration-300 text-heading-black/80 hover:text-heading-black/100" data-track="Link Clicked" data-track-properties="{"label": "Enterprise"}" href="/enterprise"><span>Enterprise</span><div class="absolute bottom-[-6px] left-[25%] right-0 z-[100] flex h-[3px] w-[50%] items-center justify-center rounded-[5px] opacity-0 group-hover:opacity-100 bg-heading-black/80"></div></a><a class="group relative text-[14px] font-medium leading-normal tracking-[-0.28px] transition-colors duration-300 text-heading-black/80 hover:text-heading-black/100" data-track="Link Clicked" data-track-properties="{"label": "Customers"}" href="/customers"><span>Customers</span><div class="absolute bottom-[-6px] left-[25%] right-0 z-[100] flex h-[3px] w-[50%] items-center justify-center rounded-[5px] opacity-0 group-hover:opacity-100 bg-heading-black/80"></div></a><a class="group relative text-[14px] font-medium leading-normal tracking-[-0.28px] transition-colors duration-300 text-heading-black/80 hover:text-heading-black/100" data-track="Link Clicked" data-track-properties="{"label": "Docs"}" href="/kb/1017/install"><span>Docs</span><div class="absolute bottom-[-6px] left-[25%] right-0 z-[100] flex h-[3px] w-[50%] items-center justify-center rounded-[5px] opacity-0 group-hover:opacity-100 bg-heading-black/80"></div></a><a class="group relative text-[14px] font-medium leading-normal tracking-[-0.28px] transition-colors duration-300 text-heading-black/80 hover:text-heading-black/100" data-track="Link Clicked" data-track-properties="{"label": "Blog"}" href="/blog"><span>Blog</span><div class="absolute bottom-[-6px] left-[25%] right-0 z-[100] flex h-[3px] w-[50%] items-center justify-center rounded-[5px] opacity-0 group-hover:opacity-100 bg-heading-black/80"></div></a><a class="group relative text-[14px] font-medium leading-normal tracking-[-0.28px] transition-colors duration-300 text-heading-black/80 hover:text-heading-black/100" data-track="Link Clicked" data-track-properties="{"label": "Pricing"}" href="/pricing"><span>Pricing</span><div class="absolute bottom-[-6px] left-[25%] right-0 z-[100] flex h-[3px] w-[50%] items-center justify-center rounded-[5px] opacity-0 group-hover:opacity-100 bg-heading-black/80"></div></a></nav></div><div class="hidden xl-small:flex xl-small:items-center xl-small:gap-[25px]"><a class="t-14 font-medium transition-colors duration-300 text-heading-black/80 hover:text-gray-1000" data-track="Link Clicked" data-track-properties="{"label": "Download"}" href="/download">Download</a><a class="t-14 font-medium transition-colors duration-300 text-heading-black/80 hover:text-gray-1000" data-track="Link Clicked" data-track-properties="{"label": "Log in"}" href="https://login.tailscale.com/welcome">Log in</a><a class="t-14 font-medium transition-colors duration-300 text-heading-black/80 hover:text-gray-1000" data-track="Link Clicked" data-track-properties="{"label": "Contact sales"}" href="/contact/sales">Contact sales</a><a data-track="Link Clicked" data-track-properties="{"label": Get started - it's free!}" href="https://login.tailscale.com/start"><div class="inline-flex shrink-0 border transition-colors duration-200 w-full xs:w-auto items-center justify-center text-center relative focus:outline-none group transition-all overflow-hidden font-body font-medium rounded-lg group gap-[11px] py-2 px-[17px] leading-[1.46] tracking-[-0.16px] transition-colors duration-300 bg-heading-black border-heading-black text-white hover:bg-gray-900 hover:border-gray-900 "><div>Get started - it's free!</div></div></a></div><button type="button" aria-label="Open Menu" class="flex xl-small:hidden"><svg width="55" height="30" viewBox="0 0 55 30" fill="none" xmlns="http://www.w3.org/2000/svg"><rect class="fill-gray-900" x="0.5" y="0.5" width="54" height="29" rx="5.5"></rect><line class="origin-center transition duration-300 rotate-0" x1="17" y1="11.5" x2="38" y2="11.5" stroke="white"></line><line class="origin-center transition duration-300 rotate-0" x1="17" y1="17.5" x2="38" y2="17.5" stroke="white"></line><rect x="0.5" y="0.5" width="54" height="29" rx="5.5" stroke="#1F1E1E"></rect></svg></button></div></header><div class="fixed inset-0 z-[90] h-full w-full overflow-auto bg-white px-5 pb-20 pt-24 transition-opacity duration-200 will-change-[opacity] xl-small:hidden pointer-events-none opacity-0"><div class="space-y-[22px]"><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><div class="t-20 flex w-full items-center justify-between font-medium "><span>Product</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 rotate-90 bg-gray-900 text-white"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></div><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"><div class="left-[-110px] top-[57px] z-[100] flex flex-col justify-between gap-8 rounded-2xl bg-white py-[30px] will-change-transform lg:absolute lg:flex-row lg:gap-[50px] lg:border lg:px-[30px] xl:left-[-40px]" style="opacity:0"><div class="flex-1 lg:min-w-[266px]"><div class="t-14 relative z-[10] mb-2 text-gray-500 lg:mb-[15px] lg:ml-3">Meet Tailscale</div><ul><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "How it works"}" href="/blog/how-tailscale-works"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">How it works</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Why Tailscale"}" href="/why-tailscale"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Why Tailscale</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "WireGuard® for Enterprises"}" href="/wireguard-vpn"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">WireGuard® for Enterprises</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Bring Tailscale to Work"}" href="/bring-tailscale-to-work"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Bring Tailscale to Work</div></div></a></li></ul></div><div class="flex-1 lg:min-w-[266px]"><div class="t-14 relative z-[10] mb-2 text-gray-500 lg:mb-[15px] lg:ml-3">Explore</div><ul><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Integrations"}" href="/integrations"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Integrations</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Features"}" href="/features"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Features</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Compare Tailscale"}" href="/compare"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Compare Tailscale</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Community Projects"}" href="/community/community-projects"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Community Projects</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Partnerships"}" href="/partnerships"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Partnerships</div></div></a></li></ul></div></div></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><div class="t-20 flex w-full items-center justify-between font-medium "><span>Solutions</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 rotate-90 bg-gray-900 text-white"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></div><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"><div class="left-[-110px] top-[57px] z-[100] flex flex-col justify-between gap-8 rounded-2xl bg-white py-[30px] will-change-transform lg:absolute lg:flex-row lg:gap-[50px] lg:border lg:px-[30px] xl:left-[-40px]" style="opacity:0"><div class="flex-1 lg:min-w-[266px]"><div class="t-14 relative z-[10] mb-2 text-gray-500 lg:mb-[15px] lg:ml-3">By use-case</div><ul><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Remote Access"}" href="/use-cases/remote-access"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Remote Access</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Site-to-site Networking"}" href="/use-cases/site-to-site-networking"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Site-to-site Networking</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Multi-Cloud Networking"}" href="/use-cases/multi-cloud-networking"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Multi-Cloud Networking</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Kubernetes Networking"}" href="/use-cases/kubernetes"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Kubernetes Networking</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Edge & IoT Deployments"}" href="/use-cases/iot"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Edge & IoT Deployments</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Zero Trust Networking"}" href="/use-cases/zero-trust-networking"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Zero Trust Networking</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "AI Workloads"}" href="/use-cases/ai"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">AI Workloads</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Secure SaaS"}" href="/use-cases/secure-saas"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Secure SaaS</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Business VPN"}" href="/use-cases/business-vpn"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Business VPN</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Homelab"}" href="/use-cases/homelab"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Homelab</div></div></a></li></ul></div><div class="flex-1 lg:min-w-[266px]"><div class="t-14 relative z-[10] mb-2 text-gray-500 lg:mb-[15px] lg:ml-3">By role</div><ul><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "DevOps"}" href="/solutions/devops"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">DevOps</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "IT"}" href="/solutions/it"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">IT</div></div></a></li><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Security"}" href="/solutions/security"><div class="flex items-center gap-2"><div class="t-16 relative z-[10] text-heading-black">Security</div></div></a></li></ul></div></div></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><a class="t-20 flex w-full items-center justify-between font-medium " href="/enterprise"><span>Enterprise</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 -rotate-0 bg-gray-50"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></a><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"><div class="left-[-110px] top-[57px] z-[100] flex flex-col justify-between gap-8 rounded-2xl bg-white py-[30px] will-change-transform lg:absolute lg:flex-row lg:gap-[50px] lg:border lg:px-[30px] xl:left-[-40px]" style="opacity:0"><div class="flex-1 lg:min-w-[266px]"><ul></ul></div></div></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><a class="t-20 flex w-full items-center justify-between font-medium " href="/customers"><span>Customers</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 -rotate-0 bg-gray-50"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></a><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"><div class="left-[-110px] top-[57px] z-[100] flex flex-col justify-between gap-8 rounded-2xl bg-white py-[30px] will-change-transform lg:absolute lg:flex-row lg:gap-[50px] lg:border lg:px-[30px] xl:left-[-40px]" style="opacity:0"><div class="flex-1 lg:min-w-[266px]"><div class="t-14 relative z-[10] mb-2 text-gray-500 lg:mb-[15px] lg:ml-3">Nav heading here</div><ul><li class="group relative whitespace-nowrap"><a class="relative z-[10] inline-block w-full rounded-lg px-1 py-2 hover:bg-gray-50 lg:p-[12px]" data-track="Link Clicked" data-track-properties="{"label": "Title here"}" href="https://tailscale.com/customers"><div class="flex items-center gap-2"><img alt="Alt text " loading="lazy" width="300" height="120" decoding="async" data-nimg="1" class="relative z-[10] brightness-100 saturate-100 transition duration-200 lg:brightness-[1.1] lg:saturate-0 lg:brightness-100 lg:saturate-100" style="color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 300 120'%3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAwAB/ucNC4UAAAAASUVORK5CYII='/%3E%3C/svg%3E")" srcSet="https://cdn.sanity.io/images/w77i7m8x/production/a06dc612b1e3e4f4df53a72030002600639a8738-300x120.png?w=384&q=75&fit=clip&auto=format 1x, https://cdn.sanity.io/images/w77i7m8x/production/a06dc612b1e3e4f4df53a72030002600639a8738-300x120.png?w=640&q=75&fit=clip&auto=format 2x" src="https://cdn.sanity.io/images/w77i7m8x/production/a06dc612b1e3e4f4df53a72030002600639a8738-300x120.png?w=640&q=75&fit=clip&auto=format"/><div class="t-16 relative z-[10] text-heading-black">Title here</div></div><div class="t-14 relative z-[10] mt-1 line-clamp-2 !font-normal !leading-[1.28] text-heading-black/80">How Cribl Enables Secure Work From Anywhere with Tailscale</div></a></li></ul></div></div></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><a class="t-20 flex w-full items-center justify-between font-medium " href="/kb/1017/install"><span>Docs</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 -rotate-0 bg-gray-50"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></a><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"><div class="left-[-110px] top-[57px] z-[100] flex flex-col justify-between gap-8 rounded-2xl bg-white py-[30px] will-change-transform lg:absolute lg:flex-row lg:gap-[50px] lg:border lg:px-[30px] xl:left-[-40px]" style="opacity:0"><div class="flex-1 lg:min-w-[266px]"><ul></ul></div></div></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><a class="t-20 flex w-full items-center justify-between font-medium " href="/blog"><span>Blog</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 -rotate-0 bg-gray-50"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></a><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"><div class="left-[-110px] top-[57px] z-[100] flex flex-col justify-between gap-8 rounded-2xl bg-white py-[30px] will-change-transform lg:absolute lg:flex-row lg:gap-[50px] lg:border lg:px-[30px] xl:left-[-40px]" style="opacity:0"><div class="flex-1 lg:min-w-[266px]"><ul></ul></div></div></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><a class="t-20 flex w-full items-center justify-between font-medium " href="/pricing"><span>Pricing</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 -rotate-0 bg-gray-50"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></a><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"><div class="left-[-110px] top-[57px] z-[100] flex flex-col justify-between gap-8 rounded-2xl bg-white py-[30px] will-change-transform lg:absolute lg:flex-row lg:gap-[50px] lg:border lg:px-[30px] xl:left-[-40px]" style="opacity:0"><div class="flex-1 lg:min-w-[266px]"><ul></ul></div></div></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><a class="t-20 flex w-full items-center justify-between font-medium " href="/download"><span>Download</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 -rotate-0 bg-gray-50"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></a><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"></div></div><div class="relative overflow-hidden border-b border-stroke-gray pb-6 "><a class="t-20 flex w-full items-center justify-between font-medium " href="/contact/sales"><span>Contact sales</span><span class="flex h-[22px] w-[22px] items-center justify-center rounded-full text-gray-1000 transition-transform duration-300 -rotate-0 bg-gray-50"><svg width="10" height="10" viewBox="0 0 10 10" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.83344 7.82482L8.83656 4.99835L5.83344 2.17188L5.24469 2.72658L7.24156 4.60599H1.16406V5.3907H7.24156L5.24469 7.27011L5.83344 7.82482Z" fill="currentColor"></path></svg></span></a><div class="flex flex-col transition duration-300 will-change-[height] h-0 opacity-0"></div></div></div><a class="mt-[42px] block" data-track="Link Clicked" data-track-properties="{"label": "Get started - it's free!"}" href="https://login.tailscale.com/start"><div class="inline-flex shrink-0 border transition-colors duration-200 w-full xs:w-auto items-center justify-center text-center relative focus:outline-none group transition-all overflow-hidden font-body font-medium rounded-lg group gap-[11px] py-2 px-[17px] leading-[1.46] tracking-[-0.16px] !w-full py-3 bg-heading-black border-heading-black text-white hover:bg-gray-900 hover:border-gray-900 "><div>Get started - it's free!</div></div></a><a class="mt-[15px] block" data-track="Link Clicked" data-track-properties="{"label": "Login"}" href="https://login.tailscale.com/welcome"><div class="inline-flex shrink-0 border transition-colors duration-200 w-full xs:w-auto items-center justify-center text-center relative focus:outline-none group transition-all overflow-hidden font-body font-medium rounded-lg group gap-[11px] py-2 px-[17px] leading-[1.46] tracking-[-0.16px] !w-full py-3 bg-gray-200 border-gray-200 text-heading-black"><div>Login</div></div></a><div class="t-14 mx-auto mt-[55px] max-w-[264px] text-center text-gray-600"></div><div class="mt-[35px] flex flex-wrap justify-center gap-[14px]"></div><div class="mt-[60px] flex items-center justify-center gap-[8px]"><span class="scale-[1.1] text-heading-black transition-colors duration-300 hover:text-red-900"><svg width="28" height="29" viewBox="0 0 28 29" fill="none" xmlns="http://www.w3.org/2000/svg"><rect y="0.988281" width="28" height="28" rx="14" fill="currentColor"></rect><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M8.03169 9L13.0509 15.0672L8 20H9.13675L13.5587 15.6812L17.1317 20H21L15.6985 13.5916L20.3997 9H19.263L15.1906 12.9775L11.9001 9H8.03169ZM9.70337 9.75698H11.4805L19.3281 19.2429H17.551L9.70337 9.75698Z" fill="white"></path></svg></span><span class="scale-[1.1] text-heading-black transition-colors duration-300 hover:text-red-900"><svg width="28" height="28" viewBox="0 0 28 28" fill="none" xmlns="http://www.w3.org/2000/svg"><rect x="0.21875" width="27.2195" height="27.2195" rx="13.6098" fill="currentColor"></rect><path class="transition-colors duration-300 group-hover:fill-heading-black" d="M12.434 19.6598L12.4179 14.8081H10.3008V12.7289H12.4179V11.3427C12.4179 9.47188 13.5974 8.57031 15.2966 8.57031C16.1106 8.57031 16.8101 8.62983 17.014 8.65643V10.6115L15.8355 10.612C14.9114 10.612 14.7324 11.0433 14.7324 11.6762V12.7289H17.3577L16.652 14.8081H14.7324V19.6598H12.434Z" fill="#fff"></path></svg></span><span class="scale-[1.1] text-heading-black transition-colors duration-300 hover:text-red-900"><svg width="28" height="28" viewBox="0 0 28 28" fill="none" xmlns="http://www.w3.org/2000/svg"><rect x="0.439453" width="27.2195" height="27.2195" rx="13.6098" fill="currentColor"></rect><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M8.68685 18.6518H10.8825V11.5871H8.68685V18.6518Z" fill="white"></path><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M8.50195 9.34036C8.50195 10.0352 9.07976 10.6143 9.77312 10.6143C10.4896 10.6143 11.0443 10.0584 11.0443 9.34036C11.0443 8.64547 10.4665 8.06641 9.77312 8.06641C9.07976 8.06641 8.50195 8.64547 8.50195 9.34036Z" fill="white"></path><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M16.8917 18.6518H19.0873V14.7836C19.0873 12.8843 18.6713 11.425 16.4525 11.425C15.3894 11.425 14.6729 12.0041 14.3724 12.56H14.3493V11.5871H12.2461V18.6518H14.4418V15.1542C14.4418 14.2509 14.6267 13.3475 15.7592 13.3475C16.8686 13.3475 16.8917 14.413 16.8917 15.2237V18.6518Z" fill="white"></path></svg></span><span class="scale-[1.1] text-heading-black transition-colors duration-300 hover:text-red-900"><svg width="28" height="28" viewBox="0 0 28 28" fill="none" xmlns="http://www.w3.org/2000/svg"><rect x="0.658203" width="27.2195" height="27.2195" rx="13.6098" fill="currentColor"></rect><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M19.6754 11.46C19.5368 10.5863 19.121 9.98138 18.1506 9.84696C16.6258 9.57813 14.2693 9.57812 14.2693 9.57812C14.2693 9.57812 11.9128 9.57813 10.388 9.84696C9.4177 9.98138 8.93254 10.5863 8.86323 11.46C8.72461 12.3337 8.72461 13.6106 8.72461 13.6106C8.72461 13.6106 8.72461 14.8876 8.86323 15.7613C9.00185 16.635 9.4177 17.2399 10.388 17.3743C11.9128 17.6432 14.2693 17.6432 14.2693 17.6432C14.2693 17.6432 16.6258 17.6432 18.1506 17.3743C19.121 17.1727 19.5368 16.635 19.6754 15.7613C19.814 14.8876 19.814 13.6106 19.814 13.6106C19.814 13.6106 19.814 12.3337 19.6754 11.46ZM12.8831 15.6269V11.5944L16.3486 13.6106L12.8831 15.6269Z" fill="white"></path></svg></span></div><div class="t-14 mx-auto mt-10 max-w-[264px] text-center text-gray-600"> © 2025 </div></div><main class="container"><section class="overflow-hidden pt-24 md:pt-[164px]"><div class="container"><div class="flex w-full max-w-[1060px] gap-[30px]"><div class="hidden flex-[0_1_200px] md:block"></div><div class="flex-[1_1_843px] border-b border-stroke-gray pb-10"><h1 class="t-72">Changelog</h1><p class="t-b20 mt-[30px] text-subheading-black">Updates to the Tailscale client and service.</p><div class="items mt-[30px] flex gap-[30px]"><a href="/changelog/index.xml" class="flex items-center gap-[10px] transition-colors duration-200 hover:text-blue-500" data-track="Link Clicked" data-track-properties="{"label":"Subscribe via RSS"}"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 17 17" class="h-auto w-[0.9em]"><use href="/sprite.svg#rss"></use></svg><span>Subscribe via RSS</span></a></div></div></div></div></section><section class="mt-10 overflow-hidden"><div class="container mb-12 md:mb-[60px]"><div class="flex w-full max-w-[1060px] gap-[30px]"><div class="hidden flex-[0_1_200px] md:block"></div><div class="flex-[1_1_843px]"><nav class="flex items-center gap-4"><a id="all" class="rounded-full border px-4 py-1 text-sm leading-[1.75rem] transition-colors duration-200 border-gray-900 bg-gray-900 text-white" href="#all">All Changes</a><a id="service" class="rounded-full border px-4 py-1 text-sm leading-[1.75rem] transition-colors duration-200 border-gray-1000/5 bg-transparent text-heading-black hover:bg-gray-1000/5" href="#service">Service</a><a id="client" class="rounded-full border px-4 py-1 text-sm leading-[1.75rem] transition-colors duration-200 border-gray-1000/5 bg-transparent text-heading-black hover:bg-gray-1000/5" href="#client">Client</a><a id="other" class="rounded-full border px-4 py-1 text-sm leading-[1.75rem] transition-colors duration-200 border-gray-1000/5 bg-transparent text-heading-black hover:bg-gray-1000/5" href="#other">Other</a></nav></div></div></div><div class="container space-y-10 md:space-y-20"><article id="2025-04-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-04-02">Apr 2, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-04-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes Operator session recording</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1454/kubernetes-operator-session-recording">Tailscale Kubernetes Operator session recording</a> to record <a href="https://kubernetes.io/docs/reference/kubectl/generated/kubectl_exec/">kubectl exec</a> session contents when using the <a href="/kb/1437/kubernetes-operator-api-server-proxy">Kubernetes API server proxy</a> (<a href="/kb/1167/release-stages#beta">beta</a>).</li> </ul> </div></div></div><div id="2025-04-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes Operator GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/k8s-operator-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes Operator</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>). <ul> <li>Use the Kubernetes Operator to integrate Tailscale with Kubernetes clusters.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2025-03-31" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-03-31">Mar 31, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-03-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.82.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="changed">Alpine image is updated to version 3.19.</li> </ul> </div></div></div><div id="2025-03-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.82.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see our <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new">Ingress TLS certificates can be issued from <a href="https://letsencrypt.org/docs/staging-environment/">Let's Encrypt's staging environment</a> to avoid bumping into rate limits during initial setup. See our <a href="https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclassspec">GitHub documentation on ProxyClass APIs</a> to learn more.</li> <li data-change="changed">Alpine image is updated to version 3.19.</li> </ul> </div></div></div><div id="2025-03-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.82.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div></div></div></article><article id="2025-03-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-03-27">Mar 27, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-03-27-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.82.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><strong>Note:</strong> v1.82.1 includes fixes for Android devices only, and is exclusively released for Android.</p> <h6>Android</h6> <ul> <li data-change="new">Device search is available on Android TV running Android 13 or later.</li> <li data-change="new">Enhanced device search UI is available on all devices running Android 13 or later.</li> </ul> </div></div></div></div></div></article><article id="2025-03-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-03-26">Mar 26, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-03-26-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.82.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1232/derp-servers">DERP</a> functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use <a href="https://letsencrypt.org/">Let's Encrypt</a> or WebPKI certificates.</li> <li data-change="changed">Go is updated to version 1.24.1</li> <li data-change="changed">NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available, in the event of a slow or misbehaving server.</li> <li data-change="fixed"><a href="/kb/1457/captive-portals">Captive portal</a> detection reliability is improved on some in-flight Wi-Fi networks, including British Airways and WestJet.</li> <li data-change="fixed">Port mapping success rate is improved by retrying in additional error cases.</li> <li data-change="fixed"><a href="/kb/1325/device-web-interface">Web interface</a> setting changes occur as expected and without error.</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">The <a href="https://pkgs.tailscale.com/stable/#macos">.pkg installer</a> size is decreased by 35%.</li> <li data-change="fixed">Memory leak issue related to <a href="/kb/1233/mac-ios-shortcuts">shortcuts</a> is resolved.</li> <li data-change="fixed"><a href="/kb/1081/magicdns">MagicDNS</a> intermittent configuration failures no longer occur when waking from sleep.</li> <li data-change="fixed">Seamless <a href="/kb/1028/key-expiry#renewing-keys-for-an-expired-device">key renewals</a> occur as expected, ensuring the client remains connected.</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Memory leak issue related to <a href="/kb/1233/mac-ios-shortcuts">shortcuts</a> is resolved.</li> <li data-change="fixed"><a href="/kb/1081/magicdns">MagicDNS</a> intermittent configuration failures no longer occur when waking from sleep.</li> </ul> <h6>Android</h6> <p><strong>Note:</strong> The Android client release for v1.82.0 was delayed and moved into the v1.82.1 client release instead.</p> <h6>App connectors</h6> <ul> <li data-change="fixed"><a href="/kb/1411/device-connectivity#port-mapping">Port mapping</a> success rates for <a href="/kb/1281/app-connectors">app connectors</a> are improved.</li> </ul> </div></div></div></div></div></article><article id="2025-03-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-03-13">Mar 13, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-03-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale GitHub Action support for Windows and macOS</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The <a href="https://github.com/tailscale/github-action">Tailscale GitHub Action</a> supports running on Windows <a href="https://docs.github.com/en/actions/about-github-actions/understanding-github-actions#runners">runners</a> (<a href="/kb/1167/release-stages/#beta">beta</a>).</li> <li data-change="new">The <a href="https://github.com/tailscale/github-action">Tailscale GitHub Action</a> supports running on macOS <a href="https://docs.github.com/en/actions/about-github-actions/understanding-github-actions#runners">runners</a> (<a href="/kb/1167/release-stages/#beta">beta</a>).</li> </ul> </div></div></div></div></div></article><article id="2025-03-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-03-07">Mar 7, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-03-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Admin console session timeout update</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="fixed">An issue related to admin console sessions remaining active longer than the configured <a href="/kb/1461/admin-console-session-timeout">console session inactivity timeouts</a> (<a href="/security-bulletins/#ts-2025-001">TS-2025-001</a>).</li> </ul> </div></div></div></div></div></article><article id="2025-03-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-03-05">Mar 5, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-03-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Helsinki DERP region</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Helsinki is added as a <a href="/kb/1232/derp-servers">DERP region</a>.</li> </ul> </div></div></div><div id="2025-03-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale promo codes for plan upgrades</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Promo codes can be applied when upgrading to a Tailscale <a href="/pricing">paid plan</a> in the <a href="https://login.tailscale.com/admin/settings/billing">Billing</a> page of the admin console. While upgrading your plan, go to the <strong>Upgrading to</strong> section and select <strong>Apply promo code</strong>. For more information, see <a href="/kb/1251/pricing-faq#how-do-i-get-a-tailscale-promo-code">Pricing & Plans FAQ</a>.</li> </ul> </div></div></div></div></div></article><article id="2025-03-04" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-03-04">Mar 4, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-03-04-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.80.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="fixed"><a href="/kb/1325/device-web-interface">Web interface</a> setting changes occur as expected and without error.</li> </ul> <h6>App connectors</h6> <ul> <li data-change="fixed"><a href="/kb/1281/app-connectors">App connectors</a> respond to DNS queries and update routes without failure. Previously, DNS resolution failures may have occurred due to a routing deadlock issue.</li> </ul> </div></div></div><div id="2025-03-04-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.80.3</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div><div id="2025-03-04-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.80.3</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see our <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div><div id="2025-03-04-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.80.3</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div></div></div></article><article id="2025-02-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-02-26">Feb 26, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-02-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Terraform Provider v0.18.0</h3></header><div><div class="t-b18 changelog-entry"><p>v0.18.0 of the <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest">Tailscale Terraform Provider</a> has been released with the following changes:</p> <ul> <li data-change="changed">The <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/logstream_configuration">tailscale_logstream_configuration</a> resource can now manage streaming to <a href="/kb/1255/log-streaming?tab=amazon+s3#add-configuration-log-streaming">Amazon S3</a> and <a href="/kb/1255/log-streaming?tab=s3-compatible#add-configuration-log-streaming">S3-compatible services</a></li> <li data-change="changed">The <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/tailnet_key">tailscale_tailnet_key</a> resource can now be imported.</li> <li data-change="new">Added a <code>reset_acl_on_destroy</code> property to the <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/acl">tailscale_acl</a> resource which optionally allows for resetting the Tailscale policy file to its default when the resource is destroyed.</li> </ul> </div></div></div></div></div></article><article id="2025-02-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-02-13">Feb 13, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-02-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Ashburn and Nuremberg DERP regions</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Ashburn and Nuremberg are added as <a href="/kb/1232/derp-servers">DERP regions</a>. We added them December 5, 2024, and apologize for the late notice.</li> </ul> </div></div></div><div id="2025-02-13-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.80.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Nodes could lose the display names of owners of peers in rare cases. This had manifested in missing names in <a href="/kb/1080/cli#status"><code>tailscale status</code></a> and could prevent incoming <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> connections from being accepted. The behavior is reverted to that of v1.78.x and earlier.</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">SSH clients that skip the <a href="/kb/1193/tailscale-ssh#authentication-and-authorization"><code>none</code></a> auth method and immediately try <code>publickey</code> can connect to <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> as expected. The behavior is reverted to that of v1.78.x and earlier.</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">SSH clients that skip the <code>none</code> auth method and immediately try <code>publickey</code> can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.</li> </ul> <h6>FreeBSD</h6> <ul> <li data-change="fixed">SSH clients that skip the <code>none</code> auth method and immediately try <code>publickey</code> can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.</li> </ul> </div></div></div></div></div></article><article id="2025-02-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-02-07">Feb 7, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-02-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Country device posture attribute GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Use <code>ip:country</code> as a geolocation <a href="/kb/1288/device-posture#device-posture-attributes">device posture attribute</a> (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div></div></div></article><article id="2025-02-06" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-02-06">Feb 6, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-02-06-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.80.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>macOS</h6> <ul> <li data-change="fixed"><code>System extension uninstalled</code> message no longer appears erroneously when removing third-party system extensions while Tailscale is running.</li> <li data-change="fixed">Resolved an issue that could have caused the network extension to crash in rare cases while parsing the macOS routing table.</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Resolved an issue that could have caused the network extension to crash in rare cases while parsing the iOS routing table.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed">Resolved an issue that could have caused the network extension to crash in rare cases while parsing the tvOS routing table.</li> </ul> </div></div></div></div></div></article><article id="2025-02-03" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-02-03">Feb 3, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-02-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.80.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="changed">TLS certificate requests from <a href="https://letsencrypt.org">Let’s Encrypt</a> include the device's DNS name in the CSR’s SAN extension and set the <code>Common Name</code> field.</li> <li data-change="fixed"><a href="/kb/1223/funnel">Tailscale Funnel</a> configuration on devices displays errors when <a href="/kb/1072/client-preferences#allow-incoming-connections">incoming connections</a> are not permitted and connections are disallowed.</li> <li data-change="fixed">Tailscale Funnel disabled on a device no longer displays as enabled in the admin console.</li> <li data-change="fixed">Serve config provided using the <code>TS_SERVE_CONFIG</code> environment variable successfully loads for tailnets with HTTPS disabled, as long as the serve config does not define an HTTPS endpoint.</li> </ul> </div></div></div><div id="2025-02-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.80.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new">The optional <a href="/kb/1445/kubernetes-operator-customization#prometheus-servicemonitor"><code>ServiceMonitor</code></a> created for the proxy metrics endpoints can be labelled with user-specified labels.</li> <li data-change="new">Proxies created for the Kubernetes Operator dynamically reload the <a href="/kb/1278/tailscaled">tailscaled</a> configuration when it has changed. Changes such as a hostname might mean slightly slower change propagation (up to a minute), but less downtime.</li> <li data-change="changed">TLS certificate requests from <a href="https://letsencrypt.org">Let’s Encrypt</a> include the device's DNS name in the CSR’s SAN extension and set the <code>Common Name</code> field.</li> <li data-change="fixed">Improved failover for egress <a href="/kb/1438/kubernetes-operator-cluster-egress#configure-an-egress-service-using-proxygroup"><code>ProxyGroup</code></a> replicas. Replica restarts no longer cause downtime for cluster workloads that access tailnet targets using egress <code>ProxyGroup</code>.</li> </ul> </div></div></div><div id="2025-02-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.80.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="changed">TLS certificate requests from <a href="https://letsencrypt.org">Let’s Encrypt</a> include the device's DNS name in the CSR’s SAN extension and set the <code>Common Name</code> field.</li> </ul> </div></div></div></div></div></article><article id="2025-01-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-01-30">Jan 30, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-01-30-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.80.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1315/mdm-keys#set-whether-device-hostnames-can-be-modified"><code>Hostname</code></a> system policy is added for overriding the device hostname configured by the operating system, using an MDM solution.</li> <li data-change="changed"><a href="/kb/1080/cli#configure"><code>tailscale configure</code></a> CLI command and corresponding subcommands are no longer in <a href="/kb/1167/release-stages#alpha">alpha</a>, except for the subcommand <code>kubeconfig</code>, which remains in alpha.</li> <li data-change="fixed"><a href="/kb/1325/device-web-interface">Web interface</a> displays a <strong>Login</strong> button instead of the <strong>Reauthenticate</strong> button when adding a new device to your tailnet.</li> <li data-change="fixed"><a href="/kb/1223/funnel">Tailscale Funnel</a> configuration on devices displays errors when <a href="/kb/1072/client-preferences#allow-incoming-connections">incoming connections</a> are not permitted and connections are disallowed.</li> <li data-change="fixed">Connections to a <a href="/blog/opensource#the-open-source-coordination-server">custom coordination server</a> that does not support HTTPS will no longer fail when a custom port number is specified.</li> </ul> <h6>Linux</h6> <ul> <li data-change="changed">TLS certificate requests from <a href="https://letsencrypt.org">Let’s Encrypt</a> include the device's DNS name in the CSR’s SAN extension and set the <code>Common Name</code> field.</li> <li data-change="fixed"><a href="/kb/1223/funnel">Tailscale Funnel</a> disabled on a device no longer displays enabled in the admin console.</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">Onboarding flow is added for easier initial setup of the app.</li> <li data-change="changed">TLS certificate requests from <a href="https://letsencrypt.org">Let’s Encrypt</a> include the device's DNS name in the CSR’s SAN extension and set the <code>Common Name</code> field.</li> <li data-change="fixed">Client installs as expected when using <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsi/8ac65057-0663-45e5-9718-f490e87945dc">Group Policy Software Installation</a> (GPSI).</li> <li data-change="fixed">Race conditions that result in an incorrect state or a deadlock no longer cause issues when multiple Windows users are logged in simultaneously.</li> </ul> <h6>macOS</h6> <ul> <li data-change="new"><a href="/kb/1080/cli#configure"><code>configure sysext activate</code></a>, <a href="/kb/1080/cli#configure"><code>configure sysext deactivate</code></a>, and <a href="/kb/1080/cli#configure"><code>configure sysext status</code></a> CLI commands are added to the Standalone variant for managing the activation flow of the macOS system extension programmatically.</li> <li data-change="new">Standalone variant detects if the system extension is manually disabled or uninstalled by the user and displays a notice in the client UI.</li> <li data-change="new"><strong>Flush DNS Cache</strong> option is added to the <a href="/kb/1023/troubleshooting#debug-menu-and-options">Debug menu</a>.</li> <li data-change="changed">TLS certificate requests from <a href="https://letsencrypt.org">Let’s Encrypt</a> include the device's DNS name in the CSR’s SAN extension and set the <code>Common Name</code> field.</li> <li data-change="fixed">App preferences re-set configures <strong>Use Tailscale Subnets</strong> to On and <strong>Allow Incoming Connections</strong> to Off as these are the default settings.</li> <li data-change="fixed"><a href="/kb/1233/mac-ios-shortcuts#find-devices">Find Devices</a> shortcut action no longer hangs.</li> <li data-change="fixed">Standalone variant works as expected when users are not members of <code>staff</code> macOS user group.</li> </ul> <h6>iOS</h6> <ul> <li data-change="new"><a href="/kb/1085/auth-keys">Auth keys</a> can be used for connecting to a <a href="/blog/opensource#the-open-source-coordination-server">custom coordination server</a>.</li> <li data-change="changed">VPN extension no longer runs when logging out.</li> <li data-change="fixed"><a href="/kb/1233/mac-ios-shortcuts#find-devices">Find Devices</a> shortcut action no longer hangs.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="new"><a href="/kb/1085/auth-keys">Auth keys</a> are supported for <a href="/kb/1280/appletv#install-tailscale-on-tvos">authenticating an Apple TV</a> in your tailnet.</li> <li data-change="new">Auth keys can be used for connecting to a <a href="/blog/opensource#the-open-source-coordination-server">custom coordination server</a>.</li> <li data-change="changed">VPN extension no longer runs when logging out.</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Devices can be configured as a <a href="/kb/1019/subnets">subnet router</a> in the <strong>Settings</strong> menu of the app.</li> </ul> </div></div></div></div></div></article><article id="2025-01-29" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-01-29">Jan 29, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-01-29-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">GitHub username change automatically updates tailnet name</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">When a user changes their GitHub username used to authenticate to a <a href="/kb/1284/sso-github#create-a-github-personal-tailnet">GitHub personal tailnet</a>, upon next Tailscale login their <a href="/kb/1217/tailnet-name">tailnet name</a> will automatically be renamed. This is a change from the previous behavior, which required the user to file a request with the Tailscale support team to rename the tailnet.</li> </ul> </div></div></div></div></div></article><article id="2025-01-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-01-27">Jan 27, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">4via6 subnet routers GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"> Use <a href="/kb/1201/4via6-subnets">4via6 subnet routers</a> to route traffic when you have existing subnets with overlapping IPv4 addresses (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Auto approvers GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Use <a href="/kb/1337/acl-syntax/#autoapprovers">auto approvers</a> to auto-approve advertised subnet routes and exit nodes (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Node attributes GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Configure <a href="/kb/1218/nextdns#use-different-nextdns-profiles-for-different-devices">different NextDNS profiles for different devices</a> using <a href="/kb/1337/acl-syntax/#nodeattrs"><code>nodeAttrs</code></a> (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Download invoices GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1182/billing-information/#download-invoices">Download invoices</a> for your Tailscale account in the <a href="https://login.tailscale.com/admin/settings/billing"><strong>Billing</strong></a> page of the admin console (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Fast user switching GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Use <a href="/kb/1225/fast-user-switching">fast user switching</a> to quickly switch between two or more logged-in accounts on the same device, without requiring you to re-authenticate (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Configuration log streaming integration with S3 buckets GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Stream <a href="/kb/1255/log-streaming#configuration-log-streaming">configuration audit logs</a> to <a href="/kb/1255/log-streaming?tab=amazon+s3#add-configuration-log-streaming">Amazon S3</a> and <a href="/kb/1255/log-streaming?tab=s3-compatible#add-configuration-log-streaming">S3-compatible services</a> (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Network flow log streaming integration with S3 buckets GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Stream <a href="/kb/1255/log-streaming#network-log-streaming">network flow logs</a> to <a href="/kb/1255/log-streaming?tab=amazon+s3#add-a-network-log-streaming-destination">Amazon S3</a> and <a href="/kb/1255/log-streaming?tab=s3-compatible#add-a-network-log-streaming-destination">S3-compatible services</a> (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div><div id="2025-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">NextDNS profiles per device GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Use <a href="/kb/1218/nextdns#use-different-nextdns-profiles-for-different-devices">different NextDNS profiles for different devices</a> (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>).</li> </ul> </div></div></div></div></div></article><article id="2025-01-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2025-01-22">Jan 22, 2025</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2025-01-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">GitHub secret scanning</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/github-secret-scanning"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://docs.github.com/code-security/secret-scanning/introduction/about-secret-scanning">GitHub secret scanning</a> supports <a href="https://tailscale.com/kb/1301/secret-scanning#github">detecting and revoking leaked Tailscale secrets</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-12-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-12-13">Dec 13, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-12-13-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.78.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><strong>Note</strong>: Tailscale v1.78.2 was an internal-only release.</p> <h6>Containers</h6> <ul> <li data-change="fixed">Unit test that would previously fail if run in a container.</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed"><strong>Advanced DNS Settings</strong> view unexpectedly dismissed on iPhone.</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">Work in progress search bar is hidden behind a flag until the feature is ready.</li> </ul> </div></div></div></div></div></article><article id="2024-12-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-12-12">Dec 12, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-12-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.78.3</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="fixed">A nil pointer exception when serve config is provided via the <code>TS_SERVE_CONFIG</code> environment variable.</li> </ul> </div></div></div><div id="2024-12-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.78.3</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div><div id="2024-12-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Mullvad exit nodes with trial tailnets</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The <a href="/kb/1258/mullvad-exit-nodes">Mullvad exit nodes</a> add-on can be purchased for tailnets that are in <a href="/kb/1182/billing-information#how-plans-are-assigned-to-new-tailnets">trial mode</a>.</li> </ul> <br /> <p><strong>Note</strong>: Purchasing the Mullvad exit nodes add-on for your trial tailnet will result in changes requiring action. For more information, see the <a href="/kb/1251/pricing-faq#can-i-use-the-mullvad-exit-nodes-add-on-with-a-tailnet-trial">Pricing & Plans FAQ</a> topic.</p> </div></div></div><div id="2024-12-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.78.3</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div></div></div></article><article id="2024-12-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-12-11">Dec 11, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-12-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Device posture integrations GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Device posture integrations GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Restrict device access with Tailscale <a href="/kb/1288/device-posture">device posture management</a> and additional GA integrations: <a href="/kb/1409/jamf-pro">Jamf Pro</a>, <a href="/kb/1405/kandji">Kandji</a>, <a href="/kb/1410/intune">Microsoft Intune</a>, and <a href="/kb/1390/sentinelone">SentinelOne</a>.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-12-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-12-10">Dec 10, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-12-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.78.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="new">All Tailscale container images are annotated with Open Container Initiative (OCI) <a href="https://specs.opencontainers.org/image-spec/annotations/">annotations</a>.</li> <li data-change="fixed">Clients should more accurately detect whether they are in a container when checking for updates.</li> </ul> </div></div></div><div id="2024-12-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.78.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new"> <p>Tailscale <a href="/kb/1482/client-metrics">client metrics</a> can be enabled using a <code>ProxyClass</code> with the <code>.spec.metrics.enable</code> field set.</p> </li> <li data-change="new"> <p>All Tailscale container images are annotated with Open Container Initiative (OCI) <a href="https://specs.opencontainers.org/image-spec/annotations/">annotations</a>.</p> </li> <li data-change="new"> <p><code>ProxyClass</code> supports configuring topology spread constraints for the Proxy Pods.</p> </li> <li data-change="new"> <p>Connector Custom Resource Definition (CRD) can be used to configure the Kubernetes Operator to deploy a Tailscale <a href="/kb/1281/app-connectors">app connector</a> on Kubernetes.</p> </li> <li data-change="new"> <p>Tailscale running on Kubernetes and using a <a href="https://kubernetes.io/docs/concepts/configuration/secret">Kubernetes Secret</a> as a state store writes Kubernetes Events to its Pod when changes occur to the state stored in the Kubernetes Secret. The same is true when there are errors related to reading or writing the state. This should help debugging issues related to transient errors when talking to the Kubernetes API server to retrieve or update the state Secret.</p> </li> <li data-change="new"> <p>Kubernetes Operator can optionally create a <a href="https://prometheus-operator.dev/">Prometheus ServiceMonitor</a> for proxy resources that have Tailscale <a href="/kb/1482/client-metrics">client metrics</a> enabled.</p> </li> <li data-change="new"> <p>Container Storage Interface (CSI) driver volume for the operator's OAuth client credentials can be configured by using Helm values.</p> </li> <li data-change="new"> <p><a href="/kb/1439/kubernetes-operator-cluster-ingress">Kubernetes Ingress</a> has clearer warnings if it has been deployed to a tailnet that has no HTTPS enabled. Specifically, a new warning in proxy logs and empty hostname on the Ingress status.</p> </li> <li data-change="changed"> <p><code>tailscale.com/tailnet-ip</code> annotation is validated that it holds a valid IP address.</p> </li> <li data-change="changed"> <p>Timeout for Kubernetes API server calls for reading/updating <code>tailscaled</code> state stored in a Kubernetes Secret has been changed from 5 seconds to the total of 30 seconds for the read/update operation and an operation to emit an Event about the state update. This should reduce errors related to slow API server connections.</p> </li> <li data-change="changed"> <p>The <code>ProxyClass</code> field <code>.spec.metrics.enable</code> enables metrics at both <code>/metrics</code> and <code>/debug/metrics</code>, but <code>/debug/metrics</code> is deprecated. Users relying on <code>/debug/metrics</code> need to set <code>.spec.statefulSet.pod.tailscaleContainer.debug.enable</code> (which is a new field in Tailscale 1.78.1) until Tailscale 1.82.0 releases. When 1.82.0 releases, <code>/metrics</code> and <code>/debug/metrics</code> will both independently default to false.</p> </li> <li data-change="changed"> <p>Kubernetes operator proxy containers created for ingress and egress Service resources, Connectors and ProxyGroups are privileged. This is needed because of recent changes in <code>containerd</code>. For more context, see <a href="https://github.com/tailscale/tailscale/pull/14262">tailscale/tailscale/pull/14262</a>.</p> </li> <li data-change="fixed"> <p>Tailscale running on Kubernetes reads its state from a Secret only once, and that is upon initial start. This should reduce bugs caused by transient issues when connecting to the Kubernetes API server as well as reduce the load on the API server and improve latency for state operations.</p> </li> <li data-change="fixed"> <p><a href="/kb/1438/kubernetes-operator-cluster-egress">Kubernetes Egress</a> Service ports for <code>ProxyGroup</code> can be changed from a single unnamed port to one or more named ports.</p> </li> <li data-change="fixed"> <p>Clients should more accurately detect whether they are in a container when checking for updates.</p> </li> </ul> </div></div></div><div id="2024-12-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.78.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="new">All Tailscale container images are annotated with Open Container Initiative (OCI) <a href="https://specs.opencontainers.org/image-spec/annotations/">annotations</a>.</li> <li data-change="fixed">Clients should more accurately detect whether they are in a container when checking for updates.</li> </ul> </div></div></div></div></div></article><article id="2024-12-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-12-05">Dec 5, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-12-05-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.78.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Issue which resulted in an unwanted change in source code line endings.</li> </ul> </div></div></div><div id="2024-12-05-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.78.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1482/client-metrics">Client metrics</a> have been added, to provide insights into Tailscale client behavior, health, and performance.</li> <li data-change="new"><a href="/kb/1080/cli#metrics"><code>tailscale metrics</code></a> command has been added, to expose and collect client metrics for use with third-party monitoring systems.</li> <li data-change="new"><a href="/kb/1080/cli#syspolicy"><code>tailscale syspolicy</code></a> command has been added, to list <a href="/kb/1315/mdm-keys">system policies</a>, reload system policies, or view errors related to the system policies configured on the device.</li> <li data-change="changed">Tailscale system policies are applied immediately when pushed via mobile device management (MDM) or Group Policy, without requiring a client restart.</li> <li data-change="fixed"><a href="/kb/1246/tailscale-ssh-session-recording">Tailscale SSH session recording</a> detects the disappearance of the recorder node sooner. This fix addresses a security vulnerability described in <a href="/security-bulletins#ts-2024-013">TS-2024-013</a>.</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">UI customization <a href="/kb/1315/mdm-keys">system policies</a> are configurable for both devices and users.</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">UI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings.</li> <li data-change="new">The macOS configuration report diagnostic tool can collect a larger amount of diagnostics when requested by Tailscale support. This includes system and process logs on the <a href="/kb/1065/macos-variants#standalone-variant">Standalone variant</a>.</li> <li data-change="new"><strong>Update Available</strong> notifications include a link to the client changelog.</li> <li data-change="changed">On macOS Sequoia, in <strong>System Settings.app</strong> > <strong>Login Items & Extension</strong>, Tailscale is listed as <strong>Tailscale Network Extension</strong> instead of <strong>IPNExtension</strong>, to reduce user confusion.</li> <li data-change="fixed">Performance optimizations reduce CPU and memory usage when parsing network maps, especially for users on larger and busy tailnets.</li> <li data-change="fixed">Performance optimizations at the UI layer reduce flickering of the menus, especially for users on larger and busy tailnets where the contents of the network map change very frequently.</li> <li data-change="fixed">Error messages displayed when failing to toggle a setting are improved and easier to understand.</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">UI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings.</li> <li data-change="new">On iPhones and iPads running iOS 18, the VPN can be toggled from Control Center. Hold down in an empty space to add the Tailscale Control.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="new">UI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings.</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Authentication by using a <a href="/kb/1079/install-android#use-a-generated-code">generated code</a> is available for Android TV users.</li> <li data-change="new">Search bar shows suggestions.</li> <li data-change="fixed">The default avatar displays if the user has no profile picture.</li> <li data-change="fixed">False positive health warnings in the UI are reduced.</li> <li data-change="fixed">Health warnings are no longer displayed in the UI after stopping Tailscale.</li> <li data-change="fixed">Crashes when sharing a file using <a href="/kb/1106/taildrop">Taildrop</a> from another Android app are reduced.</li> <li data-change="fixed">UI padding of the main app toolbar is improved.</li> </ul> </div></div></div></div></div></article><article id="2024-11-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-11-27">Nov 27, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-11-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Country device posture attribute</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><code>ip:country</code> has been added as a <a href="/kb/1288/device-posture#device-posture-attributes">device posture attribute</a> (<a href="/kb/1167/release-stages/#beta">beta</a>).</li> </ul> </div></div></div></div></div></article><article id="2024-11-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-11-14">Nov 14, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-11-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">New and more granular OAuth scopes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">New scopes for <a href="/kb/1215/oauth-clients">OAuth clients</a> have been added with more granular permissions. Existing OAuth clients using the previous set of scopes, and keys generated using these clients, are still valid.</li> </ul> </div></div></div></div></div></article><article id="2024-11-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-11-08">Nov 8, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-11-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.76.6</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="changed">Logging for when clients move home <a href="/kb/1232/derp-servers">DERP</a> regions is improved.</li> <li data-change="fixed">Tailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.</li> </ul> </div></div></div><div id="2024-11-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.76.6</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="changed">Logging for when clients move home <a href="/kb/1232/derp-servers">DERP</a> regions is improved.</li> <li data-change="fixed">Tailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.</li> </ul> </div></div></div><div id="2024-11-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming integration with S3 buckets</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/s3-log-streaming"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Tailscale <a href="/kb/1255/log-streaming#network-log-streaming">network flow logs</a> and <a href="/kb/1255/log-streaming#configuration-log-streaming">configuration audit logs</a> can now be streamed to <a href="https://aws.amazon.com/s3/">Amazon S3</a> and S3-compatible services (<a href="/kb/1167/release-stages/#beta">beta</a>).</li> </ul> </div></div></div><div id="2024-11-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.76.6</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="changed">Logging for when clients move home <a href="/kb/1232/derp-servers">DERP</a> regions is improved.</li> <li data-change="fixed">Tailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.</li> </ul> </div></div></div></div></div></article><article id="2024-11-06" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-11-06">Nov 6, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-11-06-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.76.6</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><strong>Note</strong>: v1.76.4 and v1.76.5 were internal-only releases.</p> <h6>All platforms</h6> <ul> <li data-change="updated">Logging for when clients move home <a href="/kb/1232/derp-servers">DERP</a> regions is improved.</li> <li data-change="fixed">Tailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.</li> </ul>  <h6>Android</h6> <ul> <li data-change="fixed">Android app no longer terminates unexpectedly when performing network transitions.</li> </ul>  </div></div></div></div></div></article><article id="2024-11-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-11-05">Nov 5, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-11-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">User approval and Invite any user GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1239/user-approval">User approval</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>)</li> <li data-change="changed"><a href="/kb/1271/invite-any-user">Invite any user</a> GA</li> </ul> </div></div></div></div></div></article><article id="2024-10-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-10-24">Oct 24, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-10-24-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">1Password XAM device posture integration GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/1password-extended-access-kolide"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">1Password Extended Access Management (XAM) GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li><a href="/kb/1407/kolide">Restrict device access with 1Password XAM</a> (formerly known as Kolide) and Tailscale <a href="/kb/1288/device-posture">device posture management</a>.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-10-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-10-21">Oct 21, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-10-21-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.76.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><strong>Note</strong>: v1.76.3 includes fixes for Windows devices only, and is exclusively released for Windows.</p> <h6>Windows</h6> <ul> <li data-change="fixed">Mullvad VPN submenu no longer fails to populate with <a href="/kb/1258/mullvad-exit-nodes">Mullvad exit nodes</a> if there aren't any non-Mullvad exit nodes in the tailnet.</li> </ul> </div></div></div></div></div></article><article id="2024-10-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-10-17">Oct 17, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-10-17-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.76.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><strong>Note</strong>: v1.76.2 includes fixes for Android TV devices only, and is exclusively released for Android.</p>  <h6>Android</h6> <ul> <li data-change="changed">D-Pad navigation is optimized in the Tailscale app on Android TV devices.</li> </ul>  </div></div></div></div></div></article><article id="2024-10-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-10-16">Oct 16, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-10-16-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.76.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed"><a href="/kb/1080/cli#netcheck"><code>tailscale netcheck</code></a> CLI command no longer crashes when performing diagnostics on networks lacking UDP connectivity.</li> <li data-change="fixed">Improperly formatted <code>SERVFAIL</code> responses no longer cause DNS timeouts when using an <a href="/kb/1103/exit-nodes">exit node</a>.</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">dbus login sessions no longer fail on systems where <code>/bin/login</code> is missing.</li> </ul>  <h6>Android</h6> <ul> <li data-change="fixed">Android application no longer crashes in certain configurations when editing the <a href="/kb/1444/android-app-split-tunneling">app-based split tunneling</a> settings.</li> </ul>  </div></div></div><div id="2024-10-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.76.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div><div id="2024-10-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Google Workspace integration GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/google-workspace-sync-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1317/sso-google-sync">User & group provisioning for Google Workspace</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Sync Google Workspace groups and users to use in your <a href="/kb/1337/acl-syntax/#provisioned-groups">Tailscale ACLs</a>.</li> </ul> </li> </ul> </div></div></div><div id="2024-10-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.76.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new"><a href="/kb/1438/kubernetes-operator-cluster-egress">Tailnet services can be exposed</a> to cluster workloads on multiple proxy replicas using a ProxyGroup. It's also possible to expose multiple tailnet services on a single set of ProxyGroup replicas.</li> <li data-change="fixed">Single use proxy <a href="/kb/1085/auth-keys">auth keys</a> no longer persist in the state Secrets after the proxies have logged in. This should fix an issue where, in some edge cases, the leftover keys were causing the proxies to attempt to re-authenticate after Pod restart.</li> </ul> </div></div></div><div id="2024-10-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.76.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="changed">State directory can be set with the <code>TS_STATE_DIR</code> environment variable. The state directory also defaults to <code>/tmp/</code> for all tsrecorder installations that explicitly set the statefile location.</li> </ul> </div></div></div></div></div></article><article id="2024-10-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-10-10">Oct 10, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-10-10-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.76.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Clients lacking UDP connectivity no longer skip performing fallback latency measurements with <a href="/kb/1232/derp-servers">DERP servers</a>.</li> <li data-change="fixed">Warnings no longer display unnecessarily.</li> <li data-change="fixed">Tailscale connectivity on flights using Inflight Internet Wi-Fi (such as Alaska Airlines) no longer fails.</li> <li data-change="fixed">Service-related processes no longer run unnecessarily when services are disabled on the tailnet.</li> <li data-change="fixed">Error messages include explanations in addition to the HTTP status code.</li> </ul> <h6>Linux</h6> <ul> <li data-change="new"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> supports sending environment variables to hosts. It's also possible to specify permitted environment variables using the <code>acceptEnv</code> field.</li> <li data-change="fixed"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> no longer breaks some terminal applications by omitting pixel width and height when resizing the application window.</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Ping messages sent through <a href="/kb/1019/subnets">subnet routers</a> to unreachable hosts no longer generate ping responses.</li> </ul> <h6>macOS</h6> <ul> <li data-change="new"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> supports sending environment variables to hosts. You must specify permitted environment variables using the <code>acceptEnv</code> field.</li> <li data-change="new">Tailscale <code>.pkg</code> installer for the <a href="/kb/1065/macos-variants#standalone-variant">standalone variant</a> prevents potential conflicts by showing a warning if it detects a Homebrew install of Tailscale.</li> <li data-change="new"><a href="/kb/1225/fast-user-switching">Bug report</a> view shows a warning if Tailscale detects that Cloudflare WARP is installed. Some Cloudflare WARP configurations conflict with Tailscale.</li> <li data-change="fixed">DNS settings no longer improperly set when keys expire or Tailscale stops.</li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">Battery usage is improved when <a href="/kb/1081/magicdns">MagicDNS</a> is enabled. The improvement comes from adjusting the timeout of <a href="/kb/1381/what-is-quad100#10010010010053-is-a-dns-resolver">DNS over HTTPS (DoH)</a> for idle connections and requiring a TLS 1.3 handshake when establishing a connection with the DoH server.</li> <li data-change="fixed">DNS settings no longer improperly set when keys expire or Tailscale stops.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed">DNS settings no longer improperly set when keys expire or Tailscale stops.</li> </ul> <h6>Android</h6> <ul> <li data-change="new"><a href="/kb/1225/fast-user-switching">Account switcher</a> displays the server hostname if the account uses a custom coordination server.</li> <li data-change="changed">Battery usage is improved when <a href="/kb/1081/magicdns">MagicDNS</a> is enabled. The improvement comes from adjusting the timeout of <a href="/kb/1381/what-is-quad100#10010010010053-is-a-dns-resolver">DNS over HTTPS (DoH)</a> for idle connections and requiring a TLS 1.3 handshake when establishing a connection with the DoH server.</li> <li data-change="fixed">Quick tile toggle no longer fails to turn on Tailscale if Tailscale had been manually disconnected before it was last shut down.</li> </ul>  </div></div></div></div></div></article><article id="2024-10-03" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-10-03">Oct 3, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-10-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Personal Plus pricing plan</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The Personal Plus <a href="/pricing">pricing plan</a> offers the same features as the Personal plan with up to 6 users for a flat rate. For details about billing, plan comparison, and support, see <a href="/kb/1251/pricing-faq">Pricing & Plans FAQ</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-10-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-10-02">Oct 2, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-10-02-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.74.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>Tailscale v1.74.2 addresses an issue for iOS, and is exclusively released for that platform.</p> <h6>iOS</h6> <ul> <li data-change="fixed">The Tailscale app launches as expected when <strong>Wi-Fi Calling on This iPhone</strong> is enabled in the iOS <strong>Cellular</strong> settings.</li> </ul> </div></div></div><div id="2024-10-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailnet deletion</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Tailnets containing multiple users can be <a href="/kb/1237/delete-tailnet">deleted</a> from the admin console without first deleting the users manually.</li> </ul> </div></div></div></div></div></article><article id="2024-09-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-09-27">Sep 27, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-09-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Parameters added to Set custom device posture attributes endpoint</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The optional <code>expiry</code> and <code>comment</code> parameters have been added to the <a href="https://tailscale.com/api#tag/devices/POST/device/%7BdeviceId%7D/attributes/%7BattributeKey%7D">Set custom device posture attributes</a> endpoint of the <a href="/kb/1288/device-posture#posture-attributes-api">device posture attribute API</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-09-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-09-18">Sep 18, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-09-18-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.74.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>Tailscale v1.74.1 addresses issues for Linux and Android, and is exclusively released for those platforms.</p> <h6>Linux</h6> <ul> <li data-change="fixed">Linux-only NAT traversal optimization added in v1.74.0 is now disabled following a bug report. The behavior is reverted to that of v1.72.x and earlier and will be re-added in a future release.</li> </ul> <h6>Android</h6> <p><strong>Note:</strong> The Android client release for v1.74.0 was delayed and moved into the v1.74.1 client release instead.</p> <ul> <li data-change="fixed">Device network change detection is improved to reflect accurate <a href="/kb/1054/dns">Tailscale DNS</a> configuration updates.</li> <li data-change="fixed"><a href="/kb/1315/mdm-keys">System policies</a> for the Android client on ChromeOS work as expected.</li> </ul> </div></div></div><div id="2024-09-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.74.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div><div id="2024-09-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.74.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new">Recorder CRD (custom resource) is added for deploying the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> to Kubernetes.</li> <li data-change="new">Default <a href="/kb/1445/kubernetes-operator-customization"><code>ProxyClass</code></a> can now be specified for the Kubernetes Operator proxies. If you are using Helm, the default <code>ProxyClass</code> can be configured in the <code>proxyConfig.defaultProxyClass</code> Helm value or set using <code>PROXY_DEFAULT_CLASS</code> environment variable.</li> <li data-change="fixed">Wildcards in <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">RBAC</a> role definitions are replaced with exact verbs.</li> </ul> </div></div></div><div id="2024-09-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.74.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <p><strong>Note:</strong> This version contains no changes except for library updates.</p> </div></div></div></div></div></article><article id="2024-09-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-09-13">Sep 13, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-09-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Terraform Provider v0.17.0</h3></header><div><div class="t-b18 changelog-entry"><p>v0.17.0 of the <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest">Tailscale Terraform Provider</a> has been released with the following changes:</p> <h5>Resources</h5> <ul> <li data-change="new">Manage <a href="/kb/1213/webhooks">webhooks</a> with <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/webhook"><code>tailscale_webhook</code></a>.</li> <li data-change="new">Manage <a href="/kb/1224/contact-preferences">contact preferences</a> with <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/contacts"><code>tailscale_contacts</code></a>.</li> <li data-change="new">Manage <a href="/kb/1288/device-posture">device posture integrations</a> with <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/posture_integration"><code>tailscale_posture_integration</code></a>.</li> <li data-change="new">Manage <a href="/kb/1255/log-streaming">log streaming</a> with <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/logstream_configuration"><code>tailscale_logstream_configuration</code></a>.</li> <li data-change="new">Manage <a href="/api#tag/tailnetsettings/GET/tailnet/%7Btailnet%7D/settings">Tailnet settings</a> with <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/tailnet_settings"><code>tailscale_tailnet_settings</code></a>.</li> <li data-change="fixed">Changing the domain attribute for <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/dns_split_nameservers"><code>tailcale_dns_split_nameservers</code></a> now properly removes the previous domain value.</li> </ul> <h5>Data Sources</h5> <ul> <li data-change="new">Fetch information for multiple users with <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/data-sources/users"><code>tailcale_users</code></a>.</li> <li data-change="new">Fetch information for a specific user with <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/data-sources/user"><code>tailscale_user</code></a>.</li> </ul> </div></div></div></div></div></article><article id="2024-09-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-09-12">Sep 12, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-09-12-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.74.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1315/mdm-keys#set-an-auth-key"><code>AuthKey</code></a> system policy can be used to authenticate a device with Tailscale using an <a href="/kb/1362/mdm">MDM solution</a>.</li> <li data-change="new"><a href="/kb/1080/cli#dns"><code>tailscale dns</code></a> CLI command is added for accessing <a href="/kb/1054/dns">Tailscale DNS</a> settings and status.</li> <li data-change="changed">Go is updated to version 1.23.1.</li> <li data-change="fixed"><a href="kb/1226/tailnet-lock">Tailnet Lock</a> long rotation signatures are truncated automatically to avoid excessive growth.</li> <li data-change="fixed"><strong>Log In</strong> option in the client works as expected.</li> </ul> <h6>Linux</h6> <ul> <li data-change="new"><a href="https://docs.kernel.org/networking/segmentation-offloads.html#generic-receive-offload">TCP generic receive offload</a> (GRO) support is added for improved userspace mode throughput.</li> <li data-change="changed"><a href="https://docs.kernel.org/networking/segmentation-offloads.html#tcp-segmentation-offload">TCP generic segmentation offload</a> (GSO) is re-introduced for supporting improved userspace mode throughput. This was initially introduced in Tailscale v1.72.0 and then rolled back in v1.72.1.</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">The client no longer connects to a tailnet automatically when restarting or switching profiles.</li> <li data-change="fixed">Profiles created as Local System with Unattended Mode enabled are retained after a reboot.</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">The <a href="https://github.com/tailscale/tailscale/wiki/Tailscaled-on-macOS">open-source variant</a> of the Tailscale client can now read the system <a href="/kb/1054/dns">DNS configuration</a> to provide DNS resolution when <a href="/kb/1080/cli#set"><code>tailscale set -—accept-dns</code></a> or <a href="/kb/1241/tailscale-up"><code>tailscale up -—accept-dns</code></a> is enabled and the <strong>Override local DNS</strong> option in the <a href="https://login.tailscale.com/admin/dns"><strong>DNS</strong></a> page of the admin console is disabled.</li> <li data-change="fixed">DNS resolution continues to work after a key expires.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="new">The <a href="/kb/1280/appletv#test-device-latency">ping</a> feature allows you to observe connectivity performance between your Apple TV and other devices in your tailnet.</li> </ul> <h6>Android</h6> <p><strong>Note:</strong> The Android client release for v1.74.0 was delayed and moved into the v1.74.1 client release instead.</p> <ul> <li data-change="fixed"><a href="/kb/1054/dns">Tailscale DNS</a> works as expected when switching between Wi-Fi and cellular networks.</li> <li data-change="fixed"><a href="/kb/1315/mdm-keys">System policies</a> for the Android client on ChromeOS work as expected.</li> </ul> </div></div></div></div></div></article><article id="2024-09-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-09-11">Sep 11, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-09-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">MAC addresses matching in CrowdStrike Falcon</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1288/device-posture">Device posture</a> integration with <a href="/kb/1289/crowdstrike-zta">CrowdStrike Falcon</a> can now use MAC addresses to match devices that lack serial numbers. When Falcon integration is configured, <a href="/kb/1326/device-identity-collection">Device Identity Collection</a> will automatically collect MAC addresses.</li> </ul> </div></div></div></div></div></article><article id="2024-08-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-26">Aug 26, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-26-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.72.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>Tailscale v1.72.2 addresses issues for macOS, iOS, and tvOS, and is exclusively released for those platforms.</p> <h6>macOS</h6> <ul> <li data-change="fixed">An issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed.</li> <li data-change="fixed">An issue that could prevent Tailscale from automatically launching at login on some Macs is fixed.</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">An issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed">An issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed.</li> </ul> </div></div></div></div></div></article><article id="2024-08-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-23">Aug 23, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Configurable session timeouts</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Admin console <a href="/kb/1461/admin-console-session-timeout">session timeouts from inactivity</a> are now configurable from the <a href="https://login.tailscale.com/admin/settings/user-management">User Management Settings</a> page of the admin console.</li> </ul> </div></div></div></div></div></article><article id="2024-08-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-22">Aug 22, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-22-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.72.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>Tailscale v1.72.1 addresses a Linux-specific issue, and is exclusively released for the Linux platform and containers.</p> <h6>Linux</h6> <ul> <li data-change="changed">TCP generic segmentation offload (GSO) support for userspace mode is removed.</li> <li data-change="fixed">DNS over TCP failures when querying the Tailscale-internal resolver are fixed.</li> </ul> </div></div></div><div id="2024-08-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.72.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="fixed">DNS over TCP failures when querying the Tailscale-internal resolver are fixed.</li> </ul> </div></div></div><div id="2024-08-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.72.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="fixed">DNS over TCP failures when querying the Tailscale-internal resolver are fixed.</li> </ul> </div></div></div><div id="2024-08-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.72.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="fixed">DNS over TCP failures when querying the Tailscale-internal resolver are fixed.</li> </ul> </div></div></div></div></div></article><article id="2024-08-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-21">Aug 21, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.72.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="new">An HTTP health check endpoint at <code>/healthz</code> can be enabled by setting <code>TS_HEALTHCHECK_ADDR_PORT</code> to <code>[addr]:port</code>.</li> </ul> </div></div></div><div id="2024-08-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.72.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new">Additional environment variables can now be passed for the Kubernetes Operator deployment via <a href="/kb/1236/kubernetes-operator#helm">Helm chart</a> options.</li> <li data-change="fixed"><code>DNSConfig CRD</code> reconcile logic is fixed for dual-stack clusters.</li> </ul> </div></div></div><div id="2024-08-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.72.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="fixed">Running without HTTPS is now allowed when UI is disabled.</li> </ul> </div></div></div></div></div></article><article id="2024-08-19" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-19">Aug 19, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-19-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.72.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1457/captive-portals">Captive portal detection</a> is now supported.</li> <li data-change="new">The <a href="/kb/1080/cli/#cert"><code>tailscale cert</code></a> command now contains the <code>--min-validity</code> flag. Use this flag to request a specified minimum remaining validity on the returned certificate. This flag is intended for automation, like cron jobs, that periodically refreshes certificates.</li> <li data-change="new">The <a href="/kb/1243/tailscale-lock"><code>tailscale lock</code></a> command now supports passing keys as files. To pass a key as a file, use the prefix <code>file:</code> followed by the path to the file: <code>file:<path-to-key-file></code>.</li> <li data-change="changed">A health warning is now raised if Tailscale is unable to forward DNS queries to the configured resolvers.</li> <li data-change="changed">An increase in send and receive buffer sizes for userspace mode TCP improves throughput over high latency paths.</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">The addition of TCP generic segmentation offload (GSO) support to userspace mode improves throughput.</li> </ul> <h6>macOS</h6> <p><em>Note</em>: macOS 10.15 Catalina is no longer supported. See the <a href="/changelog#2024-02-15">v1.60.0 changelog</a> for our initial end of life announcement.</p> <ul> <li data-change="new">Notifications are sent when a captive portal is detected.</li> <li data-change="fixed">Health warnings in the UI are now sorted by their severity level.</li> <li data-change="fixed">Reliability of the authentication process when launching the web browser is improved.</li> <li data-change="fixed">The VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling <a href="/kb/1291/ios-vpn-on-demand">VPN On Demand</a> first.</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Notifications are sent when a captive portal is detected.</li> <li data-change="new">Health warnings are displayed when connectivity is impacted.</li> <li data-change="fixed">An error message is displayed while attempting to start the VPN when both Wi-Fi and cellular interfaces are down, instead of failing silently.</li> <li data-change="fixed">The VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling <a href="/kb/1291/ios-vpn-on-demand">VPN On Demand</a> first.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="new">Notifications are sent when a captive portal is detected.</li> <li data-change="fixed">The VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling <a href="/kb/1291/ios-vpn-on-demand">VPN On Demand</a> first.</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Health warnings, if any are present, are displayed in the main view of the app.</li> </ul> </div></div></div></div></div></article><article id="2024-08-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-15">Aug 15, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Via in Access Control Previews</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1393/access-control">Access control policies</a> using <a href="/kb/1378/via"><code>via</code></a> are included in the <strong>Preview rules</strong> tab of the <a href="https://login.tailscale.com/admin/acls/preview"><strong>Access Controls</strong></a> page of the admin console.</li> </ul> </div></div></div></div></div></article><article id="2024-08-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-13">Aug 13, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Microsoft Entra ID SCIM GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/entra-id"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1249/sso-entra-id-scim">User & group provisioning for Microsoft Entra ID</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Sync Microsoft Entra ID groups and users to use in your <a href="/kb/1337/acl-syntax/#provisioned-groups">Tailscale ACLs</a>.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-08-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-08">Aug 8, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Autogroups allowed as SSH source in ACLs</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">SSH <code>src</code> in <a href="/kb/1018/acls">ACL</a> rules supports all role-based <a href="/kb/1337/acl-syntax#autogroups">autogroups</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-08-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-08-02">Aug 2, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-08-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">New device posture integrations</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1407/kolide">1Password XAM</a> is available as a device posture integration (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new"> <a href="/kb/1409/jamf-pro">Jamf Pro</a> is available as a device posture integration (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new"><a href="/kb/1405/kandji">Kandji</a> is available as a device posture integration (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new"><a href="/kb/1410/intune">Microsoft Intune</a> is available as a device posture integration (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new"><a href="/kb/1390/sentinelone">SentinelOne</a> is available as a device posture integration (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2024-07-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-25">Jul 25, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Control D integration</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1403/control-d">Control D DNS</a> is available as a global nameserver in your tailnet.</li> </ul> </div></div></div></div></div></article><article id="2024-07-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-22">Jul 22, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">New API endpoints</h3></header><div><div class="t-b18 changelog-entry"><p>We have added the following endpoints to Tailscale's public API:</p> <h5>Device endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/devices/POST/device/%7BdeviceId%7D/name">Set device name</a></li> </ul> <h5>Webhook management endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/webhooks/GET/webhooks/%7BendpointId%7D">Get a webhook</a></li> </ul> <h5>Tailnet settings endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/tailnetsettings/GET/tailnet/%7Btailnet%7D/settings">Get tailnet settings</a>.</li> <li data-change="new"><a href="/api#tag/tailnetsettings/PATCH/tailnet/%7Btailnet%7D/settings">Update tailnet settings</a>.</li> </ul> </div></div></div><div id="2024-07-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.70.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="new">Egress proxies specified by an <a href="https://en.wikipedia.org/wiki/Fully_qualified_domain_name">FQDN</a> now work also for IPv6-only network stacks.</li> </ul> </div></div></div><div id="2024-07-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.70.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see our <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new">Egress proxies specified by an <a href="https://en.wikipedia.org/wiki/Fully_qualified_domain_name">FQDN</a> now work also for IPv6-only network stacks.</li> <li data-change="new">Tailscale <code>Service</code> status now includes a custom Tailscale proxy status condition.</li> <li data-change="new">Optionally record <code>kubectl exec</code> sessions.</li> <li data-change="fixed">Cluster resources for failed egress proxies are now correctly cleaned up when the parent <code>Service</code> is deleted.</li> </ul> </div></div></div><div id="2024-07-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.70.0</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="fixed"><code>tsrecorder</code> now plays session recordings for interactive sessions initiated by a command that explicitly specifies shell.</li> </ul> </div></div></div></div></div></article><article id="2024-07-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-17">Jul 17, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-17-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.70.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new">Restrict <a href="/kb/1392/auto-exit-nodes">recommended</a> and automatically selected exit nodes using the new <code>AllowedSuggestedExitNodes</code> <a href="/kb/1315/mdm-keys">system policy</a>. Applies only to platforms that support <a href="/kb/1315/mdm-keys">system policies</a>.</li> <li data-change="changed">Improved <a href="/blog/how-nat-traversal-works">NAT traversal</a> for some uncommon scenarios.</li> <li data-change="changed">Optimized <a href="/kb/1018/acls">sending firewall rules to clients</a> more efficiently.</li> <li data-change="fixed"><a href="/kb/1392/auto-exit-nodes">Exit node suggestion</a> CLI command now prints the hostname (which you can use with the <a href="/kb/1080/cli#set"><code>tailscale set</code></a> command).</li> <li data-change="fixed"><a href="/kb/1369/taildrive">Taildrive</a> share paths configured through the CLI resolve relative to where you run the <code>tailscale</code> command.</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Switching from unstable to stable tracks using the <a href="/kb/1080/cli#update"><code>tailscale update</code></a> command now works correctly.</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">Use the value <code>auto:any</code> to automatically select an <a href="/kb/1103/exit-nodes">exit node</a> for the existing <code>ExitNodeID</code> <a href="/kb/1315/mdm-keys">system policy</a>. Available for <a href="/pricing">Enterprise plan</a> users only.</li> <li data-change="new">The new <code>AllowedSuggestedExitNodes</code> <a href="/kb/1315/mdm-keys">system policy</a> restricts which exit nodes Tailscale <a href="/kb/1392/auto-exit-nodes">recommends</a> or automatically selects.</li> <li data-change="fixed">DNS leak issue.</li> <li data-change="fixed">Switching from unstable to stable tracks using the <a href="/kb/1080/cli#update"><code>tailscale update</code></a> command now works correctly.</li> <li data-change="fixed"><a href="/kb/1369/taildrive">Taildrive</a> server no longer starts unnecessarily when no drives are configured.</li> </ul> <h6>macOS</h6> <p><strong>Note</strong>: As previously announced, Tailscale v1.70 is the last version to support macOS 10.15 Catalina. macOS 10.15 is no longer supported by Apple and no longer receives security updates. Users still running macOS 10.15 should update to a newer version of macOS to continue receiving security updates and new features.</p> <ul> <li data-change="new">Toggle Tailscale DNS from Siri or the Shortcuts app.</li> <li data-change="new">Receive health notifications in the client menu on macOS to inform you about lack of internet connectivity, firewalls blocking Tailscale, misconfiguration issues, and other issues. Health issues that affect <a href="/kb/1411/device-connectivity">connectivity</a> also change the Tailscale icon in the system menubar to show an exclamation mark.</li> <li data-change="new">On MacBooks with a notch in the display, a notification window will now appear if the Tailscale icon is hidden behind the notch due to too many menubar items.</li> <li data-change="new">The Tailscale client now warns you when the built-in macOS <a href="/kb/1420/macos-webfilterproxyd">content filter (Screen Time)</a> prevents Tailscale from connecting.</li> <li data-change="new">Use the value <code>auto:any</code> to automatically select an exit node for the existing <code>ExitNodeID</code> <a href="/kb/1315/mdm-keys">system policy</a>. Available for <a href="/pricing">Enterprise plan</a> users only.</li> <li data-change="changed">The exit node picker no longer presents exit node suggestions if the organization enforces always using the suggested exit node using the <code>ExitNodeID</code> <a href="/kb/1315/mdm-keys">system policy</a>.</li> <li data-change="fixed">Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.</li> <li data-change="fixed"><a href="/kb/1369/taildrive">Taildrive</a> server no longer starts unnecessarily when no drives are configured.</li> <li data-change="fixed">Increased the reliability of the <strong>Install Updates Automatically</strong> setting.</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Toggle Tailscale DNS from Siri or the Shortcuts app.</li> <li data-change="new">Use the value <code>auto:any</code> to automatically select an exit node for the existing <code>ExitNodeID</code> <a href="/kb/1315/mdm-keys">system policy</a>. Available for <a href="/pricing">Enterprise plan</a> users only.</li> <li data-change="fixed"><a href="https://github.com/WireGuard/wireguard-go/pull/106"><code>wireguard-go</code></a> memory pool deadlock issue is resolved.</li> <li data-change="fixed">Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.</li> <li data-change="fixed">User interface no longer flickers when selecting an exit node.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="new">Use the value <code>auto:any</code> to automatically select an exit node for the existing <code>ExitNodeID</code> <a href="/kb/1315/mdm-keys">system policy</a>. Available for <a href="/pricing">Enterprise plan</a> users only.</li> <li data-change="fixed"><a href="https://github.com/WireGuard/wireguard-go/pull/106"><code>wireguard-go</code></a> memory pool deadlock issue is resolved.</li> <li data-change="fixed">User interface no longer flickers when selecting an exit node.</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Access ping information and connection status by long-pressing on a device in the devices list and selecting <strong>Ping</strong>.</li> <li data-change="new">Use <a href="/kb/1444/android-app-split-tunneling">split tunneling</a> to force or exclude app traffic through your tailnet.</li> <li data-change="fixed"><a href="https://github.com/WireGuard/wireguard-go/pull/106"><code>wireguard-go</code></a> memory pool deadlock issue is resolved.</li> </ul> </div></div></div></div></div></article><article id="2024-07-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-15">Jul 15, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Indent has shut down</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://indent.com">Indent</a> shut down their service effective July 15, 2024. If you were using Indent with your Tailscale network, migrate to another on-demand access system or Tailscale's <a href="/kb/1383/tailscale-slack-accessbot">just-in-time accessbot (alpha)</a>, or otherwise turn off your Indent integration with Tailscale.</li> </ul> </div></div></div></div></div></article><article id="2024-07-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-11">Jul 11, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Plan enrollment changes for new tailnets</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The process for creating a new tailnet now asks you if the tailnet will be primarily used <strong>At work</strong> or <strong>At home</strong>. This determines whether to enroll the tailnet into a 14-day trial or the <a href="/pricing">Personal plan</a>. For more details, see the <a href="/kb/1017/install#create-a-tailnet">Tailscale quickstart</a> topic.</li> <li data-change="changed">Newly created tailnets using custom domains are no longer automatically enrolled in a trial. Instead, the <strong>At work</strong> or <strong>At home</strong> selection determines trial enrollment.</li> </ul> </div></div></div></div></div></article><article id="2024-07-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-10">Jul 10, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">New API endpoints, OpenAPI spec, and interactive API docs</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Access an <a href="https://api.tailscale.com/api/v2">OpenAPI spec for the Tailscale API</a>. The spec is used to generate our new interactive documentation. Note that the spec definition may change without notice, so should not be relied upon for stability.</li> <li data-change="new">Access <a href="/api">interactive documentation</a> for the Tailscale API.</li> </ul> <h4>New API endpoints</h4> <p>We have added the following endpoints to Tailscale's public API:</p> <h5>Logging endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream/status">Get log streaming status</a>.</li> <li data-change="new"><a href="/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream">Get log streaming configuration</a>.</li> <li data-change="new"><a href="/api#tag/logging/PUT/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream">Set log streaming configuration</a>.</li> <li data-change="new"><a href="/api#tag/logging/DELETE/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream">Disable log streaming</a>.</li> <li data-change="changed">Created a new endpoint for <a href="/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/configuration">listing configuration audit logs</a>. An earlier version of this endpoint is still supported for backwards compatibility.</li> <li data-change="changed">Created a new endpoint for <a href="/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/network">listing network flow logs</a>. An earlier version of this endpoint is still supported for backwards compatibility.</li> </ul> <h5>Webhook management endpoints</h5> <ul> <li data-change="new"><a href="https://tailscale.com/api#tag/webhooks/GET/tailnet/%7Btailnet%7D/webhooks">List all webhooks for a tailnet</a>.</li> <li data-change="new"><a href="https://tailscale.com/api#tag/webhooks/POST/tailnet/%7Btailnet%7D/webhooks">Create a new webhook</a>.</li> <li data-change="new"><a href="https://tailscale.com/api#tag/webhooks/PATCH/webhooks/%7BendpointId%7D">Update a webhook</a>.</li> <li data-change="new"><a href="https://tailscale.com/api#tag/webhooks/DELETE/webhooks/%7BendpointId%7D">Delete a webhook</a>.</li> <li data-change="new"><a href="https://tailscale.com/api#tag/webhooks/POST/webhooks/%7BendpointId%7D/test">Test a webhook</a>.</li> <li data-change="new"><a href="https://tailscale.com/api#tag/webhooks/POST/webhooks/%7BendpointId%7D/rotate">Rotate a webhook secret</a>.</li> </ul> <h5>Device posture endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/deviceposture/GET/tailnet/%7Btailnet%7D/posture/integrations">List all posture integrations</a>.</li> <li data-change="new"><a href="/api#tag/deviceposture/POST/tailnet/%7Btailnet%7D/posture/integrations">Create a posture integration</a>.</li> <li data-change="new"><a href="/api#tag/deviceposture/PATCH/posture/integrations/%7Bid%7D">Update a posture integration</a>.</li> <li data-change="new"><a href="/api#tag/deviceposture/DELETE/posture/integrations/%7Bid%7D">Delete a posture integration</a>.</li> </ul> <h5>User management endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/users/GET/tailnet/%7Btailnet%7D/users">List all users in the tailnet</a>.</li> <li data-change="new"><a href="/api#tag/users/GET/users/%7BuserId%7D">Get details about a specific user</a>.</li> <li data-change="new"><a href="/api#tag/users/POST/users/%7BuserId%7D/role">Update the role for a specific user</a>.</li> <li data-change="new"><a href="/api#tag/users/POST/users/%7BuserId%7D/approve">Approve a pending user's access to the tailnet</a>. This is only applicable to tailnets that have enabled <a href="/kb/1239/user-approval">user approval</a>.</li> <li data-change="new"><a href="/api#tag/users/POST/users/%7BuserId%7D/suspend">Suspend a user</a>. Available for the <a href="/pricing">Personal and Enterprise plans</a>.</li> <li data-change="new"><a href="/api#tag/users/POST/users/%7BuserId%7D/restore">Restore a suspended user</a>. Available for the <a href="/pricing">Personal and Enterprise plans</a>.</li> <li data-change="new"><a href="/api#tag/users/POST/users/%7BuserId%7D/delete">Delete a user</a>. Available for the <a href="/pricing">Personal and Enterprise plans</a>.</li> </ul> <h5>User invite endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/userinvites/GET/tailnet/%7Btailnet%7D/user-invites">List all open (not yet accepted) user invites to the tailnet</a>.</li> <li data-change="new"><a href="/api#tag/userinvites/POST/tailnet/%7Btailnet%7D/user-invites">Create user invite links and send user invite emails</a>.</li> <li data-change="new"><a href="/api#tag/userinvites/GET/user-invites/%7BuserInviteId%7D">Get details for a specific user invite</a>.</li> <li data-change="new"><a href="/api#tag/userinvites/DELETE/user-invites/%7BuserInviteId%7D">Delete an open (not yet accepted) user invite</a>.</li> <li data-change="new"><a href="/api#tag/userinvites/POST/user-invites/%7BuserInviteId%7D/resend">Resend an open (not yet accepted) user invite that was originally sent via email</a>.</li> </ul> <h5>Device invite endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/deviceinvites/GET/device/%7BdeviceId%7D/device-invites">List all open (not yet accepted) device invites</a>.</li> <li data-change="new"><a href="/api#tag/deviceinvites/POST/device/%7BdeviceId%7D/device-invites">Create device invite links and send device invite emails</a>.</li> <li data-change="new"><a href="/api#tag/deviceinvites/GET/device-invites/%7BdeviceInviteId%7D">Get details for a specific device invite</a>.</li> <li data-change="new"><a href="/api#tag/deviceinvites/DELETE/device-invites/%7BdeviceInviteId%7D">Delete an open (not yet accepted) device invite</a>.</li> <li data-change="new"><a href="/api#tag/deviceinvites/POST/device-invites/%7BdeviceInviteId%7D/resend">Resend an open (not yet accepted) device invite</a>.</li> <li data-change="new"><a href="/api#tag/deviceinvites/POST/device-invites/-/accept">Accept a device invite to your tailnet</a>.</li> </ul> <h5>Contact preferences endpoints</h5> <ul> <li data-change="new"><a href="/api#tag/contacts/GET/tailnet/%7Btailnet%7D/contacts">List the tailnet's current contact preferences</a>.</li> <li data-change="new"><a href="/api#tag/contacts/PATCH/tailnet/%7Btailnet%7D/contacts/%7BcontactType%7D">Update a tailnet contact</a>.</li> <li data-change="new"><a href="/api#tag/contacts/POST/tailnet/%7Btailnet%7D/contacts/%7BcontactType%7D/resend-verification-email">Resend the verification email for a tailnet contact</a>.</li> </ul> </div></div></div><div id="2024-07-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Automatically cleanup invites</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1064/invite-team-members">Invite team member</a> invites are now automatically deleted 90 days after the last welcome email was sent.</li> </ul> </div></div></div></div></div></article><article id="2024-07-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-08">Jul 8, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">IP sets GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/via"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">IP sets GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1387/ipsets">IP sets</a> to target and manage cross-sections of your tailnet independently of other groupings like subnets, tags, and groups.</li> </ul> </li> </ul> </div></div></div><div id="2024-07-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Via in grants</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/via"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1378/via">Via</a> to add routing awareness to <a href="/kb/1324/acl-grants">grants</a> (<a href="/kb/1167/release-stages#beta">beta</a>). <ul> <li>Define the exit nodes, subnet routers, or app connectors a source can access when they use a specific destination.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-07-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-07-02">Jul 2, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-07-02-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.68.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed"><a href="/kb/1226/tailnet-lock">Tailnet lock</a> validation of rotation signatures now permits multiple nodes signed by the same pre-signed reusable auth key.</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">Wake from sleep reliability is improved for re-connections and transitions between networks.</li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">Wake from sleep reliability is improved for re-connections and transitions between networks.</li> </ul> </div></div></div></div></div></article><article id="2024-06-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-06-25">Jun 25, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-06-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Sync Google Workspace groups to use in your Tailscale ACLs</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1317/sso-google-sync">User & group provisioning for Google Workspace</a> (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2024-06-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-06-21">Jun 21, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-06-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Indent shutting down July 15, 2024</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://indent.com">Indent</a> has announced they are shutting down 12:00 PM PST July 15, 2024. If you are using Indent with your Tailscale network, migrate to another on-demand access system or Tailscale's <a href="/kb/1383/tailscale-slack-accessbot">just-in-time accessbot (alpha)</a>, or otherwise turn off your <a href="/kb/1205/ondemand-indent">Indent integration</a> by that time.</li> </ul> </div></div></div></div></div></article><article id="2024-06-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-06-20">Jun 20, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-06-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Docker image v1.68.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1282/docker">Tailscale Docker image</a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> or from our <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub packages repo</a>.</p> <ul> <li data-change="new"><a href="/blog/quic-udp-throughput">UDP GRO</a> forwarding can be turned on for containers configured as Tailscale subnet routers or exit nodes, using the new environment variable <code>TS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS</code>. To learn more, see <a href="/kb/1320/performance-best-practices">Performance best practices</a>.</li> <li data-change="new">Containers that run on Kubernetes and store the <a href="/kb/1278/tailscaled"><code>tailscaled</code></a> state in a Kubernetes <code>Secret</code> can now be enforced to read the Kubernetes API server address and port from the environment variables <code>KUBERNETES_SERVICE_HOST</code> and <code>KUBERNETES_SERVICE_PORT_HTTPS</code>. By default, the values are read from the Kubernetes <code>Service</code> in the default namespace. To enforce the environment variables, set <code>TS_KUBERNETES_READ_API_SERVER_ADDRESS_FROM_ENV</code> to <code>true</code>.</li> </ul> </div></div></div><div id="2024-06-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Kubernetes operator v1.68.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> is available. For guidance on installing and updating, see our <a href="/kb/1236/kubernetes-operator#installation">installation instructions</a>.</p> <ul> <li data-change="new">Tailscale Kubernetes operator proxies can now be configured to accept routes advertised by tailnet peers using the new <code>proxyClass.spec.tailscale.acceptRoutes</code> field. To learn more, see our <a href="https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass">ProxyClass documentation</a>.</li> <li data-change="new">Images and image pull policies can be configured for individual Tailscale Kubernetes operator proxies using ProxyClass.</li> <li data-change="new">Connector Custom Resources status now includes the proxy's tailnet IP addresses and MagicDNS name.</li> <li data-change="fixed">Helm values file now allows configuring image repositories using a repository key, which is a standard and expected by some tools.</li> </ul> </div></div></div><div id="2024-06-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale tsrecorder v1.68.1</h3></header><div><div class="t-b18 changelog-entry"><p>A new release of the <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale <code>tsrecorder</code></a> is available. You can download it from <a href="https://hub.docker.com/r/tailscale/tsrecorder/tags">Docker Hub</a>.</p> <ul> <li data-change="new"><code>--state</code> flag or the <code>TS_STATE</code> environment variable can be used to specify a Kubernetes <code>Secret</code> as <a href="/kb/1278/tailscaled"><code>tailscaled</code></a> state store when <a href="/kb/1263/session-recording-s3#deploy-the-recorder-node">deploying the <code>tsrecorder</code> container</a>.</li> <li data-change="new"><code>--dst</code> flag for destination can be set as the environment variable <code>TSRECORDER_DST</code> when deploying the <code>tsrecorder</code> container.</li> <li data-change="new"><code>--bucket</code> flag for the S3 bucket name can be set as the environment variable <code>TSRECORDER_BUCKET</code> when deploying the <code>tsrecorder</code> container.</li> <li data-change="new"><code>--hostname</code> flag for the hostname can be set as the environment variable <code>TSRECORDER_HOSTNAME</code> when deploying the <code>tsrecorder</code> container.</li> <li data-change="new"><code>--ui</code> flag for the user interface can be set as the environment variable <code>TSRECORDER_UI</code> when deploying the <code>tsrecorder</code> container.</li> <li data-change="new">AWS ambient credentials can be used to access the S3 backend.</li> </ul> </div></div></div></div></div></article><article id="2024-06-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-06-14">Jun 14, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-06-14-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.68.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed"><a href="/kb/1201/4via6-subnets">4via6 subnet router</a> advertisement works as expected.</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> access to Security-Enhanced Linux (SELinux) machines works as expected.</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">Android TV navigation is improved.</li> </ul> </div></div></div></div></div></article><article id="2024-06-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-06-12">Jun 12, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-06-12-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.68.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new"><a href="/kb/1067/update#auto-updates">Auto-updates</a> are available for containers. The tailnet-wide default is ignored in containers.</li> <li data-change="new">When enabled, auto-updates get applied even if the node is down or disconnected from the <a href="/kb/1155/terminology-and-concepts#coordination-server">coordination server</a>.</li> <li data-change="changed"><a href="/kb/1243/tailscale-lock#lock-status"><code>tailscale lock status</code></a> now prints the node's signature.</li> <li data-change="changed">Go is updated to version 1.22.4.</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed"><a href="/kb/1022/install-windows"><code>.exe</code> installer</a> no longer downloads MSI packages for Windows 7 and Windows 8, automatically. See the <a href="/changelog#2023-05-24">v1.42.0 changelog</a> for our initial end of life announcement.</li> </ul> <h6>macOS</h6> <ul> <li data-change="new"><a href="/kb/1016/install-mac">Standalone</a> variant of the client can now install a launcher for the <a href="/kb/1080/cli">Tailscale CLI</a> in <code>/usr/local/bin</code> by going to <strong>Settings</strong>, <strong>CLI integration</strong>, then <strong>Show me how</strong>.</li> <li data-change="new">Standalone variant of the client now supports notifications when a file is received using <a href="/kb/1106/taildrop">Taildrop</a>.</li> <li data-change="new">Pop-up notification displays when a network might be vulnerable to a potential TunnelVision attack. For more information, see <a href="/kb/1412/tunnel-vision">TunnelVision vulnerability and Tailscale</a>.</li> <li data-change="changed">Client starts up more reliably if another VPN app is running when Tailscale is enabled.</li> <li data-change="changed"><a href="https://pkgs.tailscale.com/stable/#macos"><code>.pkg</code> installer</a> terminates pre-existing copies of Tailscale and the VPN extension before proceeding with installation if Tailscale was already installed.</li> <li data-change="fixed">TunnelBear installation is properly detected, and warns the user about incompatibility.</li> <li data-change="fixed"><code>Using Exit Node</code> label no longer appears incorrectly in the app menu before completing onboarding, upon the first time app launch.</li> <li data-change="fixed">Fixed a bug with split DNS domains being used as search domains after a network change.</li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">Battery life is optimized by offloading DNS resolution to iOS in more cases.</li> <li data-change="changed">Client now starts more reliably if another VPN app is running when Tailscale is enabled.</li> <li data-change="fixed">Bug report view no longer copies the bug report ID to the clipboard automatically.</li> <li data-change="fixed"><strong>Reauthenticate</strong> button for in-app key expiry notifications works as expected.</li> <li data-change="fixed">Dark mode contains minor changes to UI colors.</li> <li data-change="fixed">Fixed a bug with split DNS domains being used as search domains after a network change.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="changed">Client now starts more reliably if another VPN app is running when Tailscale is enabled.</li> <li data-change="fixed"><strong>Reauthenticate</strong> button for in-app key expiry notifications works as expected.</li> </ul> <h6>Android</h6> <ul> <li data-change="changed">On-off toggle state better matches the actual client state.</li> <li data-change="changed">Status notifications when Tailscale is disconnected are now background notifications, and tapping on notifications launches the Tailscale app.</li> <li data-change="changed">Client starts automatically after the first login.</li> <li data-change="changed"><a href="/kb/1315/mdm-keys">System policy</a> (MDM) support is added for mandatory exit nodes.</li> <li data-change="fixed">Organization name is now rendered properly when set in the <a href="/kb/1315/mdm-keys#set-your-organization-name"><code>ManagedByOrganizationName</code></a> system policy.</li> <li data-change="fixed">Crashing no longer occurs when launching Tailscale and another VPN application was already running.</li> <li data-change="fixed"><a href="/kb/1103/exit-nodes#advertise-a-device-as-an-exit-node">Running an exit node</a> no longer lets you <a href="/kb/1103/exit-nodes#use-the-exit-node">use another device as an exit node</a> and vice versa.</li> <li data-change="fixed">Home screen shows the selected exit node country and city when using <a href="/kb/1258/mullvad-exit-nodes">Mullvad exit nodes</a>.</li> </ul> <p><br /><br /></p> <p><strong>Note</strong>: The Tailscale client releases for containers such as the <a href="/kb/1236/kubernetes-operator">Kubernetes operator</a>, <a href="/kb/1282/docker">Docker</a> image, and <a href="/kb/1246/tailscale-ssh-session-recording">tsrecorder</a> are typically released a few days after the initial client release. A separate changelog will be published when client updates for containers are available.</p> </div></div></div></div></div></article><article id="2024-05-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-30">May 30, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Auto exit nodes</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="blog/auto-exit-nodes"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">You can now automatically select a <a href="/kb/1392/auto-exit-nodes">recommended exit node</a> based on client information (such as location).</li> </ul> </div></div></div></div></div></article><article id="2024-05-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-24">May 24, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-24-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Exit node destination logging</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/egress-logging"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1103/exit-nodes">Exit node</a> destination logging can now be configured from the <a href="https://login.tailscale.com/admin/logs/network"><strong>Network flow logs</strong></a> tab in the <strong>Logs</strong> page of the admin console.</li> </ul> </div></div></div></div></div></article><article id="2024-05-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-20">May 20, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-20-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.66.4</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Restored UDP connectivity through <a href="/kb/1258/mullvad-exit-nodes">Mullvad exit nodes</a>.</li> </ul> <h6>Linux</h6> <ul> <li data-change="changed">Stateful filtering is now off by default. Stateful filtering was introduced in 1.66.0 as a mitigation for a vulnerability described in <a href="/security-bulletins#ts-2024-005">TS-2024-005</a>, and inadvertently broke DNS resolution from containers running on the host. Most vulnerable setups are protected by other mitigations already, except when <code>autogroup:danger-all</code> is used in <a href="/kb/1018/acls">ACLs</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-05-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-15">May 15, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-15-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.66.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><em>Note</em>: Tailscale v1.66.2 was an internal-only release.</p> <h6>All platforms</h6> <ul> <li data-change="fixed">Login URLs did not always appear in the console when running <a href="/kb/1080/cli#up"><code>tailscale up</code></a>.</li> </ul> <h6>Android</h6> <ul> <li data-change="changed">Reintroduced the Quick Settings title that v1.66.0 temporarily removed.</li> <li data-change="changed">Improved the VPN service connection logic, especially when rebooting the device with Always-On VPN enabled.</li> <li data-change="changed">The persistent VPN status notification now informs the user with a muted icon when the VPN is disconnected. VPN status notifications can be disabled in the system notification settings.</li> <li data-change="fixed">The "Enable" button in the exit node selector banner now renders with the correct background color.</li> </ul> <h6>Kubernetes operator</h6> <ul> <li data-change="breaking change">Starting with v1.66, the Kubernetes operator must always run the same or later version as the proxies it manages.</li> <li data-change="new"><a href="/kb/1440/kubernetes-operator-cloud-services">Expose cloud services</a> on cluster network to the tailnet, using Kubernetes <code>ExternalName</code> Services. This allows exposing cloud services, such as RDS instances, to tailnet by their DNS names.</li> <li data-change="new">Expose tailnet services that use <a href="/kb/1153/enabling-https">Tailscale HTTPS</a> to cluster workloads. Refer to <a href="https://github.com/tailscale/tailscale/pull/11019">#11019</a>.</li> <li data-change="new">Cluster workloads can now refer to Tailscale Ingress resources by their MagicDNS names. Refer to <a href="https://github.com/tailscale/tailscale/pull/11019">#11019</a>.</li> <li data-change="new">Configure environment variables for Tailscale Kubernetes operator proxies using <code>ProxyClass</code> CRD. Refer to <a href="https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass"><code>ProxyClass</code> API</a>.</li> <li data-change="new">Expose <code>tailscaled</code> metrics endpoint for Tailscale Kubernetes operator proxies through <code>ProxyClass</code> CRD. Note that the <code>tailscaled</code> metrics are unstable and will likely change in the future. Refer to <a href="https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass"><code>ProxyClass</code> API</a>.</li> <li data-change="new">Configure labels for the Kubernetes operator Pods with Helm chart values. Refer to <a href="https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/chart/values.yaml">Helm chart values</a>.</li> <li data-change="new">Configure affinity rules for Kubernetes operator proxy Pods with <code>ProxyClass</code>. Refer to <a href="https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass"><code>ProxyClass</code> API</a>.</li> <li data-change="fixed">Kubernetes operator proxy <code>init</code> container no longer attempts to enable IPv6 forwarding on systems that don't have IPv6 module loaded. Refer to <a href="https://github.com/tailscale/tailscale/pull/11867">#11867</a>.</li> </ul> <h6>Containers</h6> <ul> <li data-change="fixed">Tailscale containers running on Kubernetes no longer error if an empty Kubernetes <code>Secret</code> is pre-created for the <code>tailscaled</code> state. Refer to <a href="https://github.com/tailscale/tailscale/pull/11326">#11326</a>.</li> <li data-change="fixed">Improved the ambiguous error messages when Tailscale running on Kubernetes does not have the right permissions to perform actions against the <code>tailscaled</code> state <code>Secret</code>. Refer to <a href="https://github.com/tailscale/tailscale/pull/11326">#11326</a>.</li> </ul> </div></div></div><div id="2024-05-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Dark mode in the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use the <strong>Light</strong>, <strong>Dark</strong>, or <strong>Use system setting</strong> theme in the admin console by clicking the avatar menu on the top-right and selecting <strong>Appearance</strong>. The default theme is <strong>Use system setting</strong>.</li> </ul> </div></div></div></div></div></article><article id="2024-05-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-10">May 10, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for Amazon Fire devices</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The Tailscale app for Android is now available in the <a href="https://www.amazon.com/dp/B0D38TRB3N">Amazon Appstore</a> for <a href="/kb/1394/install-amazon-fire">Amazon Fire TVs and tablets</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-05-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-09">May 9, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-09-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.66.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>This release is exclusively for Linux platforms and the <a href="/kb/1065/macos-variants">standalone variant</a> of the macOS client. It is not available for other platforms.</p> <h6>Linux</h6> <ul> <li data-change="new"><a href="/kb/1080/cli#set"><code>tailscale set</code></a> command flags <code>--netfilter-mode</code>, <code>--snat-subnet-routes</code>, and <code>--stateful-filtering</code> are added.</li> <li data-change="fixed">Issue with <a href="/kb/1294/firewall-mode"><code>nftables</code></a> rules for stateful filtering, introduced in v1.66.0.</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">A version mismatch warning no longer displays when upgrading, if no mismatch is detected.</li> </ul> </div></div></div></div></div></article><article id="2024-05-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-08">May 8, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL syntax updates</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">As part of a security fix to address an issue related to exit nodes and subnet routing (<a href="/security-bulletins/#ts-2024-005">TS-2024-005</a>), changes are made to <a href="/kb/1018/acls">ACLs</a>. <ul> <li>The meaning of <code>*</code> when used in the <a href="/kb/1337/acl-syntax#src"><code>src</code></a> field in ACLs has been changed. Previously, <code>*</code> expanded to include any IPv4 and IPv6 address. With this change, <code>*</code> expands to all <a href="/kb/1015/100.x-addresses">Tailscale IP addresses</a> and all IP addresses from approved <a href="/kb/1019/subnets">subnet routes</a>.</li> <li>The new <code>autogroup:danger-all</code> ACL type has been added, which matches the previous definition of <code>*</code> when used in the <code>src</code> field. If you are using default ACLs or have specified <code>*</code> in <code>src</code>, you don't need to make any ACL changes to get the new secure behavior.</li> <li>We recommend updating all Tailscale clients to v1.66 to benefit from the additional security improvements.</li> </ul> </li> </ul> </div></div></div><div id="2024-05-08-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.66.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>We recommend updating all Tailscale clients to v1.66.0 or later to benefit from additional security improvements.</p> <h6>All platforms</h6> <ul> <li data-change="new">Implemented client-side quarantining for shared-in exit nodes, as a mitigation for a security vulnerability described in <a href="/security-bulletins#ts-2024-005">TS-2024-005</a>.</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">Use the <code>--stateful-filtering</code> flag for the <a href="/kb/1241/tailscale-up"><code>tailscale up</code></a> to enable stateful filtering for <a href="/kb/1019/subnets">subnet routers</a> and <a href="/kb/1103/exit-nodes">exit nodes</a>, as a mitigation for a security vulnerability described in <a href="/security-bulletins#ts-2024-005">TS-2024-005</a>.</li> </ul> <p><strong>Note:</strong> This change can break existing setups that depend on forwarding connections from external hosts (internet, LAN, Docker containers, etc.) into the tailnet through a Tailscale node. If your setup depends on such forwarding, you can disable stateful filtering with the <code>tailscale up --stateful-filtering=false</code> command.</p> <ul> <li data-change="new">Use <a href="/kb/1080/cli#tab-completion">tab completion</a> to type the first few letters of a Tailscale CLI command, flag, or arguments, followed by the <code>tab</code> key to complete the item being typed. Set up tab completion by using the <a href="/kb/1080/cli#completion"><code>tailscale completion</code></a> command.</li> <li data-change="new">Use the <a href="/kb/1080/cli#exit-node"><code>tailscale exit-node suggest</code></a> command to automatically pick an available exit node that is likely to perform best.</li> <li data-change="changed"><a href="/kb/1214/site-to-site">Site-to-site networking</a> now also requires <code>--stateful-filtering=false</code> in addition to <code>--snat-subnet-routes=false</code> on new subnet routers. Existing subnet routers with <code>--snat-subnet-routes=false</code> will default to <code>--stateful-filtering=false</code>.</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">View a suggested <a href="/kb/1103/exit-nodes">exit node</a> in the <strong>Exit Node</strong> picker when available.</li> <li data-change="new">Generate a macOS Configuration Report <code>.txt</code> file from the <strong>Bug Report</strong> view to help the Tailscale support team diagnose issues.</li> <li data-change="changed">Improved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">See direct vs. relayed connections in the <strong>Ping</strong> view.</li> <li data-change="new">View a suggested <a href="/kb/1103/exit-nodes">exit node</a> in the <strong>Exit Node</strong> picker when available.</li> <li data-change="new">Use <a href="/kb/1085/auth-keys">auth keys</a> to log in without using the browser.</li> <li data-change="new">Search <a href="/kb/1068/acl-tags">tagged devices</a> by tag in the <strong>Devices</strong> list.</li> <li data-change="new">Remove accounts in the <strong>Fast User Switching</strong> view by using a long press, without having to log out.</li> <li data-change="changed">Improved UI experience to log into a custom coordination server like <a href="/blog/opensource#the-open-source-coordination-server">Headscale</a>.</li> <li data-change="changed">The <strong>Fast User Switching</strong> view can now be used when Tailscale is disconnected.</li> <li data-change="changed">Improved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.</li> <li data-change="changed">Reduced app launch time.</li> </ul> <h6>tvOS</h6> <ul> <li data-change="new">Manage DNS configuration in the <strong>DNS Settings</strong> view.</li> <li data-change="new">Generate a <a href="/kb/1227/bug-report">bug report</a> identifier by navigating to <strong>About Tailscale</strong> > <strong>Report an issue</strong>.</li> <li data-change="changed">Improved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.</li> </ul> <h6>Android</h6> <p>We've rebuilt the Android app from the ground up, adopting a similar design that we've previously rolled out on iOS and using the latest Android best practices.</p> <ul> <li data-change="new">Use new status indicators to see at-a-glance insights into node connectivity. Tap on a node to see detailed information.</li> <li data-change="new">See detailed information about resolvers, domains, and routing configurations in a dedicated <strong>DNS Settings</strong> view.</li> <li data-change="new">See the status of <a href="/kb/1226/tailnet-lock">Tailnet lock</a> and node keys.</li> <li data-change="new">Use <a href="/kb/1225/fast-user-switching">Fast user switching</a> to switch between two or more logged-in accounts on the same device, without requiring you to re-authenticate.</li> <li data-change="new">Use <a href="/kb/1085/auth-keys">auth keys</a> to log in without using the browser.</li> <li data-change="new">Manage Android devices in your tailnet using <a href="/kb/1384/android-mdm">Mobile Device Management</a> (MDM) solutions such as <a href="/kb/1386/mdm-google-workspace">Google Workspace</a>, <a href="/kb/1327/mmdm-microsoft-intune">Microsoft Intune</a>, or <a href="/kb/1385/tinymdm">TinyMDM</a>, among other tools.</li> <li data-change="new">Accessibility support.</li> <li data-change="new">Use dark mode as an alternative to light mode.</li> <li data-change="changed">The <strong>Quick Settings</strong> tile has been temporarily disabled, pending resolution of an issue.</li> <li data-change="changed">More intuitive behavior switching between exit nodes.</li> <li data-change="fixed">Issue with LAN access during exit node use.</li> </ul> </div></div></div></div></div></article><article id="2024-05-01" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-05-01">May 1, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-05-01-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Device posture management GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/crowdstrike"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Device posture management GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1288/device-posture">Device posture management</a> to collect device properties and set device connectivity rules within your Tailscale network. Leverage <a href="/kb/1289/crowdstrike-zta">Tailscale's integration with CrowdStrike</a> to use Falcon Zero Trust Assessment (ZTA) scores to enable granular access control based on device health and security.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-04-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-30">Apr 30, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Manage split DNS in API and Terraform</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The API can now <a href="https://github.com/tailscale/tailscale/blob/main/api.md#get-split-dns">read</a>, <a href="https://github.com/tailscale/tailscale/blob/main/api.md#update-split-dns">update</a>, and <a href="https://github.com/tailscale/tailscale/blob/main/api.md#set-split-dns">set</a> <a href="/kb/1054/dns#nameservers">split DNS</a>.</li> <li data-change="new">The <a href="https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/dns_split_nameservers">Tailscale Terraform provider</a> can now manage <a href="/kb/1054/dns#nameservers">split DNS</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-04-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-23">Apr 23, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming with Axiom</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Log streaming integration with <a href="https://axiom.co">Axiom</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>). <ul> <li>Use Axiom for <a href="/kb/1255/log-streaming">log streaming</a>.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-04-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-22">Apr 22, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Windows OS versions in admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Windows machines in the admin console are now displayed using their marketing version number instead of their internal version number.</li> </ul> </div></div></div></div></div></article><article id="2024-04-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-18">Apr 18, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">All identity providers available to everyone</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/sso-tax-cut"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Allowable <a href="/kb/1013/sso-providers">identity providers</a> are no longer limited by <a href="/pricing">pricing plan</a>. Any supported identity provider is available to all plans.</li> </ul> </div></div></div></div></div></article><article id="2024-04-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-17">Apr 17, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-17-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.64.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Windows</h6> <ul> <li data-change="changed">Installers are now built using WiX toolchain <a href="https://www.firegiant.com/blog/2024/2/6/wix-security-releases-available/">version 3.14.1</a>.</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">DiskStation Manager UI no longer freezes for a few minutes at startup when attempting to clean unused routes. This update is applicable to the version provided on <a href="https://pkgs.tailscale.com/stable/#spks">pkgs.tailscale.com</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-04-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-15">Apr 15, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-15-other" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Changelog update</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The Tailscale changelog has migrated to a new server. To prevent disruptions to RSS readers that subscribe to our changelog, we have limited the RSS feed to entries published on or after 2024-04-15. Existing RSS subscriptions should not lose access to older entries that have already been downloaded. The full changelog history is always available on our website</li> </ul> </div></div></div><div id="2024-04-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Share devices by email from the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1084/sharing">Share devices</a> by sending emails directly from the admin console. The email will contain the invitation and instructions on how to accept the device share.</li> </ul> </div></div></div></div></div></article><article id="2024-04-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-11">Apr 11, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-11-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.64.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#serve"><code>tailscale serve</code></a> headers are now <a href="https://datatracker.ietf.org/doc/html/rfc2047">RFC 2047</a> Q-encoded.</li> <li data-change="new">Device web interface enabled by default locally on <a href="/kb/1381/what-is-quad100"><code>100.100.100.100</code></a>.</li> <li data-change="changed">Go is updated to version 1.22.2.</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Use Tailscale for macOS as a Tailscale SSH client (Standalone variant only).</li> <li data-change="new">Receive alerts when an error occurs while changing client preferences.</li> <li data-change="new">Added a new <a href="https://www.obdev.at/iap/index.html">Internet Access Policy</a> for <a href="https://www.obdev.at/products/littlesnitch/index.html">Little Snitch</a> users.</li> <li data-change="changed">The <code>.pkg</code> installer no longer requires a system restart after installing the client (Standalone variant only).</li> <li data-change="fixed">Unexpected terminations for some macOS 10.15 Catalina users.</li> <li data-change="fixed">Reduced number of alerts if the network extension terminates unexpectedly.</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Improved reliability of the ping chart presentation.</li> </ul> <h6>Synology</h6> <ul> <li data-change="new">Update certificates using the <a href="/kb/1080/cli/#cert"><code>cert</code></a> CLI command.</li> <li data-change="fixed"><a href="/kb/1121/ipv6">IPv6</a> addresses are available again.</li> </ul> <h6>Kubernetes operator</h6> <ul> <li data-change="new"><a href="/kb/1080/cli#configure"><code>tailscale configure kubeconfig</code></a> now respects <code>KUBECONFIG</code> environment variable.</li> <li data-change="fixed"><a href="/kb/1080/cli#configure"><code>tailscale configure kubeconfig</code></a> now works with partially empty <code>kubeconfig</code>.</li> <li data-change="fixed"><a href="https://en.wikipedia.org/wiki/">MSS</a> clamping for Kubernetes operator proxies using <a href="https://wiki.nftables.org/wiki-nftables/index.php/What_is_nftables%3F">nftables</a>.</li> </ul> <h6>Containers</h6> <ul> <li data-change="fixed">Containers on hosts with partial support for <a href="https://www.man7.org/linux/man-pages/man8/iptables.8.html">ip6tables</a> no longer crash.</li> </ul> </div></div></div><div id="2024-04-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Salesforce available as a preset app</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://www.salesforce.com">Salesforce</a> is available as a <a href="/kb/1339/preset-apps">preset app</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-04-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-09">Apr 9, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Unused external invites expire</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1271/invite-any-user">External user invites</a> that are unused for 30 days will expire. This includes external invites sent by <a href="/kb/1271/invite-any-user#send-an-invite-email">email</a> and <a href="/kb/1271/invite-any-user#send-an-invite-link">link</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-04-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-04-05">Apr 5, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-04-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Invite users by email from the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1271/invite-any-user">Invite external users</a> by sending emails directly from the admin console. The email will contain the invitation and instructions on how to join the tailnet.</li> </ul> </div></div></div></div></div></article><article id="2024-03-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-03-26">Mar 26, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-03-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL Preview</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1338/acl-edit">ACL Preview</a> now shows posture conditions</li> </ul> </div></div></div><div id="2024-03-26-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.62.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="new">Send load balancing hint HTTP request header</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Do not allow <code>msiexec</code> to reboot the operating system</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Issue that could cause the Tailscale system extension to not be installed upon app launch, when deploying Tailscale using MDM and using a configuration profile to pre-approve the VPN tunnel (applies to <a href="/kb/1065/macos-variants">standalone</a> variant only)</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">IPv6 routing</li> </ul> <h6>Kubernetes operator</h6> <ul> <li data-change="fixed"> <a href="/kb/1236/kubernetes-operator">Kubernetes operator</a> proxies should not accept subnet routes</li> </ul> </div></div></div></div></div></article><article id="2024-03-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-03-22">Mar 22, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-03-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Device posture attributes API</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Call <a href="/kb/1288/device-posture#posture-attributes-api">device posture attribute API</a> endpoints using the <a href="/kb/1215/oauth-clients#scopes">OAuth access token</a> scope ID <code>devices</code> and personal access tokens belonging to users with the <a href="/kb/1138/user-roles#it-admin">IT admin</a> user role</li> </ul> </div></div></div><div id="2024-03-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale SSH GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tailscale-ssh-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Tailscale SSH GA (<a href="/kb/1167/release-stages#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> to manage the authentication and authorization of SSH connections in your tailnet</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-03-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-03-18">Mar 18, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-03-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Download invoices</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1182/billing-information/#download-invoices">Download invoices</a> for your Tailscale account in the <a href="https://login.tailscale.com/admin/settings/billing"><strong>Billing</strong></a> page of the admin console (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2024-03-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-03-13">Mar 13, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-03-13-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.62.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1325/device-web-interface">Web interface</a> now uses ACL grants to manage access on tagged devices</li> <li data-change="changed"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> connections now disable unnecessary hostname <a href="https://en.wikipedia.org/wiki/Canonicalization">canonicalization</a></li> <li data-change="changed"><a href="/kb/1227/bug-report"><code>tailscale bugreport</code></a> command for generating diagnostic logs now contain ethtool information</li> <li data-change="changed">Mullvad's <a href="https://mullvad.net/en/blog/family-friendly-dns-content-blocking-now-added-to-our-encrypted-dns-service">family-friendly server</a> is added to the list of well known DNS over HTTPS (DoH) servers</li> <li data-change="changed">DNS over HTTP requests now contain a timeout</li> <li data-change="changed">TCP forwarding attempts in <a href="/kb/1177/kernel-vs-userspace-routers#userspace-netstack-mode">userspace mode</a> now have a per-client limit</li> <li data-change="changed">Endpoints with link-local IPv6 addresses is preferred over private addresses</li> <li data-change="changed">WireGuard logs are less verbose</li> <li data-change="changed">Go is updated to version 1.22.1</li> <li data-change="fixed"><a href="/kb/1232/derp-servers">DERP server</a> region no longer changes if connectivity to the new DERP region is degraded</li> </ul> <h6>Linux</h6> <ul> <li data-change="changed"><a href="/kb/1067/update#auto-updates">Auto-update</a> version detection on Alpine Linux is improved</li> <li data-change="changed">IPv6 support detection in a container environment is improved</li> <li data-change="fixed">DNS configuration on Amazon Linux 2023 no longer causes an infinite loop</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed"><a href="/kb/1315/mdm-keys#set-your-organization-name"><code>ManagedByOrganizationName</code></a>, <a href="/kb/1315/mdm-keys#set-an-info-message"><code>ManagedByCaption</code></a>, and <a href="/kb/1315/mdm-keys#set-a-support-url"><code>ManagedByURL</code></a> system policy keys are now supported</li> <li data-change="fixed">Tailscale Tunnel WinTun adapter handling is improved</li> <li data-change="fixed"><a href="/kb/1189/install-windows-msi">MSI</a> upgrades no longer ignore policy properties set during initial install</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">A <code>.pkg</code> installer package is now available for the <a href="/kb/1065/macos-variants">standalone</a> release of the Tailscale client</li> <li data-change="changed"><a href="/kb/1106/taildrop">Taildrop</a> notifications now include actions to reveal the received file in the Finder, or delete it</li> <li data-change="changed"><a href="/kb/1226/tailnet-lock">Tailnet lock</a> settings UI displays more information about the status, including key and public key trust status</li> <li data-change="changed">The onboarding flow now guides the user in enabling the Tailscale system extension</li> <li data-change="changed"><strong>Launch Tailscale at login</strong> settings item can now be toggled when the Tailscale client is disconnected</li> <li data-change="changed">DNS behavior is improved when handling transitions between network interfaces</li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">Battery usage is improved</li> <li data-change="changed"><a href="/kb/1106/taildrop">Taildrop</a> notifications now include actions to reveal the received file in the Files app, or delete it</li> <li data-change="changed"><a href="/kb/1226/tailnet-lock">Tailnet lock</a> settings UI displays more information about the status, including key and public key trust status</li> <li data-change="changed">Unnecessary log messages are removed when triggered by changes to device power state and routing</li> <li data-change="changed">DNS behavior is improved when handling interface transitions between Wi-Fi and Cellular</li> </ul> <h6>Android</h6> <ul> <li data-change="changed">Settings persist from previous sign-ins</li> <li data-change="changed">Always-on VPN handling is improved</li> <li data-change="changed">Custom control server is applied on first start</li> </ul> <h6>Kubernetes operator</h6> <ul> <li data-change="changed"><a href="/kb/1439/kubernetes-operator-cluster-ingress">Ingress</a> resource handling is improved when deployed before its backing <code>Service</code> resource</li> <li data-change="fixed">Destination NAT (DNAT) rule management by egress proxies in <a href="/kb/1294/firewall-mode"><code>nftables</code></a> mode when IP address of <code>tailscale.com/tailnet-fqdn</code> changes</li> </ul> </div></div></div></div></div></article><article id="2024-03-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-03-07">Mar 7, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-03-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Secret scanning with GitLab</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/gitlab"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Secret scanning integration with <a href="https://gitlab.com/">GitLab</a> <ul> <li>Use <a href="/kb/1301/secret-scanning">secret scanning</a> to help mitigate accidental disclosure and prevent fraudulent use of <a href="/kb/1252/key-secret-management">Tailscale-generated keys</a></li> </ul> </li> </ul> </div></div></div><div id="2024-03-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL groups and tests for Tailscale SSH</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1337/acl-syntax/#sshtests"><code>sshTests</code></a> ACL top-policy section lets you write assertions about your SSH access rules and functions similarly to ACL <a href="/kb/1337/acl-syntax/#tests"><code>tests</code></a>, but for <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a></li> <li data-change="new"><code>user:*@<domain></code> <a href="/kb/1337/acl-syntax/#autogroups">ACL autogroup</a> allows access for any user whose login is in the specified domain and is a direct member of the tailnet</li> <li data-change="new"><code>localpart:*@<domain></code> ACL autogroup allows Tailscale SSH access to a user on the host whose name matches the local-part of the user's Tailscale login</li> </ul> </div></div></div></div></div></article><article id="2024-02-29" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-29">Feb 29, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-29-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.60.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Exposing port <code>8080</code> to other devices in your tailnet works as expected</li> </ul> </div></div></div></div></div></article><article id="2024-02-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-23">Feb 23, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Updated Users page</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="https://login.tailscale.com/admin/users"><strong>Users</strong></a> page of the admin console updated to provide more context around <a href="/kb/1271/invite-any-user">user invitations</a>, <a href="/kb/1239/user-approval">user approval</a>, and your tailnet's <a href="/kb/1013/sso-providers">identity provider</a></li> </ul> </div></div></div></div></div></article><article id="2024-02-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-22">Feb 22, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Exit node visibility</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Users can only see <a href="/kb/1103/exit-nodes">exit nodes</a> they have permission to use, based on the <a href="/kb/1337/acl-syntax#subnet-routers-and-exit-nodes">ACL</a> settings for a tailnet. This includes visibility in the Tailscale client and the output for <a href="/kb/1080/cli">Tailscale CLI</a> commands such as <a href="/kb/1080/cli#status"><code>tailscale status</code></a> and <a href="/kb/1080/cli#exit-node"><code>tailscale exit-node list</code></a>.</li> </ul> </div></div></div><div id="2024-02-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Preset Apps GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Preset Apps GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1339/preset-apps">Preset Apps</a> to configure common applications with only a few clicks or an ACL configuration. Routes and domains for Preset Apps are automatically updated and managed by Tailscale, based on each app’s source of truth. Routes for preset apps are automatically approved and pushed down to all selected <a href="/kb/1281/app-connectors">App connectors</a>.</li> </ul> </li> <li data-change="new">Confluence, GitHub, Google Workspace, Jira, Okta, and Stripe are now available as preset apps</li> </ul> </div></div></div></div></div></article><article id="2024-02-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-21">Feb 21, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Updated pricing plans</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The Free <a href="/pricing">pricing plan</a> is now called the Personal plan. All other aspects of the plan remain the same.</li> <li data-change="new">Customers who sign up with a custom domain will be auto-enrolled into a 14-day trial of the Enterprise plan with no provisioned user limits</li> <li data-change="new">Personal plan customers who use a custom or vanity domain for their tailnet can opt out of the trial and continue to use the Personal plan</li> <li data-change="changed">Customers who use Tailscale for commercial purposes will be billed for all of their <a href="/kb/1251/pricing-faq#how-are-monthly-active-users-defined">active users</a> once they sign up for a plan</li> </ul> <p><em>Note</em>: Free trials are available for business customers. For details about billing, plan comparison, and support, see <a href="/kb/1251/pricing-faq">Pricing & Plans FAQ</a>. For instructions on how to change your plan, see <a href="/kb/1182/billing-information">Modify billing</a>.</p> </div></div></div></div></div></article><article id="2024-02-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-15">Feb 15, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-15-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.60.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1080/cli#status"><code>tailscale status</code></a> command output now includes location-based exit nodes</li> <li data-change="new"><a href="/kb/1080/cli#web"><code>tailscale web</code></a> command flag <code>--read-only</code> is added to run the web UI in read-only mode</li> <li data-change="new">A warning is logged when unable to find SSH host keys</li> <li data-change="new">Support added for legacy "urn:dslforum-org" port mapping services</li> <li data-change="changed">Build with Go 1.22</li> <li data-change="changed">Detect when Tailscale is running on Digital Ocean and automatically use Digital Ocean's DNS resolvers</li> <li data-change="changed">Expose gVisor metrics in debug mode</li> <li data-change="changed">Improve error message when running as non-root</li> <li data-change="fixed">A valid login page is presented to users when attempting to log in even after leaving device unattended for several days</li> <li data-change="fixed">An issue with noisy peer mtu discovery errors</li> <li data-change="fixed">A potential crash when no supported port mapping services are found</li> </ul> <h6>Windows</h6> <ul> <li>Fixed:<code>tailscaled</code> could be slow or cause increased CPU usage with large routing tables</li> </ul> <h6>macOS</h6> <p><em>Note</em>: Tailscale v1.60.0 is built with Go 1.22 and Go 1.22 is the last release that will run on macOS 10.15 Catalina (<a href="https://tip.golang.org/doc/go1.22#darwin">source</a>). We are providing notice that around August 15, 2024, Tailscale will be built with Go 1.23 at which time macOS users that want to run the latest version of Tailscale will require macOS 11 Big Sur or later. Note that macOS 10.15 Catalina is no longer supported by Apple and is no longer receiving security updates.</p> <ul> <li data-change="new">New UI to add, remove, and switch between user accounts, including using custom control servers</li> <li data-change="new">New UI to change client preferences</li> <li data-change="new">New UI to manage updates for the Standalone variant of the client, including switching in-app between stable and unstable builds</li> <li data-change="new"><a href="/kb/1291/ios-vpn-on-demand">VPN On Demand</a> is now supported on macOS, to automatically connect/disconnect Tailscale when specific conditions are triggered</li> <li data-change="new"><strong>Reset VPN Configuration</strong> menu item in the <strong>Debug</strong> menu is now available to reset the system VPN configuration if needed</li> <li data-change="new">An alert window is presented when the Tailscale network extension fails to start, providing suggested troubleshooting steps</li> <li data-change="changed">Tailscale appears in the macOS Dock when an app window is presented</li> <li data-change="changed">The <strong>Network Devices</strong> list now shows all devices known to the control server, not only those seen in the last 4 days</li> <li data-change="changed">The onboarding flow automatically advances once the user is connected</li> <li data-change="fixed">A potential crash and excessive logging upon client launch</li> <li data-change="fixed"><strong>Start on Login</strong> is set correctly on macOS Ventura and earlier versions</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">A potential crash and excessive logging upon client launch</li> <li data-change="fixed">Stale devices are no longer presented in the devices list</li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed">A potential crash and excessive logging upon client launch</li> <li data-change="fixed">Stale devices are no longer presented in the devices list</li> </ul> <h6>Android</h6> <ul> <li data-change="changed">Mullvad exit nodes now sorted to make it easier to find the best node for each location</li> <li data-change="changed">Mullvad tunnels are no longer shown as regular nodes in UI</li> <li data-change="fixed">Quick settings tile now works</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">An issue with stalling of SMB transfers of large files</li> </ul> <h6>Kubernetes operator</h6> <ul> <li data-change="new">A new <code>ProxyClass</code> custom resource that allows you to provide a custom configuration for cluster resources that the operator creates</li> <li data-change="new"><a href="/kb/1068/acl-tags">ACL tags</a> for the operator can now be configured via Helm chart values</li> <li data-change="fixed">Routing to Ingress backends that require an exact path without a slash (<code>/</code>) suffix</li> </ul> <h6>App connectors</h6> <ul> <li data-change="new"><a href="/kb/1281/app-connectors">App connectors</a> now flatten DNS CNAME chains down to a target A/AAAA routing record, for apps that are configured with a DNS record that is a CNAME</li> <li data-change="new">Apps can be preconfigured with known routes to have those routes auto-advertised by all selected app connectors, and immediately begin to route traffic</li> </ul> </div></div></div></div></div></article><article id="2024-02-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-14">Feb 14, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Auto-updates GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/auto-update-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1067/update#auto-updates">Auto-updates</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>)</li> <li data-change="new">Enable Tailscale client auto-updates in the <a href="https://login.tailscale.com/admin/settings/device-management"><strong>Device management</strong></a> section of the admin console</li> <li data-change="new">Initiate Tailscale client updates to devices from the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page of the admin console. For details, see <a href="/kb/1067/update#auto-updates">Auto-updates</a>.</li> </ul> </div></div></div></div></div></article><article id="2024-02-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-12">Feb 12, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">App connectors wildcard support change</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">New Apps and <a href="/kb/1281/app-connectors/">app connectors</a> can no longer be selected via the <code>*</code> wildcard in a tailnet policy file or configuration flow. Instead, <a href="/kb/1068/acl-tags">tag</a> all app connectors and then use the tags as a selector. Existing <code>*</code> configurations will need to update to a tag-based selector upon the next tailnet policy file change. For details, see <a href="/kb/1281/app-connectors/#considerations">Wildcard connectors no longer supported</a>.</li> </ul> </div></div></div><div id="2024-02-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">System policies GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/mdm-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">System policies GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1315/mdm-keys">system policies</a> (also known as MDM policies) to control Tailscale client settings for your users, such as UI visibility, organization customization, auto-update functionality, and runtime configurations</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-02-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-02-05">Feb 5, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-02-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Secret scanning with GitGuardian</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/gitguardian"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Secret scanning integration with <a href="https://www.gitguardian.com/">GitGuardian</a> <ul> <li>Use <a href="/kb/1301/secret-scanning">secret scanning</a> to help mitigate accidental disclosure and prevent fraudulent use of <a href="/kb/1252/key-secret-management">Tailscale-generated keys</a></li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2024-01-29" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-01-29">Jan 29, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-01-29-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support Device Posture in ACL tests</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Device Posture is now supported in <a href="/kb/1337/acl-syntax#tests">ACL Tests</a></li> </ul> </div></div></div></div></div></article><article id="2024-01-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-01-23">Jan 23, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-01-23-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.58.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><em>Note:</em> The 1.58.1 release needed to be re-done. Use 1.58.2 instead.</p> <h6>All platforms</h6> <ul> <li data-change="fixed"><a href="/kb/1281/app-connectors">App connectors</a> have improved scheduling and merging of route changes under some conditions</li> <li data-change="fixed">Crash when performing UPnP portmapping on older routers with no supported portmapping services</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Opening the <strong>About</strong> window no longer displays a user interface when there is no newer version</li> </ul> </div></div></div></div></div></article><article id="2024-01-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-01-18">Jan 18, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-01-18-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.58.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p><em>Note:</em> Rollout of 1.58.0 paused on 21-Jan-2024 while we investigate reports of a regression with portmapping.</p> <h6>All platforms</h6> <ul> <li data-change="changed">The number of <a href="/kb/1201/4via6-subnets">4via6</a> site IDs are increased from 256 to 65,536</li> <li data-change="changed"><a href="/kb/1106/taildrop">Taildrop</a> allows category Z unicode characters</li> <li data-change="changed"><a href="/kb/1232/derp-servers">DERP</a> flapping (flipping back and forth between two regions rapidly) is reduced when there's still an active connection for the home DERP server</li> <li data-change="changed"><a href="/kb/1257/connection-types#hard-nat">Portmap</a> checks the epoch from NAT-PMP & PCP, and establishes a new portmapping if it changes</li> <li data-change="changed">Portmap better handles multiple interfaces</li> <li data-change="changed">Portmap handles multiple UPnP discovery responses</li> <li data-change="changed">Increased binary size with Tailscale 1.56 is resolved</li> <li data-change="fixed"><a href="/kb/1325/device-web-interface">Web interface</a> issue related to accessing shared devices</li> <li data-change="fixed">Web interface login issue when accessed over HTTPS</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Shell shebang is added in postinstall script, which fixes some Debian installations</li> </ul> <h6>macOS</h6> <ul> <li data-change="new"><strong>DNS Settings</strong> view is added and displays the DNS configuration used when Tailscale is running</li> <li data-change="new">Quit the app without terminating the VPN tunnel by holding down the <strong>Option</strong> button and selecting <strong>Quit (Leave VPN Active)</strong></li> <li data-change="new"><strong>Toggle Tailscale</strong> shortcut action can be used to connect or disconnect the VPN tunnel, depending on its current state</li> <li data-change="new">The <a href="/kb/1315/mdm-keys#set-the-key-expiration-notice-period"><code>KeyExpirationNotice</code></a> system policy is now supported to customize the time interval before a key expiration notice is displayed to the user</li> <li data-change="new">The <a href="/kb/1325/device-web-interface">web interface</a> is now supported in the <a href="/kb/1065/macos-variants">standalone</a> variant of the client</li> <li data-change="changed">Onboarding flow includes a step to ask the user to approve key expiry notifications</li> <li data-change="changed">Onboarding flow asks the user to approve the system extension if necessary, when using the standalone variant of the client</li> <li data-change="changed">Pre-Sonoma compatibility is improved</li> <li data-change="fixed">VPN tunnel terminates upon closing the app</li> <li data-change="fixed">Opening the <strong>About</strong> window triggers a check for updates</li> <li data-change="fixed">The standalone variant of the client checks for updates every 72 hours</li> </ul> <h6>iOS</h6> <ul> <li data-change="new"><strong>Toggle Tailscale</strong> shortcut action can be used to connect or disconnect the VPN tunnel, depending on its current state. Ideal for the <strong>Action Button</strong> on iPhone 15 Pro.</li> <li data-change="new">The <a href="/kb/1315/mdm-keys#set-the-key-expiration-notice-period"><code>KeyExpirationNotice</code></a> system policy is now supported to customize the time interval before a key expiration notice is displayed to the user</li> <li data-change="fixed"><strong>Sign</strong> button in the <a href="/kb/1226/tailnet-lock">Tailnet lock</a> device sign view is rendered correctly</li> <li data-change="fixed">Connectivity is no longer lost when transitioning from Wi-Fi to Cellular while an <a href="/kb/1103/exit-nodes">exit node</a> is in use</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">The <a href="/kb/1325/device-web-interface">web interface</a> is now supported</li> <li data-change="changed">The lookup for <code>netsh.exe</code> uses the absolute path instead of the relative path</li> <li data-change="changed">ADMX <a href="/kb/1315/mdm-keys">system policy</a> descriptions are now available</li> <li data-change="changed">Vestigial wintun support is removed, which might have caused Chocolatey installs to break</li> <li data-change="fixed">A goroutine leak in winMon no longer occurs if the monitor is never started</li> <li data-change="fixed">"This package requires Windows 10 or newer" message no longer falsely displays during an uninstall or repair</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">Active network change detection is improved</li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed">Improvements to persistence of the client when running in the background</li> </ul> <h6>Kubernetes Operator</h6> <ul> <li data-change="new">A Connector custom resource is added, allowing users to configure the operator to deploy an <a href="/kb/1103/exit-nodes">exit node</a>, <a href="/kb/1019/subnets">subnet router</a>, or both</li> <li data-change="changed">A warning displays if the unsupported ingress <code>Exact</code> path type is used</li> <li data-change="changed">StatefulSet labels are synced to their Pods</li> <li data-change="changed">A Tailscale <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class">IngressClass</a> resource is added</li> <li data-change="changed">Extra long <a href="/kb/1439/kubernetes-operator-cluster-ingress#loadbalancerclass">Service</a> names are properly truncated</li> </ul> <h6>Containers</h6> <ul> <li data-change="changed">Experimental support is added for configuring <a href="/kb/1278/tailscaled"><code>tailscaled</code></a> using a mounted config file</li> <li data-change="fixed">Tailscale images now contain layers of the same media type and can be parsed by <a href="https://podman.io/">Podman</a> and <a href="https://buildah.io/">Buildah</a></li> </ul> </div></div></div></div></div></article><article id="2024-01-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-01-12">Jan 12, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-01-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for Zoho</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Zoho is now supported as a <a href="/kb/1240/sso-custom-oidc">custom OIDC provider</a></li> </ul> </div></div></div></div></div></article><article id="2024-01-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-01-10">Jan 10, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-01-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Security update indicators and filter in the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Available update icons on the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page of the admin console now differentiate between regular and security updates</li> <li data-change="changed">The Version filter on the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page can now show nodes with pending security updates</li> </ul> </div></div></div></div></div></article><article id="2024-01-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-01-08">Jan 8, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-01-08-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.44.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Windows</h6> <ul> <li data-change="fixed">Added a security fix to address privilege escalation with <a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> and <a href="/kb/1311/tailscale-funnel"><code>tailscale funnel</code></a> that allowed low-privilege users to serve files they did not have access to (<a href="/security-bulletins/#ts-2024-001">TS-2024-001</a>). This release is intended for Windows 7 and 8 users. Those with later versions of Windows should run the latest stable version of Tailscale, which is 1.56.1. This issue was resolved in Tailscale 1.52.</li> </ul> </div></div></div></div></div></article><article id="2024-01-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2024-01-02">Jan 2, 2024</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2024-01-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Invite any user to a GitHub tailnet</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1271/invite-any-user">Invite any user</a> to your tailnet when using a GitHub organization or GitHub personal account as the <a href="/kb/1284/sso-github">identity provider</a></li> </ul> </div></div></div></div></div></article><article id="2023-12-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-12-20">Dec 20, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-12-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">View machine certificate status</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1153/enabling-https/#view-certificate-status">View the TLS certificate status</a> of a machine in your tailnet by using the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page of the admin console</li> </ul> </div></div></div><div id="2023-12-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">HTTPS certificates GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">HTTPS certificates GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1153/enabling-https">HTTPS certificates</a> to provision TLS certificates for devices in your tailnet</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-12-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-12-15">Dec 15, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-12-15-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.56.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="fixed"><a href="/kb/1325/device-web-interface">Web interface</a> redirects to the correct self-IP known by the source peer</li> <li data-change="fixed"><a href="/kb/1281/app-connectors">App connector</a> domain list displays as expected</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed"><a href="/kb/1315/mdm-keys#set-a-custom-control-server-url">Custom login server</a> uses the provided URL instead of <code>login.tailscale.com</code></li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed"><a href="/kb/1315/mdm-keys#set-a-custom-control-server-url">Custom login server</a> uses the provided URL instead of <code>login.tailscale.com</code></li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed"><a href="/kb/1315/mdm-keys#set-a-custom-control-server-url">Custom login server</a> uses the provided URL instead of <code>login.tailscale.com</code></li> </ul> </div></div></div></div></div></article><article id="2023-12-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-12-14">Dec 14, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-12-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL Grants</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/acl-grants"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1324/acl-grants">ACL Grants</a> in your <a href="/kb/1155/terminology-and-concepts/#tailnet-policy-file">tailnet policy file</a> to provide capabilities at either the IP layer or the application layer (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div><div id="2023-12-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Device posture</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/device-posture"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1288/device-posture">Device posture management</a> to collect device properties and set device connectivity rules within your Tailscale network (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new">"Enable posture identity collection" and "Disable posture identity collection" are logged as <a href="/kb/1203/audit-logging/#events">configuration audit logging events</a> when <a href="/kb/1326/device-identity-collection">device posture identifiers</a> are enabled or disabled, respectively</li> <li data-change="new">"Create posture integration" is logged when a new <a href="/kb/1289/crowdstrike-zta">device posture integration</a> is added</li> <li data-change="new">"Update posture integration" is logged when a device posture integration is updated</li> <li data-change="new">"Remove posture integration" is logged when a device posture integration is removed</li> </ul> </div></div></div></div></div></article><article id="2023-12-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-12-13">Dec 13, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-12-13-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.56.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#whois"><code>tailscale whois</code></a> command shows the machine and user associated with a Tailscale IP address</li> <li data-change="changed"><a href="/kb/1315/mdm-keys">System policies</a> are now in <a href="/kb/1167/release-stages/#beta">beta</a></li> <li data-change="changed"><a href="/kb/1080/cli/#switch"><code>tailscale switch --list</code></a> command shows name and profile ID to disambiguate profiles with common login names</li> <li data-change="changed">Responsiveness is improved under load, especially with bidirectional traffic</li> <li data-change="changed">UPnP port mapping is improved</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">The <a href="/kb/1325/device-web-interface">web interface</a> allows users to configure some device settings such as <a href="/kb/1103/exit-nodes">exit nodes</a>, <a href="/kb/1019/subnets">subnet routers</a>, and <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> using a browser-based GUI instead of the <a href="/kb/1080/cli/">Tailscale CLI</a></li> <li data-change="changed"><a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command is supported for <a href="/kb/1307/nas/#unraid">Unraid</a></li> <li data-change="changed"><code>containerboot</code> symlinks its socket file if possible, making the Tailscale CLI work without <code>--socket=/tmp/tailscale.sock</code></li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Throughput is improved for <a href="/kb/1177/kernel-vs-userspace-routers/#userspace-netstack-mode">userspace ("netstack") mode</a> in the presence of packet loss</li> <li data-change="changed">Profile switcher displays the tailnet name</li> <li data-change="changed">Dynamic DNS updates are disabled in the client interface via the registry setting</li> <li data-change="changed">Client improvements when restarting after an upgrade</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed"><a href="/kb/1106/taildrop">Taildrop</a> notification displays when a file is received (App Store variant only)</li> <li data-change="changed">Taildrop shortcut action is added for file sharing</li> <li data-change="changed">Profile switcher displays the tailnet name</li> <li data-change="changed"><strong>About Tailscale</strong> dialog indicates when the app is running a <a href="/kb/1083/install-unstable">TestFlight</a> build</li> <li data-change="changed">In-app warnings and push notifications display when internet connectivity is blocked because the current <a href="/kb/1103/exit-nodes">exit node</a> is offline or its key has expired</li> <li data-change="changed">VPN tunnel fully terminates when Tailscale is stopped, using the menu bar toggle</li> <li data-change="fixed"><code>/etc/resolv</code> file formatting with Tailscaled-on-macOS is improved</li> </ul> <h6>iOS</h6> <ul> <li data-change="new"><strong>DNS Settings</strong> view is added</li> <li data-change="changed"><a href="/kb/1106/taildrop">Taildrop</a> shortcut action is added for file sharing</li> <li data-change="changed">Taildrop notifications include the received file names</li> <li data-change="changed">Profile switcher displays the tailnet name</li> <li data-change="changed"><strong>About Tailscale</strong> dialog indicates when the app is running a <a href="/kb/1083/install-unstable">TestFlight</a> build</li> <li data-change="changed"><strong>Allow Local Network Access</strong> option is added to the exit node picker UI</li> <li data-change="changed">In-app warning and push notification displays when internet connectivity is blocked because the current <a href="/kb/1103/exit-nodes">exit node</a> is offline or its key has expired</li> <li data-change="changed">App size is reduced by about 2 MB with better asset compression</li> </ul> <h6>tvOS</h6> <ul> <li data-change="new"><a href="/kb/1280/appletv">Apple TV</a> can be configured as a subnet router, allowing you to remotely access resources on your home network that may not have Tailscale installed, such as a printer</li> <li data-change="changed"><strong>About Tailscale</strong> dialog indicates when the app is running a <a href="/kb/1083/install-unstable">TestFlight</a> build</li> </ul> <h6>Kubernetes</h6> <ul> <li data-change="changed"><a href="/kb/1236/kubernetes-operator/#helm">Helm charts</a> for the <a href="https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/manifests/operator.yaml">Tailscale Kubernetes Operator</a> are now available on <a href="https://pkgs.tailscale.com/helmcharts/index.yaml">pkgs.tailscale.com/helmcharts</a></li> <li data-change="changed"><a href="/kb/1437/kubernetes-operator-api-server-proxy">Kubernetes API server proxy</a> supports impersonating groups via <a href="/kb/1324/acl-grants">ACL Grants</a></li> <li data-change="changed">Kubernetes operator <a href="/kb/1438/kubernetes-operator-cluster-egress">cluster egress</a> now supports referring to a tailnet service by its MagicDNS name in the <code>Service</code> annotation</li> </ul> <h6>GoKrazy</h6> <ul> <li data-change="changed">TUN mode is used by default</li> </ul> </div></div></div></div></div></article><article id="2023-12-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-12-12">Dec 12, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-12-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">App connectors</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/saas"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1281/app-connectors">App connectors</a> to connect software as a service (SaaS) applications to your Tailscale network (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div><div id="2023-12-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Regional routing GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/regional-routing"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1115/high-availability/#regional-routing">Regional routing</a> to route your traffic across distributed <a href="/kb/1115/high-availability">high availability infrastructure</a> based on region (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-12-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-12-05">Dec 5, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-12-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Specify protocol in ACL tests</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><code>proto</code> field is now supported in <a href="/kb/1337/acl-syntax/#tests">ACL tests</a></li> </ul> </div></div></div></div></div></article><article id="2023-11-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-30">Nov 30, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-30-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.54.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>macOS</h6> <ul> <li data-change="fixed">Changing a pre-existing system policy value to nil no longer causes stability issues</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Changing a pre-existing system policy value to nil no longer causes stability issues</li> <li data-change="fixed">Widget tracks the connection state more closely</li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed">Changing a pre-existing system policy value to nil no longer causes stability issues</li> </ul> </div></div></div><div id="2023-11-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Configure CGNAT IP range subset</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1304/ip-pool">IP pool</a> to enable configuring a specific CGNAT IP range subset in your <a href="/kb/1155/terminology-and-concepts/#tailnet-policy-file">tailnet policy file</a> (<a href="/kb/1167/release-stages/#alpha">alpha</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-11-28" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-28">Nov 28, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-28-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Access to the full CGNAT address space</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Each individual <a href="/kb/1136/tailnet">tailnet</a> can now use the full <a href="/kb/1015/100.x-addresses">CGNAT</a> address range of 100.64.0.0/10</li> </ul> </div></div></div><div id="2023-11-28-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale IPv6 address prefix change</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1033/ip-and-dns-addresses/#tailscale-ipv6-local-address-prefix">Tailscale IPv6 local addresses</a> are assigned from the <a href="https://en.wikipedia.org/wiki/Unique_local_address">unique local address</a> prefix of <code>fd7a:115c:a1e0::/48</code>. Previously IPv6 addresses were assigned from <code>fd7a:115c:a1e0:ab12::/64</code>.</li> </ul> </div></div></div></div></div></article><article id="2023-11-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-17">Nov 17, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming with Datadog GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/datadog"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Log streaming integration with <a href="https://www.datadoghq.com/">Datadog</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use Datadog for <a href="/kb/1255/log-streaming">Log streaming</a></li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-11-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-16">Nov 16, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Require check mode on every Tailscale SSH connection</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Require <a href="/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode">check mode</a> on every <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> connection by specifying <code>"checkPeriod": "always"</code> in your <a href="/kb/1155/terminology-and-concepts/#tailnet-policy-file">tailnet policy file</a> from the <a href="https://login.tailscale.com/admin/acls/file"><strong>Access controls</strong></a> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2023-11-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-15">Nov 15, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-15-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.54.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="changed">Go is updated to version 1.21.4</li> </ul> <h6>Linux</h6> <ul> <li data-change="changed"><a href="/kb/1320/performance-best-practices/#ethtool-configuration">Substantially improve throughput</a> for UDP packets over TUN device with recent Linux kernels</li> <li data-change="fixed">Added a security fix to address privilege escalation with <a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> and <a href="/kb/1311/tailscale-funnel"><code>tailscale funnel</code></a> that allowed low-privilege users to serve files they did not have access to if the machine administrator had previously granted that user <a href="/kb/1241/tailscale-up"><code>tailscale up --operator</code></a> privilege (<a href="/security-bulletins/#ts-2024-001">TS-2024-001</a>)</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">Open menu with a regular click in addition to a right-click</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Implement MDM settings for the <a href="/kb/1065/macos-variants">standalone macOS application</a></li> <li data-change="new">Support for the <a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command for the standalone macOS application</li> <li data-change="changed">Don't run Taildrop cleanup loop until the first file transfer, and avoid spurious security dialog</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Show a helpful banner if there are no other devices on the tailnet</li> <li data-change="new">Add <strong>Allow Local Network Access</strong> setting when using an exit node</li> <li data-change="new">Show info bubble when key expires within 8 hours, or has expired</li> <li data-change="fixed">Widgets now reflect the state of the VPN tunnel more accurately</li> </ul> <h6>QNAP</h6> <ul> <li data-change="new">Support for the <a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command</li> </ul> </div></div></div><div id="2023-11-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Secret scanning and TruffleHog</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/trufflehog"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Scanning for exposed Tailscale secrets <ul> <li><a href="/kb/1301/secret-scanning">Scanning for exposed Tailscale secrets</a> helps mitigate accidental disclosure and prevent fraudulent use of <a href="/kb/1252/key-secret-management">Tailscale-generated keys</a></li> </ul> </li> <li data-change="new">Secret scanning integration with TruffleHog <ul> <li><a href="https://trufflesecurity.com/trufflehog/">TruffleHog</a> scans for exposed Tailscale keys</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-11-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-09">Nov 9, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Revert your tailnet policy file</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1203/audit-logging/#reverting-acls-from-audit-logs">Revert</a> your <a href="/kb/1155/terminology-and-concepts/#tailnet-policy-file">tailnet policy file</a> from the <a href="https://login.tailscale.com/admin/logs"><strong>Configuration logs</strong></a> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2023-11-03" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-03">Nov 3, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming updates</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/log-streaming-endpoints-cribl-audit"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Log streaming private endpoints GA <ul> <li>Use <a href="/kb/1255/log-streaming/#private-endpoints">private endpoints</a> in your tailnet for <a href="/kb/1255/log-streaming">Log streaming</a> (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>)</li> </ul> </li> <li data-change="changed"><a href="/kb/1255/log-streaming">Configuration audit log streaming</a> is now available to the <a href="/pricing">Free plan</a></li> <li data-change="new">Log streaming integration with <a href="https://cribl.io/">Cribl</a> GA <ul> <li>Use Cribl for Log streaming (generally available)</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-11-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-11-02">Nov 2, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-11-02-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.52.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Windows</h6> <ul> <li data-change="fixed">Resolve an incompatibility with other software that uses wintun</li> </ul> <h6>NAS platforms</h6> <ul> <li data-change="changed">Clean up downloaded upgrades after applying them</li> </ul> </div></div></div><div id="2023-11-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Delete non-provisioned users</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="fixed"><a href="/kb/1145/remove-team-members">Delete</a> non-provisioned users on a tailnet with <a href="/kb/1290/user-group-provisioning">user & group provisioning</a> enabled</li> </ul> </div></div></div></div></div></article><article id="2023-10-31" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-10-31">Oct 31, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-10-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Automatic client updates</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/auto-update-beta"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1067/update/#auto-updates">auto-updates</a> (<a href="/kb/1167/release-stages/#beta">beta</a>) to keep your Tailscale client on the latest version</li> </ul> </div></div></div><div id="2023-10-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Kubernetes operator</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/kubernetes-operator"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1236/kubernetes-operator/">Tailscale Kubernetes operator</a> is now in <a href="/kb/1167/release-stages/#beta">beta</a> <ul> <li>Use the Kubernetes operator to expose services in your Kubernetes cluster to your tailnet, connect to your tailnet from a Kubernetes cluster, and securely connect to the Kubernetes control plane</li> </ul> </li> <li data-change="new"><a href="/kb/1236/kubernetes-operator/#helm">Use a Helm chart</a> to deploy the Kubernetes operator</li> </ul> </div></div></div><div id="2023-10-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale extension for Visual Studio Code GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Tailscale extension for Visual Studio Code GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use the <a href="/kb/1265/vscode-extension">Tailscale extension for Visual Studio Code</a> to interact with resources in your tailnet from within the VS Code IDE</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-10-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-10-30">Oct 30, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-10-30-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.52.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="changed"><a href="/kb/1080/cli/#cert"><code>tailscale cert</code></a> command renews in the background. The current certificate only displays if it has expired.</li> <li data-change="changed"><a href="/kb/1080/cli/#status"><code>tailscale status</code></a> command displays a message about client updates when newer versions are available</li> <li data-change="changed"><a href="/kb/1080/cli/#up"><code>tailscale up</code></a> command displays a message about client updates when newer versions are available</li> <li data-change="changed"><a href="/kb/1106/taildrop">Taildrop</a> now resumes file transfers after partial transfers are interrupted</li> <li data-change="changed">Taildrop prevents file duplication</li> <li data-change="changed">Taildrop detects conflicting file transfers and only proceeds with one transfer</li> <li data-change="changed">Wake on LAN (WoL) is now supported for peer node wake-ups</li> <li data-change="changed">TCP DNS queries are speculatively started if UDP hasn't responded quickly enough</li> <li data-change="changed">Truncated UDP DNS results are properly retried using TCP</li> <li data-change="changed">Go is updated to version 1.21.3</li> </ul> <h6>Linux</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#set"><code>tailscale set</code></a> command flag <code>--auto-update</code> is added to opt in to automatic client updates (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="changed"><a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> and <a href="/kb/1311/tailscale-funnel"><code>tailscale funnel</code></a> commands are updated for improved usability</li> <li data-change="changed"><a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command for manual updates is now in <a href="/kb/1167/release-stages/#beta">beta</a></li> <li data-change="changed"><a href="/kb/1106/taildrop">Taildrop</a> file transfer displays a progress meter</li> <li data-change="changed"><a href="/kb/1294/firewall-mode"><code>nftables</code></a> auto-detection is improved when <code>TS_DEBUG_FIREWALL_MODE=auto</code> is used</li> <li data-change="fixed">DNS detection of <code>NetworkManager</code> with configured but absent <code>systemd-resolved</code>, such as EndeavourOS</li> <li data-change="fixed">DNS detection for Debian <code>resolvconf</code> version 1.90 or later</li> </ul> <h6>Windows</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#set"><code>tailscale set</code></a> command flag <code>--auto-update</code> is added to opt in to automatic client updates (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new"><strong>Preferences</strong> section contains auto-update setting</li> <li data-change="new">Update notice displays, when a new version is available</li> <li data-change="new">System policies allow system administrators to set a forced/suggested tailnet name, hide settings menu items, and more</li> <li data-change="changed"><a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> and <a href="/kb/1311/tailscale-funnel"><code>tailscale funnel</code></a> commands are updated for improved usability</li> <li data-change="changed"><a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command for manual updates is now in <a href="/kb/1167/release-stages/#beta">beta</a></li> <li data-change="changed"><code>iphlpsvc</code>, <code>netprofm</code>, and <code>WinHttpAutoProxySvc</code> service dependencies are checked during installation</li> <li data-change="fixed">Added a security fix to address privilege escalation with <a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> and <a href="/kb/1311/tailscale-funnel"><code>tailscale funnel</code></a> that allowed low-privilege users to serve files they did not have access to (<a href="/security-bulletins/#ts-2024-001">TS-2024-001</a>)</li> </ul> <h6>macOS</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#set"><code>tailscale set</code></a> command flag <code>--auto-update</code> is added to opt in to automatic client updates (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new">App menu displays a notification item when a newer version is available</li> <li data-change="new">System policies allow system administrators to set a forced/suggested tailnet name, prevent the VPN from stopping, hide categories of network devices and setting menu items, and more</li> <li data-change="new"><strong>Settings</strong> section has an option added for turning on auto-updates</li> <li data-change="changed"><strong>Reauthenticate</strong> menu item shows time until expiry more prominently, presenting alerts when necessary</li> <li data-change="changed"><a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> and <a href="/kb/1311/tailscale-funnel"><code>tailscale funnel</code></a> commands are updated for improved usability</li> <li data-change="changed"><a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command for manual updates is now in <a href="/kb/1167/release-stages/#beta">beta</a></li> <li data-change="changed"><strong>About</strong> window more clearly distinguishes between the Standalone and App Store <a href="/kb/1065/macos-variants">variants</a> of the client</li> <li data-change="changed">Sparkle is updated to version 2.5.1</li> </ul> <h6>iOS</h6> <ul> <li data-change="new"><strong>Settings</strong> page displays a notification banner when a newer version is available on the App Store</li> <li data-change="new">Home and lock screen widgets are supported</li> <li data-change="new">System policies allow system administrators to set a forced/suggested tailnet name, prevent the VPN from stopping, hide the VPN On Demand settings, categories of network devices and settings menu items, and more</li> </ul> <h6>tvOS</h6> <ul> <li data-change="fixed">DNS support when operating as an <a href="/kb/1280/appletv/#use-a-device-exit-node">exit node</a></li> </ul> </div></div></div><div id="2023-10-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">OAuth clients GA and Search domains GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">OAuth clients GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1215/oauth-clients">OAuth clients</a> to provide delegated fine-grained access to the <a href="/kb/1101/api">Tailscale API</a></li> </ul> </li> <li data-change="changed">Search domains GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1054/dns/#search-domains">Search domains</a> to set custom DNS domain suffixes that are automatically appended to any domain name that is not a fully qualified domain name (FQDN)</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-10-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-10-18">Oct 18, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-10-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Add devices from the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use the <strong>Add device</strong> button in the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page of the admin console to download the Tailscale client. See <a href="/kb/1316/device-add">Add a device</a> for details.</li> </ul> </div></div></div></div></div></article><article id="2023-10-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-10-02">Oct 2, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-10-02-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.50.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li>Fixed:<code>tailscale serve</code> configuration doesn't persist in container (<a href="https://github.com/tailscale/tailscale/issues/9558">#9558</a>)</li> <li data-change="fixed"><code>tailnet lock</code> fails to sign node in container (<a href="https://github.com/tailscale/tailscale/issues/9539">#9539</a>)</li> <li data-change="fixed">Funnel doesn't work for <code>tsnet</code> apps (<a href="https://github.com/tailscale/tailscale/issues/9566">#9566</a>)</li> <li data-change="fixed">UPnP potentially crashes in specific circumstances</li> </ul> </div></div></div></div></div></article><article id="2023-09-29" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-09-29">Sep 29, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-09-29-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Google Chat supported as a webhook destination</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1213/webhooks">Webhook</a> events are available in a format for Google Chat</li> </ul> </div></div></div></div></div></article><article id="2023-09-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-09-25">Sep 25, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-09-25-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.50.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="https://meta.wikimedia.org/wiki/Wikimedia_DNS">Wikimedia DNS</a> using DNS-over-HTTPS is supported</li> <li data-change="changed">Build with Go 1.21.1</li> <li data-change="changed"><a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command is unhidden on most platforms</li> <li data-change="changed"><a href="/kb/1080/cli/#ping"><code>tailscale ping</code></a> command sends an ICMP Ping code of <code>0</code></li> <li data-change="changed"><a href="/kb/1080/cli/#web"><code>tailscale web</code></a>command updated to use React</li> <li data-change="changed"><code>tailscale debug portmap</code> command now has the <code>--log-http</code> option</li> <li data-change="fixed"><a href="/kb/1080/cli/#netcheck"><code>tailscale netcheck</code></a> command works even if the OS platform lacks CA certificates</li> <li data-change="fixed">UPnP falls back to a permanent lease if a limited lease fails</li> <li data-change="fixed">WireGuard peer endpoint selections are improved</li> </ul> <h6>Linux</h6> <ul> <li data-change="changed">Debian package lists the <code>iptables</code> and <code>iproute2</code> packages as recommended, not required</li> <li data-change="changed"><code>nftables</code> support interoperates with Uncomplicated Firewall (UFW)</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed"><a href="/kb/1227/bug-report"><code>tailscale bugreport</code></a> logs contain additional diagnostic information</li> <li data-change="fixed"><a href="/kb/1022/install-windows">Windows executable installer</a> detects when it is running on Windows 7 or Windows 8.x and will automatically download the appropriate v1.44.2 MSI package, which is the final release supporting those operating systems</li> <li data-change="fixed">Windows executable installer no longer embeds MSI packages in the executable. Instead, it automatically downloads the correct package. Users desiring the previous behavior may download the "full" executable installer at <a href="https://pkgs.tailscale.com/">pkgs.tailscale.com</a>.</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Shortcuts are added for finding and pinging devices</li> <li data-change="new"><a href="/kb/1258/mullvad-exit-nodes">Mullvad Exit Nodes</a> allows you to select nodes by country and city</li> <li data-change="fixed"><a href="/kb/1226/tailnet-lock">Tailnet lock</a> reliability improvements</li> <li data-change="fixed"><a href="/kb/1106/taildrop">Taildrop</a> no longer replaces spaces with <code>%20</code> in file names when sending files to Windows devices</li> </ul> <h6>iOS</h6> <ul> <li data-change="new"><a href="/kb/1225/fast-user-switching">Fast user switching</a> is available</li> <li data-change="new">iOS 17 supports customized device naming from <strong>Settings</strong></li> <li data-change="new">App Shortcuts in Spotlight and Siri are supported. Try saying: "<em>Hey Siri, connect to Tailscale</em>" or "<em>Hey Siri, is Tailscale connected?</em>".</li> <li data-change="new">Shortcuts are added for finding and pinging devices</li> <li data-change="new">Mullvad Exit Nodes includes an option to pick the best available node</li> <li data-change="changed">UI accessibility improvements when using VoiceOver</li> <li data-change="fixed">Taildrop no longer replaces spaces with <code>%20</code> in file names when sending files to Windows devices</li> <li data-change="fixed"><a href="/kb/1291/ios-vpn-on-demand">VPN On Demand</a> rules are no longer reset when disabled and then restarted</li> </ul> </div></div></div><div id="2023-09-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">OAuth access tokens</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Requests for <a href="/kb/1215/oauth-clients">OAuth access tokens</a> may now specify a custom set of tags instead of always inheriting the tags from the OAuth client</li> <li data-change="changed">Requesting <a href="/kb/1215/oauth-clients">OAuth access tokens</a> with invalid scopes will now fail rather than returning a token with default scopes</li> </ul> </div></div></div></div></div></article><article id="2023-09-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-09-22">Sep 22, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-09-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Kubernetes operator</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use the <a href="/kb/1236/kubernetes-operator">Tailscale Kubernetes operator</a> to expose a Kubernetes cluster to your tailnet and securely connect to the Kubernetes control plane (<a href="/kb/1167/release-stages/#alpha">alpha</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-09-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-09-18">Sep 18, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-09-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Apple TV GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/apple-tv"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Apple TV GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use an <a href="/kb/1280/appletv">Apple TV</a> to access your media server content remotely, route Apple TV traffic through an <a href="/kb/1103/exit-nodes">exit node</a>, or advertise Apple TV as an exit node</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-09-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-09-11">Sep 11, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-09-11-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.48.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Stability improvements for <a href="/kb/1258/mullvad-exit-nodes">Mullvad Exit Nodes</a>, particularly for users on IPv4-only networks</li> </ul> </div></div></div></div></div></article><article id="2023-09-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-09-07">Sep 7, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-09-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Mullvad Exit Nodes</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/mullvad-integration"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1258/mullvad-exit-nodes">Mullvad Exit Nodes</a> to have <a href="https://mullvad.net/en/why-mullvad-vpn">Mullvad VPN</a> endpoints as <a href="/kb/1103/exit-nodes/">exit nodes</a> for your Tailscale network (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new">"Enable Mullvad VPN for tailnet" and "Disable Mullvad VPN for tailnet" are logged as <a href="/kb/1203/audit-logging/#events">configuration audit logging events</a> when Mullvad Exit Nodes are <a href="/kb/1258/mullvad-exit-nodes/#enable-mullvad-exit-nodes">enabled</a> or <a href="/kb/1258/mullvad-exit-nodes/#disable-mullvad-on-a-device">disabled</a>, respectively</li> </ul> </div></div></div></div></div></article><article id="2023-08-31" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-08-31">Aug 31, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-08-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">User status changes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The <strong>Active</strong> status filter option in the <a href="https://login.tailscale.com/admin/users"><strong>Users</strong></a> page of the admin console is removed. Use the <a href="https://login.tailscale.com/admin/settings/billing"><strong>Billing</strong></a> page to track your <a href="/kb/1251/pricing-faq/#how-are-monthly-active-users-defined">active users</a> instead.</li> <li data-change="changed">The <strong>Inactive</strong> badge and status filter option in the <strong>Users</strong> page of the admin console is renamed <strong>Idle</strong></li> </ul> </div></div></div></div></div></article><article id="2023-08-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-08-21">Aug 21, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-08-21-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.48.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Fix a security vulnerability in UPnP port mapping (<a href="/security-bulletins/#ts-2023-006">TS-2023-006</a>)</li> </ul> <h6>Linux</h6> <ul> <li>Fixed: Resolve nftables interaction between Tailscale and UFW which resulted in blocking subnet routed traffic</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">Determine correct CPU architecture in <code>tailscale update</code> (<a href="https://github.com/tailscale/tailscale/issues/8927">#8927</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-08-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-08-18">Aug 18, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-08-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Sync Microsoft Entra ID groups to use in your Tailscale ACLs</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/sync-azuread-groups"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1249/sso-entra-id-scim">User & group provisioning for Microsoft Entra ID</a> (<a href="/kb/1167/release-stages/#beta">beta</a>) <ul> <li>Sync Microsoft Entra ID groups to use in your <a href="/kb/1337/acl-syntax/#provisioned-groups">Tailscale ACLs</a></li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-08-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-08-16">Aug 16, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-08-16-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.48.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#exit-node"><code>tailscale exit-node</code></a> subcommand</li> <li data-change="new"><code>--upstream</code> flag in the <a href="/kb/1080/cli/#version"><code>tailscale version</code></a> command</li> <li data-change="new">The <a href="/kb/1080/cli/#funnel"><code>tailscale funnel</code></a> command provides an interactive web UI that prompts you to allow Tailscale to enable Tailscale Funnel on your behalf</li> <li data-change="new">The <a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> command provides an interactive web UI that prompts you to allow Tailscale to enable HTTPS and Tailscale Funnel on your behalf</li> <li data-change="changed"><a href="/kb/1226/tailnet-lock/">Tailnet lock</a> is in <a href="/kb/1167/release-stages/#beta">beta</a></li> </ul> <h6>Linux</h6> <p><em>Note:</em> 1.48.0 introduced a regression in the interaction between Tailscale and Linux <code>ufw</code>. The Linux release has been withdrawn pending a fix.</p> <ul> <li data-change="new">Support for <a href="/kb/1294/firewall-mode"><code>nftables</code></a></li> <li data-change="new">RPM packages are now fully signed</li> <li data-change="new">Support for the <a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command on Alpine, Arch and Fedora distro families</li> </ul> <h6>Synology</h6> <ul> <li data-change="new">Support for the <code>tailscale update</code> command</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Support for the <code>tailscale update</code> command</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Support for <a href="/kb/1291/ios-vpn-on-demand">VPN On Demand</a></li> <li data-change="changed">VPN tunnel lifecycle improvements</li> <li data-change="changed">Improved exit node selection</li> <li data-change="changed">Minor UI tweaks</li> </ul> </div></div></div><div id="2023-08-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Funnel interactive web UI</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The Tailscale CLI now guides users through enabling <a href="/kb/1242/tailscale-serve"><code>serve</code></a> and <a href="/kb/1080/cli/#funnel"><code>funnel</code></a>.</li> </ul> </div></div></div><div id="2023-08-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming with Panther Labs GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/panther-generally-available"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Log streaming integration with <a href="https://panther.com/">Panther Labs</a> GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use Panther Labs for <a href="/kb/1255/log-streaming/">Log streaming</a></li> </ul> </li> </ul> </div></div></div><div id="2023-08-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailnet lock beta</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tailnet-lock-beta"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1226/tailnet-lock">Tailnet lock</a> is now in <a href="/kb/1167/release-stages/#beta">beta</a> <ul> <li>Use tailnet lock to require your nodes to verify node keys distributed by the <a href="/kb/1155/terminology-and-concepts/#coordination-server">coordination server</a> before trusting them</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-08-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-08-15">Aug 15, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-08-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">GitLab CI/CD support for GitLab Runner</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use the <a href="/kb/1287/tailscale-gitlab-runner">Tailscale GitLab CI/CD configuration</a> to access devices in your tailnet directly from your GitLab Runner</li> </ul> </div></div></div></div></div></article><article id="2023-08-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-08-11">Aug 11, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-08-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Machine explorer in the Tailscale VS Code extension</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/machine-explorer-vscode-extension"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">View and interact with machines on your tailnet within the <a href="/kb/1265/vscode-extension">Tailscale extension for Visual Studio Code</a>. Powered by <a href="/tailscale-ssh/">Tailscale SSH</a>, you can remotely manage files, open terminal sessions, or attach remote VS Code sessions.</li> </ul> </div></div></div></div></div></article><article id="2023-08-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-08-09">Aug 9, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-08-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming private endpoints</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1255/log-streaming/#private-endpoints">private endpoints</a> (<a href="/kb/1167/release-stages/#beta">beta</a>) in your tailnet for <a href="/kb/1255/log-streaming">log streaming</a></li> </ul> </div></div></div></div></div></article><article id="2023-07-31" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-31">Jul 31, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Additional autogroup value</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1337/acl-syntax/#autogroups">autogroup:tagged</a> to refer to all <a href="/kb/1068/acl-tags">tagged</a> nodes in a tailnet</li> </ul> </div></div></div></div></div></article><article id="2023-07-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-26">Jul 26, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-26-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.46.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Issue with <a href="/kb/1226/tailnet-lock">tailnet lock</a> signature verification</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Crash issue on ARM64</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">DNS and subnet routes issue</li> </ul> </div></div></div></div></div></article><article id="2023-07-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-25">Jul 25, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Autogroup now supports autogroup:member syntax</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Syntax for <a href="/kb/1337/acl-syntax/#autogroups">autogroups</a> now supports <code>autogroup:member</code> in addition to <code>autogroup:members</code> when referring to all users in a tailnet</li> </ul> </div></div></div></div></div></article><article id="2023-07-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-24">Jul 24, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-24-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">OAuth scopes for logs API endpoints</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The <code>logs:read</code> OAuth scope can be used to grant API access to <a href="/kb/1203/audit-logging">configuration audit logs</a></li> <li data-change="new">The <code>network-logs:read</code> OAuth scope can be used to grant API access to <a href="/kb/1219/network-flow-logs">network flow logs</a></li> </ul> </div></div></div></div></div></article><article id="2023-07-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-20">Jul 20, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">SCIM ACL validation warnings in API</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The tailnet policy file validation endpoint will now return warnings about SCIM synced groups in addition to errors in the response object. These will be the same warnings you would have seen visually in the admin console if you had tried to save that policy file. See the <a href="/kb/1180/sso-okta-scim/#updating-okta-group-names">user and group provisioning documentation</a> for more detail.</li> </ul> </div></div></div></div></div></article><article id="2023-07-19" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-19">Jul 19, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-19-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.46.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="new">Initial support for nftables-based configuration. This option is currently behind a temporary flag for testing and feedback. See <a href="https://github.com/tailscale/tailscale/issues/391">issue #391</a> for details.</li> </ul> <h6>Windows</h6> <ul> <li data-change="new"><a href="/kb/1226/tailnet-lock">Tailnet lock</a> is now supported</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Tailnet lock is now supported</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Tailnet lock is now supported</li> <li data-change="new">Onboarding flow is added for easier initial setup of the app</li> <li data-change="new">Ping devices on your tailnet from the app</li> <li data-change="changed">The app <strong>Machines</strong> page is improved</li> <li data-change="changed">The app <strong>Exit Node</strong> section is improved</li> <li data-change="changed">The app <strong>Settings</strong> page is improved</li> </ul> </div></div></div><div id="2023-07-19-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">iOS app redesign</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/reimagining-tailscale-for-ios"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The Tailscale iOS client is updated with significant design and engineering improvements</li> </ul> </div></div></div></div></div></article><article id="2023-07-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-18">Jul 18, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-18-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.44.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="fixed">Handling of custom HTTP ports in <a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a></li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Restore support for Microsoft Windows 7 and Microsoft Windows 8.x.<br/>Tailscale v1.44.2 will be the last release to support the following operating systems: Microsoft Windows 7, Microsoft Windows 8, Microsoft Windows Server 2008, and Microsoft Windows Server 2012.</li> </ul> </div></div></div></div></div></article><article id="2023-07-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-11">Jul 11, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming integration with Panther Labs</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/log-streaming-integration-panther-labs"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use Panther Labs (<a href="/kb/1167/release-stages/#beta">beta</a>) for <a href="/kb/1255/log-streaming">Log streaming</a></li> </ul> </div></div></div></div></div></article><article id="2023-07-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-10">Jul 10, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-10-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.44.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Android</h6> <ul> <li data-change="fixed">Various bugs and improvements</li> </ul> </div></div></div></div></div></article><article id="2023-07-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-07-05">Jul 5, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-07-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Terms of service and privacy policy</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/subscribe-terms"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Updated <a href="/terms">Terms of Service</a></li> <li data-change="changed">Updated <a href="/privacy-policy">Privacy Policy</a></li> </ul> </div></div></div></div></div></article><article id="2023-06-29" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-29">Jun 29, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-29-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale GitHub Action changes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The <a href="https://github.com/tailscale/github-action">Tailscale GitHub Action</a> now supports use of an <a href="/kb/1215/oauth-clients">OAuth client</a> for its node authorization. The action also supports running on ARM64 nodes.</li> </ul> </div></div></div><div id="2023-06-29-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Network flow logs GA and Log streaming GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/network-flow-logs-is-generally-available"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Network flow logs GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1219/network-flow-logs">Network flow logs</a> to understand which nodes connected to which other nodes, and when, in your tailnet</li> </ul> </li> <li data-change="changed">Log streaming GA (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use <a href="/kb/1255/log-streaming">Log streaming</a> to stream <a href="/kb/1203/audit-logging">Configuration audit logs</a> and Network flow logs to a security information and event management (<a href="/learn/security-information-and-event-management">SIEM</a>) system</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-06-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-26">Jun 26, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Nairobi DERP region</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Nairobi added as a <a href="/blog/how-tailscale-works/#encrypted-tcp-relays-derp">DERP region</a></li> </ul> </div></div></div></div></div></article><article id="2023-06-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-23">Jun 23, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Add a description to new keys and OAuth clients</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><strong>Description</strong> field is added to the <strong>Generate auth key</strong> dialog in the <a href="https://login.tailscale.com/admin/settings/keys"><strong>Keys</strong></a> page of the admin console</li> <li data-change="new"><strong>Description</strong> field is added to the <strong>Generate access token</strong> dialog in the <strong>Keys</strong> page of the admin console</li> <li data-change="new"><strong>Description</strong> field is added to the <strong>Generate OAuth client</strong> dialog in the <a href="https://login.tailscale.com/admin/settings/oauth"><strong>OAuth clients</strong></a> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2023-06-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-21">Jun 21, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-21-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.44.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>Note: This is the last release to support the following operating systems:</p> <p>• macOS 10.13 High Sierra<br/> • macOS 10.14 Mojave<br/></p> <p>Tailscale releases after 1.44.0 will no longer install on these operating systems, though we expect to maintain forward compatibility and critical security updates for 1.44.0 with future releases until at least June 30, 2024.</p> <p>To install Tailscale on a High Sierra or Mojave system, visit the Purchased Items in the App Store Account page. macOS High Sierra or Mojave systems will be offered Tailscale 1.44 when the download link is clicked. If Tailscale does not appear in the Purchased Items it must first be successfully installed using a recent macOS system. The Tailscale app will then be available for the High Sierra or Mojave system to install from Purchased Items.</p> <h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1242/tailscale-serve"><code>tailscale serve http</code></a> command to serve over HTTP (tailnet only)</li> <li data-change="new"><a href="/kb/1080/cli/#ssh"><code>tailscale ssh</code></a> command now supports remote port forwarding</li> <li data-change="new">Recursive DNS resolution is now initially supported to replace bootstrapDNS when operating in a parallel mode</li> <li data-change="changed">Build with Go 1.20.5</li> <li data-change="changed"><code>--tun-userspace-networking</code> stability improvements for userspace subnet routers</li> <li data-change="changed">MagicSock private addresses are given preference when both private and public are available, to help keep traffic in private VPCs, where possible</li> <li data-change="changed">Async support is removed from the <code>portlist</code> package. Update to use synchronous <code>Poll()</code> if this breaks your package.</li> <li data-change="changed"><code>WatchIPNBus</code> now only requires read-only permissions to read</li> <li data-change="changed"><a href="/kb/1080/cli/#cert"><code>tailscale cert</code></a> renewal decision is now based on the lifetime of the certificate instead of hard-coded. This better supports 14 day certificate lifetimes.</li> </ul> <h6>Linux</h6> <ul> <li>Changed:<code>tailscale ssh</code> support improvements for Security-Enhanced Linux (SELinux) systems</li> <li>Changed:<code>tailscale ssh</code> supports user names with up to 256 characters</li> <li data-change="changed"><code>build_dist.sh</code> better supports operating systems and CPU architectures which Tailscale release builds do not include</li> <li data-change="changed">The iputils package can now be installed on Alpine-based Docker containers</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">PreferGo supports better DNS caching</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">ICMP6 forwarding works as expected when running as a subnet router</li> </ul> <h6>FreeBSD</h6> <ul> <li data-change="fixed">ICMP6 forwarding works as expected when running as a subnet router</li> </ul> <h6>OpenBSD</h6> <ul> <li data-change="fixed">ICMP6 forwarding works as expected when running as a subnet router</li> </ul> <h6>WASI</h6> <ul> <li data-change="fixed">tsnet applications compiled to WebAssembly are now better supported</li> </ul> </div></div></div></div></div></article><article id="2023-06-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-15">Jun 15, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for QNAP</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/qnap-app-center"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The Tailscale app for <a href="/kb/1273/qnap">QNAP</a> is now available in the QNAP App Center</li> </ul> </div></div></div></div></div></article><article id="2023-06-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-14">Jun 14, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for IPv6 in tailnet policy file</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="fixed">IPv6 addresses can now be directly specified in <a href="/kb/1337/acl-syntax">ACL</a> rules and tests.</li> </ul> </div></div></div></div></div></article><article id="2023-06-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-13">Jun 13, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for Codeberg and Gitea</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Codeberg and Gitea supported as <a href="/kb/1240/sso-custom-oidc">custom OIDC providers</a></li> </ul> </div></div></div></div></div></article><article id="2023-06-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-09">Jun 9, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Edit policy groups dialog in admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1337/acl-syntax/#edit-a-users-group-membership-from-the-users-page">Edit group membership</a> in the <a href="https://login.tailscale.com/admin/users"><strong>Users</strong></a> page of the admin console</li> </ul> </div></div></div><div id="2023-06-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Custom OIDC setup option for user auth page prompt</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Setup for <a href="/kb/1240/sso-custom-oidc">custom OIDC providers</a> provides the option for specifying a prompt (<code>none</code>, <code>consent</code>, <code>login</code>, <code>select_account</code>) for the user authentication page. <em>If your tailnet was already using a custom OIDC provider, we updated your setup automatically to use <code>consent</code>, which prior to today was the only supported value.</em></li> </ul> </div></div></div><div id="2023-06-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for Ping Identity</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Ping Identity is now available as a <a href="/kb/1240/sso-custom-oidc">custom OIDC provider</a></li> </ul> </div></div></div></div></div></article><article id="2023-06-06" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-06-06">Jun 6, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-06-06-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailnet lock login change for expired nodes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li>Changed: When logging in to a node that has an expired key in a tailnet that has enabled <a href="/kb/1226/tailnet-lock">Tailnet lock</a>, an error message is returned, directing you to <a href="/kb/1272/reauth-under-tailnet-lock">reauthenticate</a> instead of logging in, or to delete the machine from within the admin console before logging in again</li> </ul> </div></div></div></div></div></article><article id="2023-05-31" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-31">May 31, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Invite any user to a tailnet</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/invite-any-user"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1271/invite-any-user">Invite any user</a> to your tailnet with a URL invitation (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new">"User joined external tailnet" is logged as a <a href="/kb/1203/audit-logging/#events">configuration audit logging event</a> when a user in your tailnet joins <a href="/kb/1271/invite-any-user">another tailnet</a></li> </ul> </div></div></div><div id="2023-05-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Leave an external tailnet</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The <strong>Leave tailnet</strong> option has been added to the Tailscale login page (<a href="https://login.tailscale.com">https://login.tailscale.com</a>)</li> <li data-change="new">The <strong>Leave tailnet</strong> menu option has been added to the <a href="https://login.tailscale.com/admin/users/"><strong>Users</strong></a> page of the admin console for the selected user</li> <li data-change="new">"User left external tailnet" is logged as a <a href="/kb/1203/audit-logging/#events">configuration audit logging event</a> when a user in your tailnet leaves <a href="/kb/1271/invite-any-user/">another tailnet</a></li> </ul> </div></div></div><div id="2023-05-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for passkeys</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/passkeys"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use a <a href="/kb/1269/passkeys">passkey</a> to authenticate to a tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="new"><strong>Sign in with passkey</strong> option is added to the Tailscale login page (https://login.tailscale.com)</li> </ul> </div></div></div><div id="2023-05-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale extension for Visual Studio Code</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tailscale-vscode"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use the <a href="/kb/1265/vscode-extension">Tailscale extension for Visual Studio Code</a> to interact with resources in your tailnet from within the VS Code IDE (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-05-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-25">May 25, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailnet lock UI changes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Manage <a href="/kb/1226/tailnet-lock">tailnet lock</a> from the <a href="https://login.tailscale.com/admin/settings/device-management"><strong>Device management</strong></a> page of the admin console, when enabled</li> <li data-change="changed">Improved UI for tailnet lock settings in the <a href="https://login.tailscale.com/admin/machines/"><strong>Machines</strong></a> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2023-05-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-24">May 24, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-24-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.42.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><p>Note: This is the last release to support the following operating systems:</p> <p>• Microsoft Windows 7<br/> • Microsoft Windows 8<br/> • Microsoft Windows Server 2008<br/> • Microsoft Windows Server 2012<br/></p> <p>Tailscale releases after 1.42.0 will no longer install on these operating systems, though we expect to maintain forward compatibility and critical security updates for 1.42.0 with future releases until at least May 31, 2024.</p> <p>Note: Do not install this version of the Tailscale client on macOS 10.13. Upgrade to version 1.44.0 instead.</p> <h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1242/tailscale-serve/"><code>tailscale serve reset</code></a> command to clear out the current serve configuration</li> <li>Changed: Update internal DNS handling to better support mixtures of global and private DNS servers</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">SSH login on platforms which lack <code>getent</code></li> </ul> <h6>Windows</h6> <p><em>Note: This release switches to a new application signing certificate, which is valid through 2025.</em><br/></p> <ul> <li data-change="changed">Notification icons are updated</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">Update Sparkle to check more regularly</li> <li data-change="fixed">Taildrop delivery of incomplete files</li> </ul> <h6>iOS</h6> <ul> <li data-change="new"><strong>Delete Account</strong> button to redirect to the admin panel</li> <li data-change="changed">Better handle memory management to avoid hitting 50 MByte memory limit</li> </ul> <h6>Unraid</h6> <ul> <li data-change="new">Support Unraid as a NAS platform similar to how Synology and QNAP are handled</li> </ul> <h6>Kubernetes</h6> <ul> <li data-change="new">Support for <code>priorityClassName</code></li> </ul> </div></div></div></div></div></article><article id="2023-05-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-22">May 22, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL tags are lowercased</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="fixed"><a href="/kb/1068/acl-tags">ACL tags</a> for auth keys created via API are lowercased</li> </ul> </div></div></div><div id="2023-05-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Custom OIDC GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/custom-oidc-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1240/sso-custom-oidc">Custom OIDC providers</a> (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use a custom OIDC provider for authentication to your tailnet</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-05-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-16">May 16, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Discord and Mattermost supported as webhook destinations</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1213/webhooks">Webhook</a> events are available in formats for Discord and Mattermost</li> </ul> </div></div></div></div></div></article><article id="2023-05-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-11">May 11, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">SSH session recording</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/session-recording-beta"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1246/tailscale-ssh-session-recording">Tailscale SSH session recording</a> to stream Tailscale SSH session logs to a designated node in your tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-05-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-10">May 10, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-10-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.40.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="new"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> is now supported for LDAP users</li> <li data-change="fixed">Support for Tailscale SSH session recording to a local file is restored</li> <li data-change="fixed">Debian and RPM packages for MIPS architecture generate as expected</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Notification icons are updated</li> <li data-change="fixed">The 32-bit <a href="/kb/1022/install-windows">Windows installer</a> for the Tailscale client works as expected</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed"><a href="/kb/1080/cli/#cert"><code>tailscale cert</code></a> command no longer causes timeout failures</li> </ul> <h6>Kubernetes</h6> <ul> <li data-change="fixed">The Tailscale version displays in the startup logs</li> </ul> </div></div></div></div></div></article><article id="2023-05-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-05">May 5, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Support for Authelia</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Authelia is now available as a <a href="/kb/1240/sso-custom-oidc">custom OIDC provider</a> (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-05-04" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-05-04">May 4, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-05-04-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Sign in with Apple</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/sign-in-with-apple"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Apple is now available as a <a href="/kb/1013/sso-providers">supported SSO identity provider</a>, for <a href="/pricing">all plans</a></li> </ul> </div></div></div></div></div></article><article id="2023-04-28" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-28">Apr 28, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-28-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Search Domains</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1054/dns/#search-domains">Search Domains</a> to configure DNS for accessing network resources without having to specify the full domain path (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-04-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-27">Apr 27, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Audit log events for Log streaming</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">"Create logstream endpoint for tailnet", "Update logstream endpoint for tailnet", and "Delete logstream endpoint for tailnet" are logged as <a href="/kb/1203/audit-logging/#events">configuration audit logging events</a> for <a href="/kb/1255/log-streaming">Log streaming</a></li> </ul> </div></div></div><div id="2023-04-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Log streaming</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/network-flow-logs"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1255/log-streaming">Log streaming</a> to stream <a href="/kb/1203/audit-logging">configuration audit logs</a> and <a href="/kb/1219/network-flow-logs">network flow logs</a> to a security information and event management (<a href="/learn/security-information-and-event-management/">SIEM</a>) system (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-04-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-26">Apr 26, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-26-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.40.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="changed"><a href="/kb/1241/tailscale-up"><code>tailscale up --force-reauth</code></a> will now display a warning and 5 second countdown if you are connected over SSH over Tailscale, unless <code>--accept-risk=lose-ssh</code> is also given</li> <li data-change="changed">Tailscale now dynamically increases the buffer size for DERP relay messages based on the amount of available RAM (<a href="https://github.com/tailscale/tailscale/pull/7776">#7776</a>)</li> <li data-change="changed">Improvements were made to how Tailscale advertises available endpoints to reduce the likelihood of a spurious loss of direct connections (<a href="https://github.com/tailscale/tailscale/pull/7877">#7877</a>)</li> </ul> <h6>Linux</h6> <ul> <li data-change="changed">Substantially higher throughput—for details, see <a href="/blog/more-throughput">Surpassing 10Gb/s over Tailscale</a></li> <li data-change="changed">Improved CPU consumption on systems with a very large (1M+) routing table</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Redo migration of pre-<a href="/kb/1225/fast-user-switching">Fast-User-Switching</a> state for better robustness</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">"Settings" replaces "Preferences" as a menu item on macOS Ventura</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Added intents <code>com.tailscale.ipn.CONNECT_VPN</code> and <code>com.tailscale.ipn.DISCONNECT_VPN</code></li> </ul> <h6>gokrazy</h6> <ul> <li data-change="new"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> now works</li> </ul> <h6>QNAP</h6> <ul> <li data-change="fixed">UI failure after reboot</li> </ul> </div></div></div></div></div></article><article id="2023-04-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-24">Apr 24, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-24-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Machines page updates</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page of the admin console has been updated to use <strong>Version</strong> as a column heading instead of <strong>OS</strong>, and to show the Tailscale <a href="/kb/1168/versions">client version</a> prior to the operating system name</li> </ul> </div></div></div></div></div></article><article id="2023-04-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-21">Apr 21, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Audit log events for approved node routes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">"Update auto approved routes for node" is logged as a <a href="/kb/1203/audit-logging/#events">configuration audit logging event</a> for <a href="/kb/1019/subnets">routes</a> advertised by the node that are updated using <a href="/kb/1337/acl-syntax/#autogroups">autogroups</a></li> <li data-change="changed">"Update approved routes for node" replaces "Update advertised routes for node" in Configuration audit logging events</li> </ul> </div></div></div><div id="2023-04-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Webhook event when a node is deleted</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><code>nodeDeleted</code> <a href="/kb/1213/webhooks">webhook</a> event is now generated when a node is removed from the tailnet, including automatic removal of <a href="/kb/1111/ephemeral-nodes">ephemeral nodes</a></li> </ul> </div></div></div></div></div></article><article id="2023-04-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-20">Apr 20, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">GitOps for Tailscale ACLs with GitLab CI</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://gitlab.com/tailscale-dev/gitops-acl-ci">Sync Tailscale ACLs</a> GitLab CI Template to <a href="/kb/1254/gitops-acls-gitlab">keep your tailnet policy file in GitLab</a>, and automatically run tests and push changes to Tailscale</li> </ul> </div></div></div></div></div></article><article id="2023-04-19" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-19">Apr 19, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-19-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Additional autogroup values</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><code>autogroup:billing-admin</code> and <code>autogroup:auditor</code> added as <a href="/kb/1337/acl-syntax/#autogroups">autogroups</a></li> </ul> </div></div></div></div></div></article><article id="2023-04-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-18">Apr 18, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Audit log events for Network flow logs</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">"Enable network flow logging for tailnet" and "Disable network flow logging for tailnet" are logged as <a href="/kb/1203/audit-logging/#events">Configuration audit logging events</a> for <a href="/kb/1219/network-flow-logs">Network flow logs</a></li> </ul> </div></div></div><div id="2023-04-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Billing page updates</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The <a href="https://login.tailscale.com/admin/settings/billing"><strong>Billing</strong></a> page of the admin console is updated to show new Tailscale <a href="/pricing">pricing</a> plans and a tailnet's monthly active users</li> </ul> </div></div></div><div id="2023-04-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Network flow logs</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/network-flow-logs"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1219/network-flow-logs">Network flow logs</a> to understand which nodes connected to which other nodes, and when, in your tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div><div id="2023-04-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Additional custom OIDC providers</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/custom-oidc-enterprise"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Auth0, Authentik, Dex, Duo, GitLab, JumpCloud, Keycloak, Ory, and ZITADEL are now available as <a href="/kb/1240/sso-custom-oidc">custom OIDC providers</a> (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div><div id="2023-04-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Updated pricing plans</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/pricing-v3"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The available <a href="/pricing">pricing plans</a> are Free, Starter, Premium, and Enterprise. <a href="/kb/1154/free-plans-discounts/#community-on-github">Community on GitHub</a> projects remain free, and discounts remain available for <a href="/kb/1154/free-plans-discounts#charities-not-for-profit-organizations-and-educational-institutions">charities, not-for-profit organizations, and educational institutions</a>. If you want, you can keep your old plan until <em>at least</em> April 30, 2024.</li> <li data-change="changed">The Free plan has three free users</li> <li data-change="changed">All plans only pay for incremental usage above three users</li> </ul> </div></div></div></div></div></article><article id="2023-04-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-07">Apr 7, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">New autogroup values</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><code>autogroup:admin</code>, <code>autogroup:it-admin</code>, <code>autogroup:network-admin</code>, and <code>autogroup:owner</code> added as <a href="/kb/1337/acl-syntax/#autogroups">autogroups</a></li> </ul> </div></div></div></div></div></article><article id="2023-04-06" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-06">Apr 6, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-06-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Machine address copy card</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Click on a machine's IP address in the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page of the admin console to display a machine address copy card. Within the machine address card, click to copy the MagicDNS name, IPV4 address, or IPV6 address of the machine to your clipboard.</li> </ul> </div></div></div></div></div></article><article id="2023-04-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-05">Apr 5, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-05-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.38.4</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="changed">Build with Go 1.20.3 to address security fixes (<a href="https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8">CVE-2023-24537, CVE-2023-24538, CVE-2023-24534, and CVE-2023-24536</a>). These address potential DoS attacks against DNS over HTTPS and Funnel that can occur over the public internet, and PeerAPI attacks launched from other nodes already on the tailnet.</li> <li data-change="changed">Added path support for proxy targets with <a href="/kb/1080/cli/#serve"><code>tailscale serve</code></a></li> <li data-change="fixed">Error displays when trying to use <a href="/kb/1223/tailscale-funnel">Funnel</a> and <a href="/kb/1241/tailscale-up"><code>tailscale up --shields-up</code></a> simultaneously</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">When connected to a Windows 10 client using <a href="/kb/1095/secure-rdp-windows">Windows RDP</a>, the Tailscale taskbar right-click option for the remote client works as expected (<a href="https://github.com/tailscale/tailscale/issues/7698">#7698</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-04-04" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-04-04">Apr 4, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-04-04-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Audit log events for Member users</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">"Log in using the web interface" and "Log out using the web interface" are logged as <a href="/kb/1203/audit-logging/#events">Configuration audit logging events</a> for the <a href="/kb/1138/user-roles/#member">Member</a> user role. These events differentiate logins from users with access to the admin console.</li> </ul> </div></div></div></div></div></article><article id="2023-03-31" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-31">Mar 31, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-31-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailnet lock works for additional scenarios</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1226/tailnet-lock">Tailnet lock</a> works with <a href="/kb/1084/sharing">shared nodes</a> and <a href="/kb/1216/tailscale-ssh-console">Tailscale SSH console</a></li> </ul> </div></div></div></div></div></article><article id="2023-03-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-30">Mar 30, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Funnel Beta</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tailscale-funnel-beta"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1223/tailscale-funnel">Tailscale Funnel</a> (<a href="/kb/1167/release-stages/#beta">beta</a>) <ul> <li>Route traffic from the wider internet to one or more of your Tailscale nodes.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-03-29" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-29">Mar 29, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-29-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.38.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new">Support for stripping HTTP request paths from Funnel proxy routes (<a href="https://github.com/tailscale/tailscale/issues/6571">#6571</a>)</li> <li data-change="changed"><a href="/kb/1223/tailscale-funnel">Tailscale Funnel</a> is now <a href="/kb/1167/release-stages/#beta">beta</a></li> <li data-change="fixed"><a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> issue that did not use actual <code>SrcAddr</code> as <code>X-Forwarded-For</code></li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Certificate storage issue that did not actually use Kubernetes secrets</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Upgraded the Walk framework for the GUI client to improve menu responsiveness</li> </ul> </div></div></div></div></div></article><article id="2023-03-28" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-28">Mar 28, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-28-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Invite teams</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/invite-users"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1064/invite-team-members">Invite multiple users at once and administer invites</a> from the <a href="https://login.tailscale.com/admin/users"><strong>Users</strong></a> page of the admin console</li> <li data-change="new">"Invite user to join tailnet" is logged as a <a href="/kb/1203/audit-logging/#events">Configuration audit logging event</a></li> </ul> </div></div></div></div></div></article><article id="2023-03-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-27">Mar 27, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Sales tax collected where required</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1182/billing-information/#sales-tax">Tailscale collects sales tax</a> for jurisdictions that require it, except for organizations with tax exempt status</li> </ul> </div></div></div><div id="2023-03-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Custom OIDC providers</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/custom-oidc"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use a <a href="/kb/1240/sso-custom-oidc">custom OIDC provider</a> for authentication to your tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-03-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-22">Mar 22, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-22-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.38.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="changed"><code>tailscale lock tskey-wrap</code> has been replaced by <a href="/kb/1243/tailscale-lock/#lock-sign"><code>tailscale lock sign</code></a></li> <li data-change="changed"><code>tailscale lock sign</code> now supports signing auth keys</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed"><code>--tun=userspace-networking</code> issue running in <a href="/kb/1126/azure-app-service">Azure App Services</a></li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Sparkle automatically checks <a href="https://pkgs.tailscale.com/stable/#macos">updates for the standalone package</a>. This does not impact the App Store package.</li> </ul> <h6>FreeBSD</h6> <ul> <li>Fixed: Issue setting the effective group ID on some non-interactive Tailscale SSH sessions. This issue is specific to FreeBSD's implementation of <code>setgroups</code> and does not impact other platforms.</li> </ul> </div></div></div></div></div></article><article id="2023-03-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-17">Mar 17, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Multi-use invite links</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Create multi-use invite links in the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page of the admin console, for <a href="/kb/1084/sharing">sharing nodes</a></li> </ul> </div></div></div></div></div></article><article id="2023-03-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-14">Mar 14, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-14-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.38.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All platforms</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#configure"><code>tailscale configure</code></a> command to configure resources that you want to include in your tailnet</li> <li data-change="new"><a href="/kb/1243/tailscale-lock/#lock-sign"><code>tailscale lock sign</code></a> to sign <a href="/kb/1085/auth-keys">pre-approved auth keys</a> for use with <a href="/kb/1226/tailnet-lock">tailnet lock</a></li> <li data-change="new"><code>tailscale debug derp</code> command to help diagnose DERP-related difficulty</li> <li data-change="new"><code>tailscale debug capture</code> command to write packet capturing for debugging</li> <li data-change="changed">The <code>tailscale debug portmap</code> command replaces <code>tailscaled debug -portmap</code>. This is now available on platforms without a <code>tailscaled</code> binary (like the macOS App Store).</li> <li data-change="changed"><a href="/kb/1242/tailscale-serve"><code>tailscale serve</code></a> command has been overhauled</li> <li data-change="changed"><code>tailscale serve funnel</code> has been made into its own command, <a href="/kb/1080/cli#funnel">tailscale funnel</a></li> <li data-change="fixed">Several improvements to UPnP port mapping have been made that allow it to work with a broader set of home routers</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">Certificates can be stored in Kubernetes secret storage</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">MSI installers start the GUI without user interaction to allow remote upgrades</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Notification upon node key expiration (only on macOS 10.14 and later)</li> <li data-change="new"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> server component is available for macOS open source <a href="https://github.com/tailscale/tailscale/wiki/Tailscaled-on-macOS">Tailscale + tailscaled CLI devices</a></li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Support for alternate control servers by setting the URL in Settings page of the admin console</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">Chromecast support while Tailscale is active</li> </ul> <p><em>Note: v1.38.0 was never released.</em></p> </div></div></div></div></div></article><article id="2023-03-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-10">Mar 10, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">User approval</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1239/user-approval">user approval</a> to require an admin to approve a user before they can join a tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li>New: Enable user approval for tailnet, Disable user approval for tailnet, and Approve user actions are logged as <a href="/kb/1203/audit-logging/#events">Configuration audit logging events</a></li> <li data-change="new"><code>userNeedsApproval</code> and <code>userApproved</code> events are available as <a href="/kb/1213/webhooks/#events">webhook events</a></li> </ul> </div></div></div></div></div></article><article id="2023-03-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-09">Mar 9, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Settings page is reorganized</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://login.tailscale.com/admin/settings/device-management"><strong>Device management</strong></a> section is added to the <a href="https://login.tailscale.com/admin/settings/general"><strong>Settings</strong></a> page of the admin console</li> <li data-change="new"><a href="https://login.tailscale.com/admin/settings/user-management"><strong>User management</strong></a> section is added to the <a href="https://login.tailscale.com/admin/settings/general"><strong>Settings</strong></a> page of the admin console</li> <li data-change="changed"><strong>Feature Previews</strong> section is removed from the <a href="https://login.tailscale.com/admin/settings/general"><strong>Settings</strong></a> page of the admin console. All feature previews are now located in the <a href="https://login.tailscale.com/admin/settings/general"><strong>General</strong></a> page.</li> <li data-change="changed"><strong>Identity Provider</strong> and <strong>User & Group Provisioning</strong> options are moved from the <a href="https://login.tailscale.com/admin/settings/general"><strong>General</strong></a> page to the <a href="https://login.tailscale.com/admin/settings/user-management"><strong>User management</strong></a> page of the admin console</li> <li data-change="changed"><strong>Device Approval</strong> and <strong>Key Expiry</strong> options are moved from the <a href="https://login.tailscale.com/admin/settings/general"><strong>General</strong></a> page to the <a href="https://login.tailscale.com/admin/settings/device-management"><strong>Device management</strong></a> page of the admin console</li> <li data-change="changed"><strong>Billing</strong> drop-down option for logged in users is removed from the admin console. Use the <strong>Billing</strong> section in the <a href="https://login.tailscale.com/admin/settings/general"><strong>General</strong></a> page instead.</li> </ul> </div></div></div></div></div></article><article id="2023-03-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-03-08">Mar 8, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-03-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale extension for Docker Desktop GA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1184/docker-desktop">Docker Desktop extension</a> (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Use the Tailscale extension for Docker Desktop to securely connect to the resources you need for development</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-02-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-02-27">Feb 27, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-02-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Webhook event when a user role is updated</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><code>userRoleUpdated</code> <a href="/kb/1213/webhooks">webhook</a> event is now generated when a user role is <a href="/kb/1171/changing-user-roles">changed</a></li> </ul> </div></div></div></div></div></article><article id="2023-02-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-02-22">Feb 22, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-02-22-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.36.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>macOS</h6> <ul> <li data-change="fixed">Prevent using an exit node while being an exit node</li> <li data-change="fixed">Improve detection of default interface</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Improve detection of default interface</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Improve clean out of registry entries during upgrade</li> </ul> </div></div></div><div id="2023-02-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Billing admin</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/billing-admin"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1138/user-roles/#billing-admin">Billing admin</a> role to manage pricing plan and billing information, but not modify other tailnet settings</li> <li data-change="changed">All users with the <a href="/kb/1138/user-roles/#admin">Admin</a> role can manage pricing plan and billing information</li> <li data-change="changed"><a href="/kb/1203/audit-logging">Configuration audit logging</a> no longer includes "Update billing owner for tailnet" events. Changes to Billing admin roles are included in "Update role for user" events</li> </ul> </div></div></div></div></div></article><article id="2023-02-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-02-21">Feb 21, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-02-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Webhook events when a webhook is updated or deleted</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><code>webhookUpdated</code> and <code>webhookDeleted</code> events are now generated when a <a href="/kb/1213/webhooks">webhook</a> is updated or deleted. These events are subscribed by default and cannot be disabled.</li> </ul> </div></div></div></div></div></article><article id="2023-02-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-02-13">Feb 13, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-02-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Device authorization is now called Device approval</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">"<a href="/kb/1099/device-approval">Device approval</a>" replaces "Device authorization" as the name of the feature in the <a href="https://login.tailscale.com/admin/settings/general"><strong>General</strong></a> settings page of the admin console</li> <li data-change="changed">"<a href="/kb/1176/filter-devices/#filter-by-disabled">Needs approval</a>" replaces "Needs authorization" in the <a href="https://login.tailscale.com/admin/machines?q=disabled%3Aneeds-approval"><strong>Disabled</strong></a> filter of the <a href="https://login.tailscale.com/admin/machines"><strong>Machines</strong></a> page</li> <li data-change="changed">"<a href="/kb/1085/auth-keys/#types-of-auth-keys">Pre-approved</a>" replaces "Pre-authorized" in the <strong>Generate auth key</strong> dialog of the <a href="https://login.tailscale.com/admin/settings/keys"><strong>Keys</strong></a> page</li> <li data-change="changed">"nodeApproved" replaces "nodeAuthorized" in <a href="/kb/1213/webhooks/#events">webhook events</a></li> <li data-change="changed">"nodeNeedsApproval" replaces "nodeNeedsAuthorization" in webhook events</li> <li data-change="changed">"Enable device approval for tailnet" replaces "Enable device authorization for tailnet" in <a href="/kb/1203/audit-logging/#events">Configuration audit logging events</a></li> <li data-change="changed">"Disable device approval for tailnet" replaces "Disable device authorization for tailnet" in Configuration audit logging events</li> <li data-change="changed">"Approve node" replaces "Authorize node" in Configuration audit logging events</li> </ul> </div></div></div></div></div></article><article id="2023-02-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-02-10">Feb 10, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-02-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Webhook event when a user is created</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1213/webhooks/#events">userCreated event</a> in the Tailnet management category when a user is created</li> </ul> </div></div></div></div></div></article><article id="2023-02-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-02-08">Feb 8, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-02-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">get-authkey utility</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Generate auth keys to <code>stdout</code> for scripting with <a href="/kb/1215/oauth-clients/#get-authkey-utility"><code>get-authkey</code> utility</a></li> </ul> </div></div></div><div id="2023-02-08-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.36.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Potential infinite loop when node key expires</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Handle starting the app before network interfaces are ready</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Handle starting the app before network interfaces are ready</li> <li data-change="fixed">Get Status intent will not connect the VPN</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Potential crash in netstat handling</li> <li data-change="fixed">Windows 7 checks for KB2533623</li> </ul> </div></div></div></div></div></article><article id="2023-01-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-30">Jan 30, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Configuration audit logging GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/config-audit-logging-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1203/audit-logging">Configuration audit logging</a> (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Identify who did what, and when, in your tailnet</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2023-01-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-27">Jan 27, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Feature invite logs no longer include acceptor</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Accept invite for feature events in <a href="/kb/1203/audit-logging">configuration audit logs</a> no longer include the acceptor in the sharer's logs</li> </ul> </div></div></div></div></div></article><article id="2023-01-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-26">Jan 26, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">OAuth clients</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/oauth"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1215/oauth-clients">OAuth clients</a> to provide delegated fine-grained access to the <a href="/kb/1101/api">Tailscale API</a> (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2023-01-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-25">Jan 25, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale actions for iOS and macOS Shortcuts</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/ios-macos-shortcuts"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1233/mac-ios-shortcuts">Automate tasks</a> with Tailscale actions for iOS and macOS Shortcuts</li> </ul> </div></div></div></div></div></article><article id="2023-01-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-24">Jan 24, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-24-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.36</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new"><code>--json</code> flag for the <a href="/kb/1243/tailscale-lock/#lock-status"><code>tailscale lock status</code></a> and <a href="/kb/1243/tailscale-lock/#lock-log"><code>tailscale lock log</code></a> commands</li> <li data-change="new"><code>--json</code> flag for the <a href="/kb/1080/cli/#version"><code>tailscale version</code></a> command</li> <li data-change="new"><a href="/kb/1080/cli/#update"><code>tailscale update</code></a> command to update client</li> <li data-change="new"><code>tailscale debug daemon-logs</code> to watch server logs</li> <li data-change="changed"><a href="/kb/1080/cli/#status"><code>tailscale status --json</code></a> now includes <code>KeyExpiry</code> time and <code>Expired</code> boolean on nodes</li> <li data-change="changed"><a href="/kb/1080/cli/#version"><code>tailscale version</code></a> now advertises when you're on the <a href="/kb/1083/install-unstable">unstable</a> (dev) track</li> <li data-change="changed">(Unix platforms) When <code>/etc/resolv.conf</code> needs to be overwritten for lack of options, a comment in the file now links to <a href="https://tailscale.com/s/resolvconf-overwrite">https://tailscale.com/s/resolvconf-overwrite</a></li> <li data-change="fixed"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a>: SSH to <code>tailscaled</code> as a non-root user works again, as long as you only SSH to the same user that <code>tailscaled</code> is running as</li> <li>Fixed: Handle cases where a node expires and we don't receive an update about it from the control server (<a href="https://github.com/tailscale/tailscale/issues/6929">#6929</a> and <a href="https://github.com/tailscale/tailscale/issues/6937">#6937</a>)</li> <li>Fixed: Support UPnP port mapping of gateway devices where they are deployed as a highly available pair (<a href="https://github.com/tailscale/tailscale/issues/6946">#6946</a>)</li> <li data-change="fixed">Support arbitrary IP protocols like EOIP and GRE (<a href="https://github.com/tailscale/tailscale/issues/6423">#6423</a>)</li> <li data-change="fixed">Exit node handling of a large number of split DNS domains (<a href="https://github.com/tailscale/tailscale/issues/6875">#6875</a>)</li> <li data-change="fixed">Accept DNS-over-TCP responses up to 4K bytes (<a href="https://github.com/tailscale/tailscale/pull/6805">#6805</a>)</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">Add build support for Loongnix CPU architecture</li> <li data-change="changed"><a href="/blog/throughput-improvements">Improved throughput performance</a> on Linux (<a href="https://github.com/tailscale/tailscale/issues/6663">#6663</a>)</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Tailscale actions (connect, disconnect, switch profile, use exit node) are available in the Shortcuts app (read the <a href="/blog/ios-macos-shortcuts">blog post</a>)</li> <li data-change="fixed">Tailscale traffic looping upon certain sleep/resume/Wi-Fi change transitions (<a href="https://github.com/tailscale/tailscale/issues/5156">#5156</a>)</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Tailscale actions (connect, disconnect, use exit node) are available in the Shortcuts app</li> <li data-change="fixed">Tailscale using cellular data even after Wi-Fi becomes available (<a href="https://github.com/tailscale/tailscale/issues/6565">#6565</a>)</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Add a more robust mechanism to remove WinTun (<a href="https://github.com/tailscale/tailscale/issues/6433">#6433</a>)</li> <li data-change="changed">Update taskbar menu radio button implementation</li> </ul> <h6>Android</h6> <ul> <li data-change="changed">New version of the Gio UI library with internationalization and accessibility fixes</li> <li data-change="changed">Allow Sonos app to discover local devices while Tailscale is connected</li> </ul> <h6>Synology</h6> <ul> <li data-change="new">Show whether outgoing connections are configured in the web UI</li> </ul> <h6>Containers</h6> <ul> <li data-change="new">Run in a Kubernetes environment without setting <code>TS_KUBE_SECRET</code> (<a href="https://github.com/tailscale/tailscale/issues/6704">#6704</a>)</li> </ul> <h6>OpenBSD</h6> <ul> <li data-change="new"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> runs on OpenBSD</li> </ul> </div></div></div></div></div></article><article id="2023-01-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-20">Jan 20, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Login page interstitial to confirm node authentication</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The Tailscale login page (<a href="https://login.tailscale.com"><code>https://login.tailscale.com</code></a>) describes the action taking place, such as adding a new device or authorizing SSH access. For some actions, like adding a new node, a second redirection page will be used as a confirmation step.</li> </ul> </div></div></div><div id="2023-01-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Self-request access to Tailscale Funnel</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">UI functionality to <a href="/kb/1222/invite-only-feature/#joining-a-feature-invitation-waitlist">request access</a> to <a href="/kb/1223/tailscale-funnel">Tailscale Funnel</a></li> </ul> </div></div></div></div></div></article><article id="2023-01-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-18">Jan 18, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Functionality to delete the beta.tailscale.net nameserver</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">UI functionality to <a href="/kb/1081/magicdns/#removing-the-betatailscalenet-nameserver">delete the legacy <code>beta.tailscale.net</code> nameserver</a> if you are no longer using it</li> </ul> </div></div></div></div></div></article><article id="2023-01-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-17">Jan 17, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Scoop</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Available as an application in <a href="https://scoop.sh">Scoop</a> in <a href="https://github.com/ScoopInstaller/Extras/blob/master/bucket/tailscale.json">Extras bucket</a></li> </ul> </div></div></div></div></div></article><article id="2023-01-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-12">Jan 12, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Terms of service, privacy policy, and DPA</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Updated <a href="/terms">Terms of service</a></li> <li data-change="changed">Updated <a href="/privacy-policy">Privacy policy</a></li> <li data-change="new"><a href="/dpa">Data Privacy Addendum</a> and <a href="/dpa-subprocessors">list of subprocessors</a></li> </ul> </div></div></div></div></div></article><article id="2023-01-04" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-04">Jan 4, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-04-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.34.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="fixed">Handling of a very large number of SplitDNS domains with an exit node</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">UI glitch with macOS 10.14 and 10.13</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Custom server URL from registry key support</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">Crashes manifesting on ARM-based platforms and models with very old kernels</li> </ul> </div></div></div></div></div></article><article id="2023-01-03" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2023-01-03">Jan 3, 2023</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2023-01-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Dev container feature</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Access your tailnet from GitHub Codespaces <a href="/kb/1160/github-codespaces/#integration">using Tailscale as a feature in a dev container</a> (Thanks <a href="https://github.com/zombiezen">Ross Light</a>!)</li> </ul> </div></div></div></div></div></article><article id="2022-12-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-12-16">Dec 16, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-12-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">User & group provisioning for Okta GA</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/sync-okta-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1180/sso-okta-scim">User & group provisioning for Okta</a> (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Sync Okta groups to use in your Tailscale ACLs</li> </ul> </li> <li data-change="new"><code>nodeID</code> included in all node-related <a href="/kb/1213/webhooks">webhook</a> event payloads</li> </ul> </div></div></div></div></div></article><article id="2022-12-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-12-14">Dec 14, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-12-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailnet lock</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tailnet-lock"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1226/tailnet-lock">tailnet lock</a> to require your nodes to verify node keys distributed by the <a href="/kb/1155/terminology-and-concepts/#coordination-server">coordination server</a> before trusting them (<a href="/kb/1167/release-stages/#alpha">alpha</a>)</li> </ul> </div></div></div></div></div></article><article id="2022-12-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-12-13">Dec 13, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-12-13-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.34.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="fixed">Unit tests on systems using <code>busybox ip</code></li> <li data-change="fixed">Regression handling <code>TS_STATE_DIR</code> in containerboot</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Issue which could fail to save the key for <a href="/kb/1080/cli/#serve"><code>tailscale serve</code></a> (<a href="https://github.com/tailscale/tailscale/issues/6409">#6409</a>)</li> <li data-change="fixed">Issue which could cause crash when interfaces change (<a href="https://github.com/tailscale/tailscale/issues/6641">#6641</a>)</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Common cause of an issue with <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> (<a href="https://github.com/tailscale/tailscale/issues/6639">#6639</a>)</li> </ul> </div></div></div></div></div></article><article id="2022-12-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-12-07">Dec 7, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-12-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Export list of devices and users in your tailnet</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use the admin console to <a href="/kb/1228/export-device-list">export a list of devices</a> and <a href="/kb/1229/export-user-list">export a list of users</a> in your tailnet</li> </ul> </div></div></div></div></div></article><article id="2022-12-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-12-05">Dec 5, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-12-05-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.34</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new"><a href="/kb/1080/cli/#switch"><code>tailscale switch</code></a> command to switch between accounts using <a href="/blog/fast-user-switching">fast user switching</a></li> <li data-change="new"><a href="/kb/1080/cli/#login"><code>tailscale login</code></a> command to <a href="/kb/1225/fast-user-switching">login with a specified account</a></li> <li data-change="new"><a href="/kb/1080/cli/#set"><code>tailscale set</code></a> command to modify configuration settings without needing to repeat the others</li> <li data-change="new"><a href="/kb/1243/tailscale-lock"><code>tailscale lock</code></a> command to manage <a href="/kb/1226/tailnet-lock">tailnet lock</a> for your tailnet</li> <li data-change="new">Additional <a href="/kb/1201/4via6-subnets/#magicdns-name-for-the-ipv4-subnet-devices">4via6 DNS name</a> format, <code>Q-R-S-T-via-X</code> (or <code>Q-R-S-T-via-X.yak-bebop.ts.net</code>), for systems that required dashes instead of dots</li> <li data-change="changed">Display decoded punycode hostnames in status list</li> <li data-change="changed">Warn in <a href="/kb/1080/cli/#status"><code>tailscale status</code></a> health and <a href="/kb/1241/tailscale-up"><code>tailscale up</code></a> if there are nodes advertising routes but <code>--accept-routes=false</code></li> </ul> <h6>Linux</h6> <ul> <li data-change="new">Add <a href="/kb/1225/fast-user-switching">fast user switching</a> using <a href="/kb/1080/cli/#login"><code>tailscale login</code></a> and <a href="/kb/1080/cli/#switch"><code>tailscale switch</code></a></li> <li data-change="changed">Warn in <a href="/kb/1080/cli/#status"><code>tailscale status</code></a> health if something else overwrites <code>/etc/resolv.conf</code></li> </ul> <h6>macOS</h6> <ul> <li data-change="new">Add <a href="/kb/1225/fast-user-switching">fast user switching</a> by selecting the desired tailnet from the Tailscale icon in the menubar, or via the <a href="/kb/1080/cli/#login"><code>tailscale login</code></a> and <a href="/kb/1080/cli/#switch"><code>tailscale switch</code></a> commands</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">Add <a href="/kb/1225/fast-user-switching">fast user switching</a> by selecting the desired tailnet from the Tailscale icon in the taskbar, or via the <a href="/kb/1080/cli/#login"><code>tailscale login</code></a> and <a href="/kb/1080/cli/#switch"><code>tailscale switch</code></a> commands</li> <li data-change="new">Use named pipes to communicate between UI and Service</li> <li>Changed: Move state storage responsibility from frontend to backend. The current state is migrated, this should not be a noticeable change.</li> <li data-change="changed">Switch to <code>wingoes</code> for OLE support, use multithreaded apartment</li> <li data-change="changed">Received <a href="/kb/1106/taildrop">Taildrop</a> files get placed in the <code>C:\Users\(username)\Downloads</code> directory (previously they were placed in the <code>C:\Users\(username)\Desktop</code> directory)</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">Allow Sonos app to discover speakers on the local LAN</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">Better detect DSM version, locate local socket correctly</li> </ul> <h6>Containers</h6> <ul> <li data-change="changed">Replace <code>run.sh</code> with <code>cmd/containerboot</code></li> </ul> <h6>FreeBSD</h6> <ul> <li data-change="new">Support for <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> (Thanks Pat Maddox!)</li> </ul> </div></div></div></div></div></article><article id="2022-12-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-12-02">Dec 2, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-12-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Set contact preferences for email notifications</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1224/contact-preferences">Set contact preferences</a> in the <a href="https://login.tailscale.com/admin/settings/contact-preferences"><strong>Contact Preferences</strong></a> page of the admin console for notifications about account changes, configuration issues, security issues, and billing</li> <li data-change="new">Contact preference updates and verifications are included in <a href="/kb/1203/audit-logging">configuration audit logs</a></li> </ul> </div></div></div></div></div></article><article id="2022-11-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-11-23">Nov 23, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-11-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Create feature preview invitations</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1222/invite-only-feature/#creating-a-feature-invitation">Create invitations for feature previews</a> in the <a href="https://login.tailscale.com/admin/settings/general"><strong>General</strong></a> settings page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2022-11-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-11-22">Nov 22, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-11-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Name change for unstable Docker images</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Tailscale unstable images on <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> and in <a href="https://github.com/tailscale/tailscale/pkgs/container/tailscale">GitHub Packages</a> now contain the prefix "unstable-", for example "unstable-v1.33" instead of "v1.33"</li> </ul> </div></div></div></div></div></article><article id="2022-11-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-11-21">Nov 21, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-11-21-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.32.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Security vulnerability in the Windows client that allows a malicious website to reconfigure the Tailscale daemon <code>tailscaled</code>, which can then be used to remotely execute code (<a href="https://www.cve.org/CVERecord?id=CVE-2022-41924">CVE-2022-41924</a>, <a href="/security-bulletins/#ts-2022-004">TS-2022-004</a>)</li> <li>Fixed: Security vulnerability in the client that allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables (<a href="https://www.cve.org/CVERecord?id=CVE-2022-41925">CVE-2022-41925</a>, <a href="/security-bulletins/#ts-2022-005">TS-2022-005</a>)</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Set <code>Zone.Identifier</code> alternate data stream for Taildrop files</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">Set <code>com.apple.quarantine</code> flag for Taildrop files</li> </ul> </div></div></div></div></div></article><article id="2022-11-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-11-17">Nov 17, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-11-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale Funnel</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/introducing-tailscale-funnel"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1223/tailscale-funnel">Tailscale Funnel</a> to route traffic from the wider Internet to your Tailscale nodes (alpha)</li> </ul> </div></div></div></div></div></article><article id="2022-11-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-11-10">Nov 10, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-11-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Filter machines in admin console with UI filters</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1176/filter-devices">Use UI filters</a> to easily filter devices in the <strong><a href="https://login.tailscale.com/admin/machines">Machines</a></strong> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2022-11-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-11-08">Nov 8, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-11-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Webhook event payload additions</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The <a href="/kb/1203/audit-logging/#log-structure">actor</a> is included in all <a href="/kb/1213/webhooks">webhook</a> event payloads</li> <li data-change="new">The <a href="/kb/1028/key-expiry">key expiration time</a> is included in payloads for expiration-related events</li> <li data-change="changed">Slack messages generated for webhook events now have timestamps formatted in the local timezone of the user viewing the message</li> </ul> </div></div></div></div></div></article><article id="2022-11-03" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-11-03">Nov 3, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-11-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale in Azure Marketplace</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Set up billing in Azure with a <a href="/kb/1220/azure-marketplace">Tailscale in Azure Marketplace</a> subscription</li> </ul> </div></div></div></div></div></article><article id="2022-10-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-27">Oct 27, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale SSH Console</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/ssh-console"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Create a <a href="/kb/1216/tailscale-ssh-console">browser-based SSH session</a> from the admin console to a node on your tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2022-10-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-26">Oct 26, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-26-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.32.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="changed">Substantially improve userspace-networking handling of packet loss</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Fix a crash impacting some macOS systems (<a href="https://github.com/tailscale/tailscale/issues/6065">#6065</a>)</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">Fix a 4-in-6 DNS problem mainly impacting Android (fixed by Peter Cai) (<a href="https://github.com/tailscale/tailscale/issues/5698">#5698</a>)</li> </ul> </div></div></div><div id="2022-10-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Ability to change tailnet fun name</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1217/tailnet-name/#re-roll-the-fun-name">Re-roll tailnet fun name</a> if you want a different fun name <em>and</em> you haven't already used it for HTTPS certificates</li> </ul> </div></div></div><div id="2022-10-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Webhooks</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/webhooks"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1213/webhooks">webhooks</a> to subscribe to certain events on your tailnet and process the event notifications through an integration or app</li> </ul> </div></div></div></div></div></article><article id="2022-10-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-21">Oct 21, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-21-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.32.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Avoid crash in <code>tailscale netcheck</code> (<a href="https://github.com/tailscale/tailscale/issues/5919">#5919</a>)</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Avoid a condition which can result in high CPU consumption (<a href="https://github.com/tailscale/tailscale/issues/5879">#5879</a>)</li> <li data-change="fixed">Fix Taildrop failures when sending many files (<a href="https://github.com/tailscale/tailscale/issues/5873">#5873</a>)</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Fix Taildrop failures when sending many files (<a href="https://github.com/tailscale/tailscale/issues/5873">#5873</a>)</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Correct IPv6 MTU setting (<a href="https://github.com/tailscale/tailscale/issues/5914">#5914</a>)</li> </ul> </div></div></div><div id="2022-10-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Customizable expiry for keys</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Choose an expiry between 1 and 90 days for new <a href="/kb/1085/auth-keys">auth keys</a> and <a href="/kb/1101/api">API keys</a></li> </ul> </div></div></div><div id="2022-10-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Fully qualified domain name in API responses</h3></header><div><div class="t-b18 changelog-entry"><ul> <li>Changed: In output of Tailscale API calls, a machine's name uses the fully qualified domain name based on the <a href="/kb/1217/tailnet-name">tailnet name</a>, instead of the previous format based on the <a href="/kb/1217/tailnet-name/#organization-name">organization name</a>. For example, a machine name in API output is now <code>my-server.yak-bebop.ts.net</code> instead of <code>my-server.example.com</code>. This is a display-only change and doesn't modify the name of any machines.</li> </ul> </div></div></div></div></div></article><article id="2022-10-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-20">Oct 20, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">MagicDNS General Availability</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/magicdns"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1081/magicdns">MagicDNS</a> (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>Access devices using short hostnames, like <code>my-server</code> or <code>dashboard</code></li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2022-10-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-18">Oct 18, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailnet name changed</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Tailnets use <code>.ts.net</code> instead of <code>.beta.tailscale.net</code> for the <a href="/kb/1217/tailnet-name">tailnet name</a> <ul> <li>To avoid publicizing your organization name, Tailscale provides you with a tailnet name, which is used by features like MagicDNS, HTTPS, and sharing. The tailnet name is visible in the <strong><a href="https://login.tailscale.com/admin/dns">DNS</a></strong> page of the admin console.</li> <li>Previously, you might have used a name ending in <code>.beta.tailscale.net</code>. If so, migrate to the new tailnet name. The existing <code>beta.tailscale.net</code> name remains supported until at least November 1, 2023.</li> <li>What we previously called the tailnet name is now called the organization name. The organization name is used by the Tailscale API, and is visible in the <strong><a href="https://login.tailscale.com/admin/settings">Settings</a></strong> page of the admin console.</li> </ul> </li> </ul> </div></div></div></div></div></article><article id="2022-10-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-13">Oct 13, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Configuration audit logging</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/config-audit-logging"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1203/audit-logging">configuration audit logging</a> to identify who did what, and when, in your tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2022-10-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-12">Oct 12, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">NextDNS</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/nextdns"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1218/nextdns">NextDNS as a global nameserver</a></li> <li data-change="new">Configure different NextDNS profiles for different devices using <a href="/kb/1337/acl-syntax/#nodeattrs"><code>nodeAttrs</code></a></li> </ul> </div></div></div><div id="2022-10-12-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.32.0</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">Support NextDNS</li> <li data-change="new">Add <code>tailscaled --no-logs-no-support</code> (or <code>TS_NO_LOGS_NO_SUPPORT=true</code> environment variable)</li> <li data-change="new"><code>tailscale bugreport --record</code> flag to pause and write another bug report</li> <li data-change="changed">More in-depth health checks in a bugreport</li> <li data-change="changed"><code>tailscale netcheck</code> looks for a captive portal</li> <li data-change="changed">Build with Go 1.19.2</li> <li data-change="fixed">IP fragmentation handling as an exit node</li> <li data-change="fixed">SSH inadvertently closing tmux/etc panes at disconnect</li> <li data-change="fixed">Always respond to 4via6 ICMP echo requests</li> <li data-change="fixed">Normalize more process names in Services report</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">Coexist with mwan3 package iptables rule fwmark masks, for OpenWRT</li> <li data-change="new">Add an eBPF helper to pass the first packet on a new flow up to <code>tailscaled</code></li> <li data-change="changed">Better detect when running in a container</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Incorrect list of Taildrop target devices</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">Log Windows service diagnostics when the wintun device fails to install</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Incorrect list of Taildrop target devices</li> </ul> <h6>Android</h6> <ul> <li data-change="changed">Show an error when unable to accommodate multiple users</li> </ul> <h6>Synology</h6> <ul> <li data-change="new">envknob support</li> <li data-change="fixed">Configure-host version parsing</li> </ul> </div></div></div></div></div></article><article id="2022-10-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-10-05">Oct 5, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-10-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">DNS entries for DERP regions for firewalls</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Per-DERP-region DNS entries, such as <code>derp1-all.tailscale.com</code>, available for <a href="/kb/1082/firewall-ports#what-if-i-really-really-want-to-specify-the-hostnames-that-tailscale-uses-to-operate-its-service">firewall allowlists</a> or other compliance requirements</li> </ul> </div></div></div></div></div></article><article id="2022-09-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-30">Sep 30, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Key type embedded in keys</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Key type is embedded in new keys, for example, <code>tskey-auth-012345abcdef</code> instead of <code>tskey-012345abcdef</code></li> </ul> </div></div></div></div></div></article><article id="2022-09-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-26">Sep 26, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Honolulu DERP region</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Honolulu added as a <a href="/blog/how-tailscale-works/#encrypted-tcp-relays-derp">DERP region</a></li> </ul> </div></div></div></div></div></article><article id="2022-09-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-22">Sep 22, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Dubai and Warsaw DERP regions</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Dubai and Warsaw added as <a href="/blog/how-tailscale-works/#encrypted-tcp-relays-derp">DERP regions</a></li> </ul> </div></div></div></div></div></article><article id="2022-09-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-16">Sep 16, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Check mode supported for nodes provisioned with an auth key</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="fixed">Nodes provisioned with an auth key can use <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> with <a href="/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode">check mode</a></li> </ul> </div></div></div><div id="2022-09-16-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.30.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">IPv6-mapped-IPv4 addresses in STUN responses</li> <li data-change="changed">Better detect when running in a container</li> </ul> </div></div></div></div></div></article><article id="2022-09-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-15">Sep 15, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Hong Kong, Madrid, and Toronto DERP regions</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Hong Kong, Madrid, and Toronto added as <a href="/blog/how-tailscale-works/#encrypted-tcp-relays-derp">DERP regions</a></li> </ul> </div></div></div></div></div></article><article id="2022-09-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-14">Sep 14, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Los Angeles and Paris DERP regions</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Los Angeles and Paris added as <a href="/blog/how-tailscale-works/#encrypted-tcp-relays-derp">DERP regions</a></li> </ul> </div></div></div></div></div></article><article id="2022-09-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-13">Sep 13, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Johannesburg and Miami DERP regions</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Johannesburg and Miami added as <a href="/blog/how-tailscale-works/#encrypted-tcp-relays-derp">DERP regions</a></li> </ul> </div></div></div></div></div></article><article id="2022-09-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-12">Sep 12, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-12-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Amsterdam and Denver DERP regions</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Amsterdam and Denver added as <a href="/blog/how-tailscale-works/#encrypted-tcp-relays-derp">DERP regions</a></li> </ul> </div></div></div></div></div></article><article id="2022-09-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-08">Sep 8, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-08-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.30.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Exit nodes in userspace-networking mode break Chrome v.104 or later IPv6 connectivity</li> <li data-change="fixed">SIGINT when running in a container without job control</li> </ul> </div></div></div></div></div></article><article id="2022-09-02" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-02">Sep 2, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-02-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">GitOps for Tailscale ACLs</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/gitops-acls"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://github.com/marketplace/actions/sync-tailscale-acls">Sync Tailscale ACLs</a> GitHub Action in GitHub Marketplace to <a href="/kb/1204/gitops-acls">keep your tailnet policy file in Git</a>, and automatically run tests and push changes to Tailscale</li> </ul> </div></div></div></div></div></article><article id="2022-09-01" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-09-01">Sep 1, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-09-01-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">See recently expired and revoked auth and API keys</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Recently expired and revoked <a href="/kb/1085/auth-keys/">auth keys</a> and <a href="/kb/1101/api">API keys</a> are now shown on the <strong><a href="https://login.tailscale.com/admin/settings/keys">Keys</a></strong> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2022-08-31" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-31">Aug 31, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-31-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.30</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">Use DNS-over-HTTPS for Mullvad DNS servers</li> <li data-change="new">Report whether a subnet router is running in userspace-networking or kernel mode</li> <li data-change="new">send Tailscale client version number in ACME requests (to Let's Encrypt, for example)</li> <li data-change="new">Report whether host kernel supports IPv6</li> <li data-change="new">Add <code>tailscale licenses</code> with link to open source licenses</li> <li data-change="changed">Delete node immediately if <code>tailscaled</code> exists and was using <code>mem:</code> state storage</li> <li data-change="changed">tsnet ephemeral nodes will delete themselves on <code>Close()</code></li> <li data-change="changed">Add a timeout when writing to BIRD socket</li> <li data-change="changed">Clients can use Noise with any HTTPS port with capver 39 (mainly for Headscale)</li> <li data-change="fixed">100.100.100.100 will respond with SERVFAIL if there are no upstream resolvers</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Gracefully handle restarts in resolved support</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">Report <a href="/kb/1065/macos-variants">variant</a> (App Store, system extension) in the about box</li> <li data-change="fixed">Fix missing IP address display in the status menu</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">Add native ARM build for backend Tailscale service (only in NSIS installer in this release)</li> <li data-change="changed">Update Proxy support</li> <li data-change="changed">Notice when group policy entries change and move our NRPT rules between the local and group policy subkeys as needed</li> <li data-change="fixed">Avoid 2.3 second DNS lookup delay when Smart Name Resolution is enabled by adding MagicDNS names to hosts file</li> <li data-change="fixed">Disable NetBIOS nameservice on Tailscale interfaces</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Fix potential crash in notification handling</li> <li data-change="fixed">Fix dismissing of error indication if a bugreport fails</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Allow coordination server URL to be set. Click the Authentication menu three times quickly to enable</li> <li data-change="fixed">Fix Google Stadia, Android Auto, GoPro, and Messages RCS with the VPN active</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">Fix <code>/dev/net</code> permissions in <code>tailscale configure-host</code></li> </ul> <h6>OpenBSD</h6> <ul> <li data-change="new">Support functioning as a subnet router or exit node using hybrid netstack mode</li> </ul> <h6>Other</h6> <ul> <li data-change="fixed">Accommodate shared nodes in nginx-auth</li> <li data-change="fixed">Fix race in derper (Custom DERP servers) with manual certificates</li> </ul> </div></div></div></div></div></article><article id="2022-08-30" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-30">Aug 30, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-30-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Terraform provider</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/terraform"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1210/terraform-provider">Tailscale Terraform provider</a> for managing your Tailscale resources, managed by Tailscale</li> </ul> </div></div></div></div></div></article><article id="2022-08-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-26">Aug 26, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Share invite links without a label</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Invite links for <a href="/kb/1084/sharing">sharing a device</a> are automatically generated and copied, and no longer requires a label to be generated</li> </ul> </div></div></div></div></div></article><article id="2022-08-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-25">Aug 25, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Remove ephemeral nodes immediately</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/ephemeral-logout"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Run <a href="/kb/1080/cli/#logout"><code>tailscale logout</code></a> to remove an <a href="/kb/1111/ephemeral-nodes">ephemeral node</a> from your tailnet immediately</li> </ul> </div></div></div></div></div></article><article id="2022-08-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-24">Aug 24, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-24-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">TrueCharts</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">TrueCharts has added community support for a <a href="https://truecharts.org/docs/charts/stable/tailscale/">TrueNAS SCALE app and Helm chart for Tailscale</a> (Thanks!)</li> </ul> </div></div></div></div></div></article><article id="2022-08-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-15">Aug 15, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">On-demand access integration</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">On-demand access integration with <a href="/kb/1208/ondemand-conductorone">ConductorOne</a>, <a href="/kb/1205/ondemand-indent">Indent</a>, <a href="/kb/1209/ondemand-opal">Opal</a>, and <a href="/kb/1206/ondemand-sym">Sym</a></li> </ul> </div></div></div></div></div></article><article id="2022-08-11" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-11">Aug 11, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-11-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">OneCGNATRoute setting, custom derp server upgrade</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">The <a href="/kb/1337/acl-syntax/#network-policy-options">network policy options section</a> in ACLs now contains the <code>OneCGNATRoute</code> setting which controls the routes that Tailscale clients will generate</li> <li data-change="fixed">Bug that can cause slow connects and a crash in a <a href="/kb/1118/custom-derp-servers">custom DERP server</a> in manual cert mode (not using Let's Encrypt). We encourage you to upgrade your <code>derper</code> binary. If you use the default Let's Encrypt mode, no action is required</li> </ul> </div></div></div></div></div></article><article id="2022-08-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-08-09">Aug 9, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-08-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale SSH supported for shared tagged nodes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Connect with <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> to <a href="/kb/1068/acl-tags">tagged</a> nodes that are <a href="/kb/1084/sharing">shared</a> with you</li> </ul> </div></div></div></div></div></article><article id="2022-07-19" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-07-19">Jul 19, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-07-19-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale status page</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">View the status of Tailscale services at <a href="https://status.tailscale.com/">https://status.tailscale.com/</a></li> </ul> </div></div></div></div></div></article><article id="2022-07-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-07-18">Jul 18, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-07-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">pfSense</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Netgate has added Tailscale support to the <a href="https://www.netgate.com/blog/tailscale-on-pfsense-software">pfSense package repository</a> (Thanks!)</li> </ul> </div></div></div><div id="2022-07-18-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.28</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">Add <code>ExitNodeStatus</code> to <code>tailscale status --json</code></li> <li data-change="fixed">Fix <code>tailscale ping -c N</code> to properly exit after N ping requests even if there are timeouts</li> <li data-change="changed">MagicDNS recursive resolution now returns <code>SERVFAIL</code> if all upstream resolvers fail</li> <li data-change="changed">portmapper: Send discovery packet for IGD specifically, some routers don't respond to <code>ssdp:all</code></li> </ul> <h6>Linux</h6> <ul> <li data-change="changed">Implement specific DNS support for AWS, Google Cloud, and Azure to add internal split DNS domain and fallback DNS</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">Use one large 100.64.0.0/10 route entry if there are no other interfaces using CGNAT, to avoid Network Changed errors in browsers where possible</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Suppress nonfunctional link-local IPv6 addresses on Tailscale interface, PowerShell <code>ping (hostname)</code> now works correctly</li> <li data-change="changed">Set registry values to not send DNS changes concerning our interface to AD domain controllers</li> <li data-change="changed">Update Windows split DNS settings to work alongside other NRPT entries set by group policy</li> <li data-change="changed">Set <code>AllowSameVersionUpgrades</code> attribute on <code>MajorUpgrade</code> tag in Windows MSI script</li> </ul> <h6>iOS</h6> <ul> <li data-change="new">Add portmapper support for NAT-PMP, PCP, UPnP</li> <li data-change="new">Add MagicDNS support for TCP</li> <li>Changed: The minimum iOS version is now iOS 15, which makes substantially more memory available (the App Store will offer Tailscale 1.26.2 for iOS 13 and 14 devices)</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Android can now be an exit node (previously available but hidden)</li> </ul> </div></div></div></div></div></article><article id="2022-07-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-07-05">Jul 5, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-07-05-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.26.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed"><code>tailscaled</code> being able to restart while mosh-server is running from an SSH session</li> <li data-change="fixed">Make <code>tailscale up --operator=""</code> clear a previously set operator</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed"><a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> support with Arch Linux</li> </ul> <h6>macOS</h6> <ul> <li data-change="changed">Limit SSH login to 16 groups</li> </ul> <h6>Windows</h6> <ul> <li data-change="changed">Make SSH command prefer Windows <code>ssh.exe</code> over <code>PATH</code></li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">Try harder to notify for <a href="/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode">SSH check mode</a></li> </ul> </div></div></div></div></div></article><article id="2022-06-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-06-23">Jun 23, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-06-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">4via6 subnet routers</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1201/4via6-subnets">4via6 subnet routers</a> to route traffic when you have existing subnets with overlapping IPv4 addresses (<a href="/kb/1167/release-stages/#alpha">alpha</a>)</li> </ul> </div></div></div><div id="2022-06-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">DNS records for shared devices</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="fixed"><a href="/kb/1084/sharing">Sharing a device</a> with a tailnet domain alias now lets the share recipient also use the shared device's <code>*.ts.net</code> DNS name</li> </ul> </div></div></div></div></div></article><article id="2022-06-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-06-22">Jun 22, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-06-22-" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale SSH</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> to allow Tailscale to manage the authentication and authorization of SSH connections in your tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> <li data-change="changed"><a href="/kb/1192/acl-samples/#allow-all-default-acl">Default ACL</a> now allows users to access their own devices using <a href="/kb/1193/tailscale-ssh">Tailscale SSH</a> with <a href="/kb/1193/tailscale-ssh#configure-tailscale-ssh-with-check-mode">check mode</a>. <em>This only affects tailnets with default ACLs, including new tailnets and tailnets which have never modified their ACLs</em></li> </ul> </div></div></div></div></div></article><article id="2022-06-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-06-18">Jun 18, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-06-18-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.26.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Various bugs</li> </ul> </div></div></div></div></div></article><article id="2022-06-06" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-06-06">Jun 6, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-06-06-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.26</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">Add <code>--peerapi <peer></code> flag in <a href="/kb/1080/cli/#ping"><code>tailscale ping</code></a> to check connectivity to a peer using the PeerAPI</li> <li data-change="new">Add <code>--timeout <duration></code> flag in <a href="/kb/1241/tailscale-up"><code>tailscale up</code></a> to enforce a maximum amount of time to wait for the Tailscale service to initialize</li> <li data-change="new">Allow <code>LoginInteractive</code> via <code>LocalAPI</code></li> <li data-change="new">MagicDNS supports DNS/TCP and handling IP fragmented UDP frames</li> <li data-change="new">Add an overall 10 second timeout for recursive MagicDNS queries</li> <li data-change="new">Add <code>Wake-on-LAN</code> function to PeerAPI. There is no UI for it currently.</li> <li data-change="new">Provide <a href="https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh"><code>/run.sh</code></a> as an entrypoint for Docker container builds</li> <li data-change="fixed">Configured MTU is now consistent between a TUN device and a userspace device</li> <li data-change="changed">Refactor <code>tailscale.com/client/tailscale</code> package with <code>LocalClient</code> type</li> <li data-change="changed">Change MagicDNS "via route" DNS names from "via-SITEID.10.2.3.4" to "10.2.3.4.via-SITEID". The old format will continue to work for the next one or two releases.</li> <li data-change="changed">Build with Go 1.18.3</li> </ul> <h6>macOS</h6> <ul> <li data-change="new"><a href="/kb/1065/macos-variants">Tailscaled-on-macOS</a> now supports MagicDNS, including Split DNS</li> <li data-change="new">Initial release of a standalone macOS client, which is independent of the App Store, in the <a href="https://pkgs.tailscale.com/stable/#macos">stable track</a></li> </ul> <h6>Windows</h6> <ul> <li data-change="new">Add <a href="/kb/1189/install-windows-msi/#ts_nolaunch"><code>TS_NOLAUNCH</code></a> property to allow admins to deploy silent MSI installs without automatically starting the GUI</li> <li data-change="fixed">MagicDNS lookup of own hostname</li> <li data-change="fixed">Handle more than 50 Split DNS domains</li> <li data-change="fixed">Resolve one source of shutdown delay (there may still be more)</li> </ul> <h6>Synology</h6> <ul> <li data-change="new">Allow the NAS disks to hibernate by moving telemetry buffering to tmpfs</li> <li data-change="changed">Improve HTTP proxy handling</li> </ul> <h6>iOS</h6> <ul> <li data-change="new"><strong>Bug report</strong> menu option in the UI</li> </ul> </div></div></div></div></div></article><article id="2022-06-03" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-06-03">Jun 3, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-06-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Search, role filtering, and pagination now supported in the Users page</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Search for users and filter based on user role in the <a href="https://login.tailscale.com/admin/users">Users page</a></li> <li data-change="new">Pagination when user list is large in the Users page</li> </ul> </div></div></div></div></div></article><article id="2022-05-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-20">May 20, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-20-" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Standalone macOS build available for testing</h3></header><div><div class="t-b18 changelog-entry"><h6>macOS</h6> <ul> <li data-change="new"><a href="https://pkgs.tailscale.com/unstable/#macos">Initial release of a standalone macOS client</a>, which is independent of the App Store, in the <a href="/kb/1083/install-unstable">unstable track</a></li> </ul> </div></div></div></div></div></article><article id="2022-05-19" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-19">May 19, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-19-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Update billing email details in the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1182/billing-information">Update billing email address</a> in the <strong><a href="https://login.tailscale.com/admin/settings/billing">Billing</a></strong> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2022-05-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-18">May 18, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Autogroup:members as a tag owner</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><code>autogroup:members</code> as a <a href="/kb/1337/acl-syntax/#tag-owners">tag owner</a>, to enable device tagging by any user who is a direct member (not a shared user) of the tailnet</li> </ul> </div></div></div><div id="2022-05-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Format ACLs when saving</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">ACLs are automatically formatted when saved from the <strong><a href="https://login.tailscale.com/admin/acls">Access controls</a></strong> page of the admin console or the API</li> </ul> </div></div></div></div></div></article><article id="2022-05-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-17">May 17, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Key expiry range changed</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The <a href="/kb/1028/key-expiry">allowed expiration range for keys</a> is 1 to 180 days, instead of 3 to 180 days</li> </ul> </div></div></div></div></div></article><article id="2022-05-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-16">May 16, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-16-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Update invoice details in the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1182/billing-information">Update invoice name and address</a> in the <strong><a href="https://login.tailscale.com/admin/settings/billing">Billing</a></strong> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2022-05-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-10">May 10, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-10-" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale extension for Docker Desktop</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use the <a href="/kb/1184/docker-desktop">Tailscale extension for Docker Desktop</a> to securely connect to the resources you need for development (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2022-05-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-09">May 9, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Add all addresses for global DNS nameservers</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">When <a href="/kb/1054/dns/#global-nameservers">adding common global DNS nameservers</a>, Tailscale will automatically include all IPv4 and IPv6 addresses for that nameserver and treat them as one entity</li> </ul> </div></div></div></div></div></article><article id="2022-05-05" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-05-05">May 5, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-05-05-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Validate ACLs in API</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">The <a href="https://github.com/tailscale/tailscale/blob/main/api.md#tailnet-acl-validate-post">tailnet ACL validate API call</a> also allows verifying ACL format and running <a href="/kb/1337/acl-syntax/#tests">ACL tests</a>, without posting a new ACL</li> <li data-change="changed">The <a href="https://github.com/tailscale/tailscale/blob/main/api.md#tailnet-keys-key-get">tailnet key detail API call</a> includes whether an auth key is <a href="/kb/1099/device-authorization/#pre-approve-devices-with-an-auth-key">pre-authorized</a></li> </ul> </div></div></div></div></div></article><article id="2022-04-28" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-04-28">Apr 28, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-04-28-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.24.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Handling of HTTP proxies in certain circumstances</li> <li data-change="fixed">An issue where the new control plane protocol could fail to make a connection to our servers (<a href="https://github.com/tailscale/tailscale/issues/4557">#4557</a>)</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">Additional fix in handling of HTTP proxies</li> </ul> </div></div></div></div></div></article><article id="2022-04-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-04-27">Apr 27, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-04-27-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.24.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Two issues where the new control plane protocol could fail to make a connection to our servers (<a href="https://github.com/tailscale/tailscale/issues/4544">#4544</a>, <a href="https://github.com/tailscale/tailscale/issues/4538">#4538</a>)</li> <li data-change="fixed">Set TCP keep-alives in userspace-networking subnet router to avoid connection leaks (<a href="https://github.com/tailscale/tailscale/issues/4522">#4522</a>)</li> <li data-change="fixed">Avoid using the LTE radio after transition to Wi-Fi</li> </ul> </div></div></div></div></div></article><article id="2022-04-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-04-25">Apr 25, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-04-25-" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Android TV support</h3></header><div><div class="t-b18 changelog-entry"><h6>Android</h6> <ul> <li data-change="new"><a href="/kb/1079/install-android">Run Tailscale on Android TV</a></li> </ul> </div></div></div></div></div></article><article id="2022-04-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-04-22">Apr 22, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-04-22-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.24</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">Initial support for site-relative IPv4 addressing using IPv6</li> <li data-change="new">First for-keepsies deployment of ts2021 protocol</li> <li data-change="new">tsnet now supports providing a custom ipn.StateStore</li> <li data-change="fixed">Improve netstack performance via better GC tuning</li> <li data-change="fixed">MagicDNS: PTR records for TS service IPs</li> <li data-change="changed">Build with Go 1.18</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">taildrop: add <code>file get --loop</code></li> <li data-change="new">taildrop: add <code>file get --conflict=(skip|overwrite|rename)</code></li> <li data-change="changed">Default to userspace-networking mode on <a href="https://gokrazy.org/">gokrazy</a></li> <li data-change="changed">Set tailscale0 link speed to UNKNOWN, not 1Gbps</li> <li data-change="changed">Attempt to load the xt_mark kernel module when it is not present</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Improve HTTPS proxy handling</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">Improve HTTPS proxy handling</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Android TV support</li> <li data-change="fixed">Fix and reintroduce Talkback support</li> </ul> <h6>FreeBSD</h6> <ul> <li data-change="fixed">Portmapping support</li> </ul> </div></div></div></div></div></article><article id="2022-04-19" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-04-19">Apr 19, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-04-19-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Sync Okta groups to use in your Tailscale ACLs</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/sync-okta-groups"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1180/sso-okta-scim">User & group provisioning for Okta</a> (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div><div id="2022-04-19-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Filter on user state, and view Last seen date, in the Users page</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Filter based on user state (<strong>Active</strong>, <strong>Inactive</strong>, and <strong>Suspended</strong>) in the <strong><a href="https://login.tailscale.com/admin/users">Users</a></strong> page of the admin console</li> <li data-change="new"><strong>Last seen</strong> column in the <strong><a href="https://login.tailscale.com/admin/users">Users</a></strong> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2022-04-14" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-04-14">Apr 14, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-04-14-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Update tax identification number in the admin console</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1182/billing-information">Add or modify your tax identification number</a> in the <strong><a href="https://login.tailscale.com/admin/settings/billing">Billing</a></strong> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2022-03-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-03-25">Mar 25, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-03-25-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL tests now support group in syntax</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1337/acl-syntax/#tests">ACL tests</a> now support <code>group</code> as an option for the <code>src</code> field, and as the <code>host</code> portion of the <code>accept</code> and <code>deny</code> fields.</li> </ul> </div></div></div></div></div></article><article id="2022-03-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-03-21">Mar 21, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-03-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL tests now support accept/deny syntax</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Policy syntax for <a href="/kb/1337/acl-syntax/#tests">ACL tests</a> now supports <code>accept</code>/<code>deny</code> in addition to <code>allow</code>/<code>deny</code> when specifying destinations that the ACL rules should accept or deny.</li> </ul> </div></div></div></div></div></article><article id="2022-03-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-03-17">Mar 17, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-03-17-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.22.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="fixed">Potential crash at startup when using BGP</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">MSI not restarting GUI after MSI-to-MSI upgrade</li> </ul> </div></div></div></div></div></article><article id="2022-03-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-03-15">Mar 15, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-03-15-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Caddy</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/caddy"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Use <a href="/kb/1190/caddy-certificates">Caddy to manage Tailscale HTTPS certificates</a></li> </ul> </div></div></div></div></div></article><article id="2022-03-10" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-03-10">Mar 10, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-03-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tagged nodes no longer need key renewal</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tagged-key-expiry"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1068/acl-tags">Tagged devices</a> have <a href="/kb/1028/key-expiry">key expiry</a> disabled by default</li> </ul> </div></div></div><div id="2022-03-10-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Autogroup:members</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">ACL rules can use <a href="/kb/1337/acl-syntax/#autogroups"><code>autogroup:members</code></a> to write rules to allow access for users who are direct members (not shared users) of the tailnet</li> </ul> </div></div></div></div></div></article><article id="2022-03-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-03-09">Mar 9, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-03-09-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.22.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">In <code>userspace-networking</code> mode, always close SOCKS proxied connections</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Better operation with <a href="https://gokrazy.org/">gokrazy</a></li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Fix macOS GUI "Must restart" dialog in some cases</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Fix a Windows NSIS installer bug when upgrading</li> </ul> <h6>FreeBSD</h6> <ul> <li data-change="fixed">Fix portmapping</li> </ul> </div></div></div></div></div></article><article id="2022-03-04" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-03-04">Mar 4, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-03-04-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Exit node sharing</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1084/sharing/#sharing--exit-nodes">Share an exit node</a> (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2022-02-23" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-02-23">Feb 23, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-02-23-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Auto Approvers for routes and exit nodes</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/auto-approvers"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1337/acl-syntax/#autoapprovers">Auto Approvers for routes and exit nodes</a> to auto-approve advertised routes and exit nodes (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div><div id="2022-02-23-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.22</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li>New: DERP Return Path Optimization (DRPO), allows a pair of nodes in different DERP regions to connect more quickly by only requiring one side to connect to the other, cutting down some DERP setup latency</li> <li data-change="new"><code>tailscaled --state=mem:</code> registers as an ephemeral node and does not store state to disk</li> <li data-change="new"><code>tailscale status --json</code> now shows <code>Tags</code> and <code>PrimaryRoutes</code> for Peers. <code>PrimaryRoutes</code> shows whether a HA subnet router is currently the active one.</li> <li data-change="new"><code>tailscale status --json | jq .TailnetName</code> will show the name of the tailnet</li> <li data-change="new">The optional <code>tailscaled</code> debug server's Prometheus metrics exporter now also includes Go runtime metrics</li> <li data-change="new"><code>tailscaled</code> supports a new <code>TS_PERMIT_CERT_UID</code> environment variable containing either a userid or username to allow to fetch Tailscale TLS certificates for the node. This environment variable can be set in <code>/etc/default/tailscaled</code> to permit non-root web servers on the local machine to fetch certs from <code>tailscaled</code>.</li> <li data-change="fixed">Send heartbeats less often, saving some battery, matching v1.20 change on mobile platforms.</li> <li data-change="changed"><code>--auth-key</code> and <code>--authkey</code> both work as <code>tailscale up</code> arguments</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">More robust detection of systemd-resolved</li> <li data-change="fixed">Efficiently parse extremely large <code>/proc/net/route</code> files</li> <li data-change="fixed">Be more helpful in suggesting <code>tailscale --operator=USER</code> to use with Taildrop</li> <li data-change="fixed">Some broken host DNS configurations are now detected and reported in <code>tailscale status</code></li> </ul> <h6>Windows</h6> <ul> <li data-change="new">MSI installer</li> <li data-change="fixed">Reject SIDs from deleted/invalid security principals to avoid <code>failed to look up user from userid</code> error</li> </ul> <h6>Synology</h6> <ul> <li data-change="changed">Add <code>/var/packages/Tailscale/target/bin/tailscale configure-host</code> to restore needed permissions. We recommend adding this as a scheduled task at boot.</li> </ul> </div></div></div></div></div></article><article id="2022-02-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-02-22">Feb 22, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-02-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL rules now support src/dst syntax</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Policy syntax for <a href="/kb/1337/acl-syntax/#acls">ACL rules</a> now supports <code>src</code>/<code>dst</code> in addition to <code>users</code>/<code>ports</code> when referring to sources and destinations</li> </ul> </div></div></div></div></div></article><article id="2022-02-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-02-17">Feb 17, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-02-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Preview rules bug fixes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="fixed"><a href="/kb/1338/acl-edit/#preview-changes">Preview rules</a> in the admin console does not confuse access for tagged nodes with other tagged nodes (<a href="https://github.com/tailscale/tailscale/issues/3957">#3957</a>)</li> <li data-change="fixed">Preview rules no longer shows <code>autogroup:self</code> for all tagged nodes</li> <li data-change="fixed">Preview rules no longer shows an error if there is an <code>autogroup:self</code> rule</li> </ul> </div></div></div><div id="2022-02-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Pre-authorized auth keys</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Generate <a href="/kb/1085/auth-keys/">auth keys</a> that are <a href="/kb/1099/device-authorization/#pre-approve-devices-with-an-auth-key">pre-authorized for device authorization</a> (<a href="https://github.com/tailscale/tailscale/issues/2120">#2120</a>)</li> <li data-change="fixed"><a href="/kb/1085/auth-keys/#types-of-auth-keys">One-off ephemeral auth keys</a> actually create ephemeral nodes</li> <li data-change="fixed"><a href="/kb/1337/acl-syntax/#autogroups"><code>autogroup:self</code></a> for users with mixed case accounts (<a href="https://github.com/tailscale/tailscale/issues/3954">#3954</a>)</li> </ul> </div></div></div></div></div></article><article id="2022-02-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-02-09">Feb 9, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-02-09-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.20.4</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">DNS lookups via an exit node in many cases</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Better handling of extremely large <code>/proc/net/route</code> files for very large routers</li> <li data-change="fixed">BGP advertisement with subnet router failover</li> </ul> <h6>OpenBSD</h6> <ul> <li data-change="fixed">openresolv <code>/etc/resolv.conf</code> handling</li> </ul> </div></div></div></div></div></article><article id="2022-02-04" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-02-04">Feb 4, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-02-04-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Disable node key expiry via API</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://github.com/tailscale/tailscale/blob/main/api.md#device-key-post">Disable node key expiry via API</a></li> <li data-change="fixed"><a href="/kb/1338/acl-edit/#preview-changes">Preview rules</a> in the admin console for tagged nodes</li> </ul> </div></div></div></div></div></article><article id="2022-02-01" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-02-01">Feb 1, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-02-01-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ACL tags General Availability</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/acl-tags-ga"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed"><a href="/kb/1068/acl-tags/">ACL tags</a> (<a href="/kb/1167/release-stages/#general-availability-ga">generally available</a>) <ul> <li>You can include tags as part of an authentication key, you can tag devices from the <strong><a href="https://login.tailscale.com/admin/machines">Machines</a></strong> page of the admin console, and tags can be owners of other tags. You must authenticate when re-tagging a device.</li> </ul> </li> <li data-change="fixed"><a href="/kb/1338/acl-edit/#preview-changes">Preview rules</a> in the admin console for a user without any nodes</li> </ul> </div></div></div></div></div></article><article id="2022-01-28" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-01-28">Jan 28, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-01-28-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tagged devices are managed by a tag, not a user</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">A device tagged with an <a href="/kb/1068/acl-tags">ACL tag</a> is associated with the tag applied to it, not with the user who authenticated the device</li> <li data-change="changed">Tagged devices are listed under "Tagged Devices" in the list of Network devices in Tailscale clients</li> <li data-change="changed">Users cannot use Taildrop to send files to and from nodes they have tagged</li> <li data-change="fixed">A user without any nodes can be specified as part of <a href="/kb/1337/acl-syntax/#tests">an ACL test</a></li> </ul> </div></div></div></div></div></article><article id="2022-01-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-01-26">Jan 26, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-01-26-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.20.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Synology</h6> <ul> <li data-change="fixed">UI issues in Synology (<a href="https://github.com/tailscale/tailscale/issues/3811">Synology 1.20.2 doesn’t have working options page</a>)</li> </ul> <p>Only the Synology client released v1.20.3. All other platforms remain with v1.20.2.</p> </div></div></div></div></div></article><article id="2022-01-21" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-01-21">Jan 21, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-01-21-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Self-serve Synology packages</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Self-serve <a href="/kb/1131/synology">Synology packages</a> are now available on <a href="https://pkgs.tailscale.com">pkgs.tailscale.com</a>.</li> </ul> </div></div></div><div id="2022-01-21-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.20.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Memory footprint growth in userspace-networking mode (<a href="https://github.com/tailscale/tailscale/issues/3762">netstack: leaking packet buffers tailscale #3762</a>)</li> <li data-change="fixed">Userspace-networking will accept a TCP SYN with ECN bits set (<a href="https://github.com/tailscale/tailscale/issues/2642">xt-userspace-networking incoming TCP doesn't always work right away tailscale #2642</a>)</li> <li data-change="fixed">Saving resolver list for OpenBSD</li> </ul> </div></div></div></div></div></article><article id="2022-01-20" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-01-20">Jan 20, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-01-20-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Delete single user tailnets</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1237/delete-tailnet">Delete your tailnet</a> from the <strong><a href="https://login.tailscale.com/admin/settings/general">Settings</a></strong> page of admin console if it only has one user. <a href="/contact/support">Contact support</a> for other requests</li> </ul> </div></div></div></div></div></article><article id="2022-01-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-01-13">Jan 13, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-01-13-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.20.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="fixed">Deadlock in handling the DERP map</li> </ul> </div></div></div></div></div></article><article id="2022-01-12" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2022-01-12">Jan 12, 2022</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2022-01-12-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.20</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">When using an exit node, DNS queries will be forwarded to the exit node for resolution</li> <li data-change="new"><code>tailscaled</code> now allows running the outgoing SOCKS5 and HTTP proxies on the same port.</li> <li data-change="new">SOCKS5/HTTP proxies now allow connecting via subnet routers & exit nodes when run in <code>userspace-networking</code> mode</li> <li data-change="new">More debug metrics available</li> <li data-change="new"><code>tailscale ip -1</code> flag</li> <li data-change="new">CLI now lets you select exit node by name</li> <li data-change="new">CLI now shows you which nodes are offering exit nodes</li> <li data-change="new">CLI now refuses to let you pick an invalid exit node (when connected)</li> <li data-change="new">Packet filter now supports matching any IP protocol number when enabled in ACLs (previously only TCP, UDP, ICMP and SCTP)</li> <li data-change="new">Added <code>Online</code> boolean to <code>tailscale status --json</code>, made <code>tailscale status</code> show offline nodes</li> <li data-change="new">Added <code>tailscale up --json</code></li> <li data-change="fixed">MagicDNS now works over IPv6 when CGNAT IPv4 is disabled using <code>disableIPv4: true</code> in ACL</li> <li data-change="fixed">Choose a new DERP relay server if the current DERP is removed from the DERPmap</li> <li data-change="fixed">Bug fixes, cleanups, log spam reduction</li> </ul> <h6>Linux</h6> <ul> <li data-change="changed"><code>tailscale file cp</code> sends via the local tailscaled now, so it now supports <code>tailscaled</code> running in tun-free, <code>userspace-networking</code> mode (such as on Synology DSM7 unless you <a href="/kb/1131/synology#enable-outbound-connections">enable TUN mode</a>)</li> </ul> <h6>Windows</h6> <ul> <li data-change="new">GUI support for running an exit node</li> </ul> <h6>macOS</h6> <ul> <li data-change="new">GUI support for running an exit node</li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">Send heartbeats less often to conserve battery</li> </ul> <h6>Android</h6> <ul> <li data-change="new">Talkback support</li> <li data-change="new">Menu selection to generate a bug report</li> <li data-change="new">"Allow LAN Access" checkbox in Exit Node menu</li> <li data-change="changed">Send heartbeats less often to conserve battery</li> <li data-change="changed">Implement DNS config reporting</li> <li data-change="changed">No longer require fallback DNS to be configured in admin console</li> <li data-change="fixed">Report in the UI when connectivity is lost; this functionality was present but broken in prior releases</li> </ul> <h6>FreeBSD</h6> <ul> <li data-change="fixed">Now supports running in a jail (if devd isn't available, it falls back to network status polling mode)</li> </ul> </div></div></div></div></div></article><article id="2021-12-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-12-17">Dec 17, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-12-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Auth keys with ACL tags</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1068/tags#best-practices">Auth keys can include an ACL tag binding</a>, so that when a device is authenticated, the tags are applied</li> <li data-change="new"><a href="/kb/1068/tags">ACL tags can be applied by an Owner, Admin, or Network admin from the admin console</a></li> <li data-change="new"><a href="/kb/1068/tags#apply-a-tag-from-another-tag">A tag can be the owner of another tag</a></li> <li data-change="new">Auth keys can be generated via <a href="https://github.com/tailscale/tailscale/blob/main/api.md#tailnet-keys-post">API</a></li> </ul> </div></div></div></div></div></article><article id="2021-12-15" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-12-15">Dec 15, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-12-15-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.18.2</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">Permit protocols other than TCP, UDP, or SCTP if an <a href="/kb/1337/acl-syntax/#acls">ACL rule</a> has a <code>proto</code> specified and allows <code>*</code> port range</li> <li data-change="fixed">Exit node selection takes effect (almost) immediately</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">In DNS DirectManager, allow comments at the end of a line</li> <li data-change="fixed">Don't get stuck waiting for systemd-resolved to restart in one particular DNS configuration</li> </ul> <h6>Synology</h6> <ul> <li data-change="new"><a href="/kb/1418/taildrop-nas#set-up-taildrop-on-synology">Receive Taildrop files</a></li> </ul> </div></div></div></div></div></article><article id="2021-12-09" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-12-09">Dec 9, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-12-09-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Autogroup:self</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">ACLs can now use <a href="/kb/1337/acl-syntax/#autogroups"><code>autogroup:self</code></a> to write access rules to allow access to devices authenticated as the same user as the source IP address</li> </ul> </div></div></div></div></div></article><article id="2021-11-25" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-11-25">Nov 25, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-11-25-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.18.1</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Linux</h6> <ul> <li data-change="fixed">Regressions on some kernel configs related to our direct use of netlink rather than using the <code>ip</code> command to program routes and policy routing</li> </ul> </div></div></div></div></div></article><article id="2021-11-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-11-22">Nov 22, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-11-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Additional admin roles</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/admin-roles"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1138/user-roles">User roles</a> for Network admin, IT admin, and Auditor</li> </ul> </div></div></div></div></div></article><article id="2021-11-19" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-11-19">Nov 19, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-11-19-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">ARM and ARM64 container images</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">arm and arm64 container images on <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> and in <a href="https://github.com/orgs/tailscale/packages/container/package/tailscale">GitHub Packages</a></li> </ul> </div></div></div></div></div></article><article id="2021-11-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-11-18">Nov 18, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-11-18-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.18</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new"><code>tailscaled</code> debug server now exports Prometheus metrics at <code>/debug/metrics</code></li> <li data-change="fixed">Improved UPnP discovery so that eero devices now work, allowing a port to be opened for direct connections (also in 1.16.2)</li> <li data-change="fixed">State machine transition regarding expired key extension</li> <li data-change="changed">If unable to upload telemetry, limit amount buffered to 50MB</li> <li data-change="changed">Retry more transient DNS errors, instead of passing the failure back to the client</li> </ul> <h6>Linux</h6> <ul> <li data-change="new">Support storing Tailscale state using AWS SSM (for example, <code>tailscaled -state arn:aws:ssm:eu-west-1:123456789:parameter/foo</code>) (thank you Maxime Visonneau)</li> <li data-change="fixed">If resolvconf wrote <code>/etc/resolv.conf</code> but pointed it to <code>systemd-resolved</code>, use <code>systemd-resolved</code> for DNS not resolvconf</li> <li data-change="fixed">If NetworkManager wrote <code>/etc/resolv.conf</code> but pointed it to <code>systemd-resolved</code>, use <code>systemd-resolved</code> for DNS not NetworkManager</li> <li data-change="fixed">Handle <code>/etc/resolv.conf</code> being a bind mount into a container, such that we cannot <code>rename()</code> it.</li> <li data-change="fixed">Work around Ubuntu 18.04 setLinkDomain length limit by omitting reverse lookup information</li> <li data-change="changed">Use AF_NETLINK messages to configure IP, not the <code>ip</code> command. Set <code>TS_DEBUG_USE_IP_COMMAND</code> environment variable to revert to use of <code>/sbin/ip</code> if this breaks your device</li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">On iOS 15+, where Network Extensions have more memory available, allow the same number of DNS-over-HTTPS requests in flight as other platforms</li> </ul> <h6>Synology</h6> <ul> <li data-change="changed">Only use AmbientCaps on DSM7+</li> </ul> </div></div></div></div></div></article><article id="2021-11-08" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-11-08">Nov 8, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-11-08-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Homebrew</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Available as a formula in <a href="https://formulae.brew.sh/formula/tailscale">Homebrew</a> (Thanks!)</li> </ul> </div></div></div></div></div></article><article id="2021-11-03" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-11-03">Nov 3, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-11-03-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Okta Integration Network</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Available in the <a href="https://www.okta.com/integrations/tailscale/">Okta Integration Network</a></li> </ul> </div></div></div></div></div></article><article id="2021-10-27" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-10-27">Oct 27, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-10-27-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Suspended and inactive users</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Users can be <a href="/kb/1145/remove-team-members/#suspending-users">suspended and restored</a> from the <strong><a href="https://login.tailscale.com/admin/users">Users</a></strong> page of the admin console</li> <li data-change="new">Users who are <a href="/kb/1145/remove-team-members/#managing-idle-users">inactive</a> are shown in <strong><a href="https://login.tailscale.com/admin/users">Users</a></strong> page of the admin console</li> </ul> </div></div></div></div></div></article><article id="2021-10-26" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-10-26">Oct 26, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-10-26-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">IPv4 addresses for ephemeral nodes</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="changed">Ephemeral nodes now have both IPv6 and IPv4 addresses</li> </ul> </div></div></div></div></div></article><article id="2021-10-18" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-10-18">Oct 18, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-10-18-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Synology Package Center</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tailscale-synology-package"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Officially supported in the <a href="https://www.synology.com/en-global/dsm/packages/Tailscale">Synology package center</a></li> </ul> </div></div></div></div></div></article><article id="2021-10-13" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-10-13">Oct 13, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-10-13-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Published container image</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/kubecon-21"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Published Tailscale container image available on <a href="https://hub.docker.com/r/tailscale/tailscale">Docker Hub</a> and in <a href="https://github.com/orgs/tailscale/packages/container/package/tailscale">GitHub Packages</a></li> </ul> </div></div></div></div></div></article><article id="2021-10-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-10-07">Oct 7, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-10-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Authentication settings</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/authentication-settings"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Enable <a href="/kb/1099/device-authorization">device authorization</a> from the <strong><a href="https://login.tailscale.com/admin/settings/general">Settings</a></strong> page of admin console</li> <li data-change="new">Set <a href="/kb/1028/key-expiry">key expiry</a> from the <strong><a href="https://login.tailscale.com/admin/settings/general">Settings</a></strong> page of admin console</li> </ul> </div></div></div><div id="2021-10-07-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.16</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="new">Support storage of node state as a Kubernetes secret.</li> <li data-change="new"><code>tailscale up --authkey=file:/path/to/secret</code> support</li> <li data-change="new"><code>tailscale up --qr</code> for QR codes</li> <li data-change="new">tailscaled in userspace-networking mode can now run an HTTP proxy server (in addition to the prior SOCKS5 proxy server support)</li> <li data-change="fixed">No longer need the <code>while tailscale up; do sleep 0.1; done</code> loops in Docker startup scripts.</li> <li data-change="fixed">CPU/memory profiling support in <code>tailscale debug</code></li> <li data-change="fixed">Bake in LetsEncrypt's ISRG Root X1 root (also in 1.14.6)</li> </ul> <h6>Linux</h6> <ul> <li data-change="fixed">Support containers with !CAP_NET_RAW and !CAP_NET_ADMIN (like CircleCI runners)</li> <li data-change="fixed">Service (portlist) scanning optimized; uses much less CPU on busy servers</li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Move state to C:\ProgramData (also in 1.14.4)</li> </ul> <h6>macOS</h6> <ul> <li data-change="fixed">Super rare Wireguard packet loop network flood when using a DNS server behind a subnet router, when a macOS device resumes from sleep and the network changes (also iOS, but triggers less there). Fixes <a href="https://github.com/tailscale/tailscale/issues/1526">#1526</a> (also in 1.14.6).</li> </ul> <h6>iOS</h6> <ul> <li data-change="fixed">Turn the radio on less often to improve battery performance</li> </ul> <h6>Android</h6> <ul> <li data-change="fixed">Support Taildrop on older Android releases</li> <li data-change="fixed">Turn the radio on less often to improve battery performance</li> </ul> </div></div></div></div></div></article><article id="2021-10-06" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-10-06">Oct 6, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-10-06-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">QR code for login link</h3></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Specify <code>--qr</code> as part of <a href="/kb/1241/tailscale-up"><code>tailscale up</code></a> to generate a QR code for the login URL</li> </ul> </div></div></div></div></div></article><article id="2021-10-01" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-10-01">Oct 1, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-10-01-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Service Updates</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="changed">Include Let's Encrypt's ISRG Root X1 root as an alternate to try if the platform roots fail</li> <li data-change="changed">If tailscale cert fails because it needs to be run as root, say so.</li> <li data-change="fixed">Avoid looping packets in tstun, believed to fix <a href="https://github.com/tailscale/tailscale/issues/1526">#1526</a></li> <li data-change="fixed">Allow SOCKS5 proxy for <code>--tun=userspace-networking</code> to dial the HTTPS domain name of the Tailnet</li> <li data-change="fixed">Ensure state directory is set to perm 0700.</li> </ul> <h6>iOS</h6> <ul> <li data-change="changed">Ignore ipsec link monitor events for iOS to avoid waking the system</li> </ul> </div></div></div></div></div></article><article id="2021-09-24" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-09-24">Sep 24, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-09-24-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Service Updates</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>Windows</h6> <ul> <li data-change="changed">Move state files from C:\Windows to C:\ProgramData, to better handle Windows</li> </ul> <h6>Synology</h6> <ul> <li data-change="fixed">Fix segfaults shortly after starting, resolves <a href="https://github.com/tailscale/tailscale/issues/2733">#2733</a></li> </ul> </div></div></div></div></div></article><article id="2021-09-22" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-09-22">Sep 22, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-09-22-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">HTTPS certificates</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/tls-certs"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Provision <a href="/kb/1153/enabling-https">TLS certificates</a> for devices in your tailnet (<a href="/kb/1167/release-stages/#beta">beta</a>)</li> </ul> </div></div></div></div></div></article><article id="2021-09-17" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-09-17">Sep 17, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-09-17-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Community on GitHub plan</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/community-github-pricing"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new">Free <a href="/kb/1154/free-plans-discounts/#community-on-github">Community on GitHub pricing plan</a> for GitHub organizations using Tailscale for open source projects, families, and friends</li> </ul> </div></div></div></div></div></article><article id="2021-09-16" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-09-16">Sep 16, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-09-16-client" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Tailscale v1.14.3</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Update instructions"}" href="https://tailscale.com/kb/1067/update/"><span>Update instructions</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><h6>All Platforms</h6> <ul> <li data-change="changed"><code>tailscale up</code> will wait for the socket to tailscaled to be created, not exit with an error. It should no longer be necessary to run it in a loop.</li> <li data-change="fixed">Crash in TCP forwarding with userspace-networking; resolves <a href="https://github.com/tailscale/tailscale/issues/2658">#2658</a></li> </ul> <h6>Windows</h6> <ul> <li data-change="fixed">Default route lookup on Windows; resolves <a href="https://github.com/tailscale/tailscale/issues/2707">#2707</a></li> </ul> <p><em>Note: v1.14.1 and v1.14.2 were never released.</em></p> </div></div></div></div></div></article><article id="2021-09-07" class="flex w-full max-w-[1060px] flex-col gap-y-3 md:flex-row md:gap-[30px]"><aside class="md:flex-[0_1_200px]"><h2 class="date-heading text-subheading-black"><a href="#2021-09-07">Sep 7, 2021</a></h2></aside><div class="md:flex-[1_1_843px]"><div class="changelog-date-group Markdown Markdown--changelog dark space-y-6"><div id="2021-09-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">Device authorization by API</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="https://github.com/tailscale/tailscale/blob/main/api.md#device-authorized-post"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="/kb/1099/device-authorization">Device authorization</a> is available in the API</li> </ul> </div></div></div><div id="2021-09-07-service" class="changelog-entry scroll-mt-28"><header class="mb-4 flex flex-wrap items-center gap-[30px] gap-y-2"><h3 class="changelog-title t-20">GitHub Actions marketplace</h3><a target="_blank" class="t-16 flex items-center gap-[11px] font-medium !text-subheading-black transition-colors duration-200 hover:!text-[#3B82F6]" data-track="Link Clicked" data-track-properties="{"label": "Read more"}" href="/blog/2021-09-github-actions-marketplace"><span>Read more</span><svg width="17" height="17" viewBox="0 0 17 17" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_272_63622)"><path fill-rule="evenodd" clip-rule="evenodd" d="M9.90069 13.3053L14.7057 8.50031L9.90069 3.69531L8.95869 4.63831L12.1537 7.83331H2.42969V9.16731H12.1537L8.95869 12.3623L9.90069 13.3053Z" fill="currentColor"></path></g><defs><clipPath id="clip0_272_63622"><rect width="16" height="17" fill="white" transform="translate(0.429688)"></rect></clipPath></defs></svg></a></header><div><div class="t-b18 changelog-entry"><ul> <li data-change="new"><a href="https://github.com/marketplace/actions/connect-tailscale">Connect Tailscale action</a> available in GitHub Marketplace</li> </ul> </div></div></div></div></div></article></div></section></main><footer class="pb-16 pt-5 md:pb-28 md:pt-20 "><div class="container grid gap-x-4 gap-y-8 pb-8 xxs:grid-cols-2 sm:grid-cols-3 sm:gap-5 md:pb-[110px] lg:grid-cols-6"><div><p class="t-16 !leading-[1.05] text-heading-black">Product</p><div class="mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4"><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/blog/how-tailscale-works">How it works</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/pricing">Pricing</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/integrations">Integrations</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/features">Features</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/compare">Compare Tailscale</a></div></div><div><p class="t-16 !leading-[1.05] text-heading-black">Use Cases</p><div class="mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4"><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/use-cases/business-vpn">Business VPN</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/use-cases/remote-access">Remote Access</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/use-cases/site-to-site-networking">Site-to-Site Networking</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/use-cases/homelab">Homelab</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/enterprise">Enterprise</a></div></div><div><p class="t-16 !leading-[1.05] text-heading-black">Resources</p><div class="mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4"><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/blog">Blog</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/events-webinars">Events & Webinars</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/partnerships">Partnerships</a></div></div><div><p class="t-16 !leading-[1.05] text-heading-black">Company</p><div class="mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4"><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/company">Company</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/careers">Careers</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/press">Press</a></div></div><div><p class="t-16 !leading-[1.05] text-heading-black">Help & Support</p><div class="mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4"><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/contact/support">Support</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/contact/sales">Sales</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/security">Security</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/legal">Legal</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/opensource">Open Source</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/changelog">Changelog</a></div></div><div><p class="t-16 !leading-[1.05] text-heading-black">Learn</p><div class="mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4"><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/learn/generate-ssh-keys">SSH keys</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/learn/ssh-into-docker-container">Docker SSH</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/learn/devsecops">DevSecOps</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/learn/multicloud">Multicloud</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/blog/how-nat-traversal-works">NAT Traversal</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/blog/2021-09-private-dns-with-magicdns">MagicDNS</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/learn/privileged-access-management">PAM</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/learn/principle-of-least-privilege">PoLP</a><a class="text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100" href="/learn">All articles</a></div></div></div><div class="container"><div class="border-stroke-gray-100 grid grid-cols-1 gap-x-5 gap-y-8 border-t pt-8 xxs:grid-cols-2 md:grid-cols-12 md:pt-[70px] lg:gap-y-[60px]"><div class="xxs:col-span-2 md:col-span-4"><a class="block w-[160px]" title="Homepage" data-track="Link Clicked" data-track-properties="{"label": "Footer logo"}" href="/"><svg class="transition-colors duration-200 " width="100%" height="100%" viewBox="0 0 110 20" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="2.44719" cy="10.1796" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse cx="9.79094" cy="10.1796" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="2.44719" cy="17.5077" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="17.1269" cy="17.5077" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse cx="9.79094" cy="17.5077" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse cx="17.1269" cy="10.1796" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="2.44719" cy="2.85924" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="9.79094" cy="2.85924" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><ellipse opacity="0.2" cx="17.1269" cy="2.85924" rx="2.44719" ry="2.44128" fill="#1F1E1E"></ellipse><path d="M34.3979 18.458C35.0907 18.458 35.6536 18.3933 36.3248 18.2637V15.7584C35.9134 15.9096 35.4588 15.9528 35.0258 15.9528C33.965 15.9528 33.5753 15.4344 33.5753 14.441V9.34402H36.3248V6.83875H33.5753V3.12403H30.5443V6.83875H28.5742V9.34402H30.5443V14.7217C30.5443 17.0974 31.8 18.458 34.3979 18.458Z" fill="#1F1E1E"></path><path d="M41.2747 18.458C42.8984 18.458 43.9809 17.9181 44.5222 17.0758C44.5655 17.443 44.6954 17.9397 44.8686 18.2421H47.5964C47.4449 17.7237 47.3366 16.903 47.3366 16.3631V10.4455C47.3366 8.005 45.583 6.62277 42.617 6.62277C40.3654 6.62277 38.6118 7.46507 37.6376 8.69611L39.3696 10.4023C40.149 9.5384 41.1448 9.08486 42.3572 9.08486C43.8294 9.08486 44.4789 9.58159 44.4789 10.3159C44.4789 10.9422 44.0459 11.3742 41.7077 11.3742C39.4562 11.3742 37.183 12.3028 37.183 14.8945C37.183 17.2918 38.9149 18.458 41.2747 18.458ZM41.8809 16.1687C40.7118 16.1687 40.1706 15.672 40.1706 14.7865C40.1706 14.009 40.8201 13.4907 41.9026 13.4907C43.6345 13.4907 44.1108 13.3827 44.4789 13.0155V13.9442C44.4789 15.1753 43.4397 16.1687 41.8809 16.1687Z" fill="#1F1E1E"></path><path d="M49.3069 5.39173H52.4677V2.5625H49.3069V5.39173ZM49.3718 18.2421H52.4028V6.83875H49.3718V18.2421Z" fill="#1F1E1E"></path><path d="M54.6109 18.2421H57.6418V2.90805H54.6109V18.2421Z" fill="#1F1E1E"></path><path d="M63.9416 18.458C67.2757 18.458 68.986 16.7087 68.986 14.8729C68.986 13.2099 68.1417 11.9789 65.3705 11.4821C63.4221 11.1366 62.2097 10.7046 62.2097 10.0351C62.2097 9.45201 62.9025 9.04166 64.0715 9.04166C65.1107 9.04166 65.9767 9.38722 66.6262 10.1431L68.553 8.52333C67.5788 7.31389 65.9767 6.62277 64.0715 6.62277C61.1489 6.62277 59.3303 8.17777 59.3303 10.0783C59.3303 12.1517 61.2354 13.0803 63.2922 13.4475C65.0025 13.7499 65.9551 14.0738 65.9551 14.8081C65.9551 15.4344 65.2839 15.9528 64.0066 15.9528C62.7509 15.9528 61.7767 15.3696 61.322 14.5058L58.7674 15.7152C59.3952 17.2702 61.5385 18.458 63.9416 18.458Z" fill="#1F1E1E"></path><path d="M75.7621 18.458C77.9271 18.458 79.4859 17.5942 80.6549 15.6504L78.2302 14.4194C77.7755 15.3265 77.0395 15.9528 75.7621 15.9528C73.8353 15.9528 72.7961 14.3978 72.7961 12.5188C72.7961 10.6399 73.9003 9.12805 75.7621 9.12805C76.9312 9.12805 77.7106 9.75437 78.1652 10.7046L80.6116 9.40882C79.7889 7.61625 78.1652 6.62277 75.7621 6.62277C71.8003 6.62277 69.7652 9.5168 69.7652 12.5188C69.7652 15.78 72.2333 18.458 75.7621 18.458Z" fill="#1F1E1E"></path><path d="M85.4829 18.458C87.1067 18.458 88.1891 17.9181 88.7304 17.0758C88.7737 17.443 88.9036 17.9397 89.0768 18.2421H91.8046C91.6531 17.7237 91.5448 16.903 91.5448 16.3631V10.4455C91.5448 8.005 89.7912 6.62277 86.8252 6.62277C84.5737 6.62277 82.8201 7.46507 81.8458 8.69611L83.5778 10.4023C84.3572 9.5384 85.353 9.08486 86.5654 9.08486C88.0376 9.08486 88.6871 9.58159 88.6871 10.3159C88.6871 10.9422 88.2541 11.3742 85.9159 11.3742C83.6644 11.3742 81.3912 12.3028 81.3912 14.8945C81.3912 17.2918 83.1231 18.458 85.4829 18.458ZM86.0891 16.1687C84.9201 16.1687 84.3788 15.672 84.3788 14.7865C84.3788 14.009 85.0283 13.4907 86.1108 13.4907C87.8427 13.4907 88.319 13.3827 88.6871 13.0155V13.9442C88.6871 15.1753 87.6479 16.1687 86.0891 16.1687Z" fill="#1F1E1E"></path><path d="M93.3263 18.2421H96.3573V2.90805H93.3263V18.2421Z" fill="#1F1E1E"></path><path d="M103.631 18.458C105.861 18.458 107.658 17.5726 108.654 15.996L106.359 14.5274C105.753 15.4776 104.952 15.996 103.631 15.996C102.138 15.996 101.055 15.1753 100.774 13.5771H109.39V12.5188C109.39 9.5168 107.55 6.62277 103.61 6.62277C99.8643 6.62277 97.8293 9.5384 97.8293 12.5404C97.8293 16.8167 101.055 18.458 103.631 18.458ZM100.882 11.2014C101.358 9.75437 102.354 9.08486 103.675 9.08486C105.168 9.08486 106.078 9.97034 106.381 11.2014H100.882Z" fill="#1F1E1E"></path></svg></a></div><div class="flex flex-col gap-[14px] md:col-span-2"><a class="t-14 !leading-[1.05] underline transition-colors duration-300 text-heading-black/60 hover:text-gray-1000/100" href="/terms">Terms of Service</a><a class="t-14 !leading-[1.05] underline transition-colors duration-300 text-heading-black/60 hover:text-gray-1000/100" href="/privacy-policy">Privacy Policy</a></div><div class="md:col-span-3"><div class="t-14 max-w-[250px] !leading-[1.35] text-heading-black/60 ">WireGuard is a registered trademark of Jason A. Donenfeld.</div></div><div class="flex gap-[6px] xxs:col-span-2 md:col-span-3 md:flex md:justify-end"><a target="_blank" class="group transition-colors duration-300 text-heading-black hover:text-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Footer Twitter logo"}" href="https://twitter.com/tailscale"><svg width="28" height="29" viewBox="0 0 28 29" fill="none" xmlns="http://www.w3.org/2000/svg"><rect y="0.988281" width="28" height="28" rx="14" fill="currentColor"></rect><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M8.03169 9L13.0509 15.0672L8 20H9.13675L13.5587 15.6812L17.1317 20H21L15.6985 13.5916L20.3997 9H19.263L15.1906 12.9775L11.9001 9H8.03169ZM9.70337 9.75698H11.4805L19.3281 19.2429H17.551L9.70337 9.75698Z" fill="white"></path></svg></a><a target="_blank" class="group transition-colors duration-300 text-heading-black hover:text-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Footer Facebook logo"}" href="https://www.facebook.com/tailscale/"><svg width="28" height="28" viewBox="0 0 28 28" fill="none" xmlns="http://www.w3.org/2000/svg"><rect x="0.21875" width="27.2195" height="27.2195" rx="13.6098" fill="currentColor"></rect><path class="transition-colors duration-300 group-hover:fill-heading-black" d="M12.434 19.6598L12.4179 14.8081H10.3008V12.7289H12.4179V11.3427C12.4179 9.47188 13.5974 8.57031 15.2966 8.57031C16.1106 8.57031 16.8101 8.62983 17.014 8.65643V10.6115L15.8355 10.612C14.9114 10.612 14.7324 11.0433 14.7324 11.6762V12.7289H17.3577L16.652 14.8081H14.7324V19.6598H12.434Z" fill="#fff"></path></svg></a><a target="_blank" class="group transition-colors duration-300 text-heading-black hover:text-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Footer LinkedIn logo"}" href="https://www.linkedin.com/company/tailscale"><svg width="28" height="28" viewBox="0 0 28 28" fill="none" xmlns="http://www.w3.org/2000/svg"><rect x="0.439453" width="27.2195" height="27.2195" rx="13.6098" fill="currentColor"></rect><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M8.68685 18.6518H10.8825V11.5871H8.68685V18.6518Z" fill="white"></path><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M8.50195 9.34036C8.50195 10.0352 9.07976 10.6143 9.77312 10.6143C10.4896 10.6143 11.0443 10.0584 11.0443 9.34036C11.0443 8.64547 10.4665 8.06641 9.77312 8.06641C9.07976 8.06641 8.50195 8.64547 8.50195 9.34036Z" fill="white"></path><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M16.8917 18.6518H19.0873V14.7836C19.0873 12.8843 18.6713 11.425 16.4525 11.425C15.3894 11.425 14.6729 12.0041 14.3724 12.56H14.3493V11.5871H12.2461V18.6518H14.4418V15.1542C14.4418 14.2509 14.6267 13.3475 15.7592 13.3475C16.8686 13.3475 16.8917 14.413 16.8917 15.2237V18.6518Z" fill="white"></path></svg></a><a target="_blank" rel="me" class="group transition-colors duration-300 text-heading-black hover:text-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Footer Mastodon logo"}" href="https://hachyderm.io/@tailscale"><svg width="28" height="29" viewBox="0 0 28 29" fill="none" xmlns="http://www.w3.org/2000/svg"><rect y="0.988281" width="28" height="28" rx="14" fill="currentColor"></rect><path class="transition-colors duration-300 group-hover:fill-heading-black" fill="white" d="M19.9516 10.8781C19.7667 9.48128 18.5693 8.38051 17.1498 8.16721C16.9104 8.13117 16.003 8 13.9011 8H13.8854C11.7829 8 11.3319 8.13117 11.0924 8.16721C9.71243 8.3746 8.45223 9.3637 8.14648 10.777C7.99942 11.4731 7.98373 12.2447 8.01105 12.9526C8.04999 13.9677 8.05755 14.981 8.14823 15.992C8.21091 16.6635 8.32027 17.3297 8.47548 17.9855C8.76612 19.1968 9.94262 20.2048 11.0953 20.616C12.3294 21.0449 13.6566 21.1161 14.9282 20.8216C15.0681 20.7886 15.2065 20.7502 15.3432 20.7064C15.6519 20.6066 16.014 20.4949 16.2803 20.2987C16.2839 20.296 16.2869 20.2924 16.289 20.2883C16.2911 20.2842 16.2923 20.2797 16.2925 20.2751V19.2955C16.2924 19.2911 16.2914 19.2869 16.2895 19.283C16.2876 19.2791 16.2849 19.2758 16.2815 19.2731C16.2782 19.2704 16.2743 19.2686 16.2702 19.2676C16.266 19.2667 16.2617 19.2667 16.2576 19.2677C15.4429 19.4655 14.608 19.5647 13.7703 19.5631C12.3288 19.5631 11.941 18.8677 11.83 18.5782C11.7408 18.3279 11.6841 18.0669 11.6614 17.8018C11.6612 17.7973 11.662 17.7929 11.6638 17.7888C11.6656 17.7847 11.6683 17.7811 11.6717 17.7783C11.6751 17.7755 11.6791 17.7735 11.6834 17.7726C11.6876 17.7716 11.6921 17.7717 11.6963 17.7728C12.4975 17.9693 13.3188 18.0685 14.1429 18.0682C14.3411 18.0682 14.5387 18.0682 14.737 18.0629C15.5659 18.0393 16.4395 17.9962 17.255 17.8343C17.2754 17.8301 17.2957 17.8266 17.3132 17.8213C18.5995 17.5701 19.8237 16.7819 19.9481 14.786C19.9527 14.7074 19.9644 13.963 19.9644 13.8814C19.965 13.6043 20.0521 11.9156 19.9516 10.8781ZM17.9718 15.8584H16.6191V12.4905C16.6191 11.7815 16.3285 11.4199 15.7373 11.4199C15.0875 11.4199 14.762 11.8477 14.762 12.6926V14.5361H13.4175V12.6926C13.4175 11.8477 13.0914 11.4199 12.4415 11.4199C11.8538 11.4199 11.5603 11.7815 11.5597 12.4905V15.8584H10.2083V12.3883C10.2083 11.6793 10.3863 11.116 10.7425 10.6985C11.1098 10.2819 11.5917 10.068 12.1898 10.068C12.8821 10.068 13.4053 10.3386 13.754 10.8793L14.0906 11.4536L14.4277 10.8793C14.7765 10.3386 15.2996 10.068 15.9908 10.068C16.5883 10.068 17.0702 10.2819 17.4387 10.6985C17.7949 11.1156 17.9729 11.6789 17.9729 12.3883L17.9718 15.8584Z"></path></svg></a><a target="_blank" class="group transition-colors duration-300 text-heading-black hover:text-gray-200" data-track="Link Clicked" data-track-properties="{"label": "Footer Youtube logo"}" href="https://www.youtube.com/@Tailscale"><svg width="28" height="28" viewBox="0 0 28 28" fill="none" xmlns="http://www.w3.org/2000/svg"><rect x="0.658203" width="27.2195" height="27.2195" rx="13.6098" fill="currentColor"></rect><path class=" transition-colors duration-300 group-hover:fill-heading-black" d="M19.6754 11.46C19.5368 10.5863 19.121 9.98138 18.1506 9.84696C16.6258 9.57813 14.2693 9.57812 14.2693 9.57812C14.2693 9.57812 11.9128 9.57813 10.388 9.84696C9.4177 9.98138 8.93254 10.5863 8.86323 11.46C8.72461 12.3337 8.72461 13.6106 8.72461 13.6106C8.72461 13.6106 8.72461 14.8876 8.86323 15.7613C9.00185 16.635 9.4177 17.2399 10.388 17.3743C11.9128 17.6432 14.2693 17.6432 14.2693 17.6432C14.2693 17.6432 16.6258 17.6432 18.1506 17.3743C19.121 17.1727 19.5368 16.635 19.6754 15.7613C19.814 14.8876 19.814 13.6106 19.814 13.6106C19.814 13.6106 19.814 12.3337 19.6754 11.46ZM12.8831 15.6269V11.5944L16.3486 13.6106L12.8831 15.6269Z" fill="white"></path></svg></a></div><div class="t-14 flex flex-wrap tracking-[0.07px] xxs:col-span-2 md:col-span-12 text-heading-black/60 ">© 2025 Tailscale Inc. All rights reserved. Tailscale is a registered trademark of Tailscale Inc.</div></div></div></footer><script src="/_next/static/chunks/webpack-404272c67fa5cfdf.js" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0]);self.__next_f.push([2,null])</script><script>self.__next_f.push([1,"1:HL[\"/_next/static/media/503dd21c3e9aa947-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n2:HL[\"/_next/static/media/59aafc96071162d7-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n3:HL[\"/_next/static/media/6190d09d67eb8e2d-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n4:HL[\"/_next/static/media/6267f766bc823bf8-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n5:HL[\"/_next/static/media/ce17880c21b59d21-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n6:HL[\"/_next/static/media/d3470cfc68a51edd-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n7:HL[\"/_next/static/css/425118351a398cbb.css\",\"style\"]\n8:HL[\"/_next/static/css/a0e3644f19e455e6.css\",\"style\"]\n"])</script><script>self.__next_f.push([1,"9:I[12846,[],\"\"]\nc:I[4707,[],\"\"]\nd:I[36423,[],\"\"]\nf:I[13542,[\"8003\",\"static/chunks/8003-0833c71e6161cb44.js\",\"3185\",\"static/chunks/app/layout-54c1176bfefb7426.js\"],\"default\"]\n11:I[61060,[],\"\"]\n12:[]\n"])</script><script>self.__next_f.push([1,"0:[\"$\",\"$L9\",null,{\"buildId\":\"I2t8Ny3X1DWyLcNaPcJOT\",\"assetPrefix\":\"\",\"urlParts\":[\"\",\"changelog\"],\"initialTree\":[\"\",{\"children\":[\"(marketing)\",{\"children\":[\"changelog\",{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],\"initialSeedData\":[\"\",{\"children\":[\"(marketing)\",{\"children\":[\"changelog\",{\"children\":[\"__PAGE__\",{},[[\"$La\",\"$Lb\",null],null],null]},[null,[\"$\",\"$Lc\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\",\"(marketing)\",\"children\",\"changelog\",\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$Ld\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"notFoundStyles\":\"$undefined\"}]],null]},[[null,\"$Le\"],null],null]},[[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/425118351a398cbb.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/a0e3644f19e455e6.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"className\":\"__className_943d4e\",\"children\":[\"$\",\"body\",null,{\"children\":[\"$\",\"$Lf\",null,{\"children\":[\"$\",\"$Lc\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$Ld\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"padding\":\"0 23px 0 0\",\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\",\"lineHeight\":\"49px\"},\"children\":\"404\"}],[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"49px\",\"margin\":0},\"children\":\"This page could not be found.\"}]}]]}]}]],\"notFoundStyles\":[]}]}]}]}]],null],null],\"couldBeIntercepted\":false,\"initialHead\":[null,\"$L10\"],\"globalErrorComponent\":\"$11\",\"missingSlots\":\"$W12\"}]\n"])</script><script>self.__next_f.push([1,"10:[[\"$\",\"meta\",\"0\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}],[\"$\",\"meta\",\"1\",{\"name\":\"theme-color\",\"content\":\"#fff\"}],[\"$\",\"meta\",\"2\",{\"charSet\":\"utf-8\"}],[\"$\",\"title\",\"3\",{\"children\":\"Changelog · Tailscale\"}],[\"$\",\"meta\",\"4\",{\"name\":\"description\",\"content\":\"View changes to the Tailscale client and service.\"}],[\"$\",\"link\",\"5\",{\"rel\":\"alternate\",\"type\":\"application/rss+xml\",\"title\":\"Tailscale Blog\",\"href\":\"https://tailscale.com/blog/index.xml\"}],[\"$\",\"link\",\"6\",{\"rel\":\"alternate\",\"type\":\"application/rss+xml\",\"title\":\"Tailscale Changelog\",\"href\":\"https://tailscale.com/changelog/index.xml\"}],[\"$\",\"link\",\"7\",{\"rel\":\"alternate\",\"type\":\"application/rss+xml\",\"title\":\"Tailscale Security Bulletins\",\"href\":\"https://tailscale.com/security-bulletins/index.xml\"}],[\"$\",\"meta\",\"8\",{\"property\":\"og:title\",\"content\":\"Tailscale\"}],[\"$\",\"meta\",\"9\",{\"property\":\"og:description\",\"content\":\"View changes to the Tailscale client and service.\"}],[\"$\",\"meta\",\"10\",{\"property\":\"og:image\",\"content\":\"https://tailscale.com/files/images/og-image.png\"}],[\"$\",\"meta\",\"11\",{\"property\":\"og:type\",\"content\":\"website\"}],[\"$\",\"meta\",\"12\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"13\",{\"name\":\"twitter:creator\",\"content\":\"@tailscale\"}],[\"$\",\"meta\",\"14\",{\"name\":\"twitter:title\",\"content\":\"Tailscale\"}],[\"$\",\"meta\",\"15\",{\"name\":\"twitter:description\",\"content\":\"View changes to the Tailscale client and service.\"}],[\"$\",\"meta\",\"16\",{\"name\":\"twitter:image\",\"content\":\"https://tailscale.com/files/images/og-image.png\"}],[\"$\",\"link\",\"17\",{\"rel\":\"icon\",\"href\":\"/favicon.png\",\"type\":\"image/png\"}],[\"$\",\"link\",\"18\",{\"rel\":\"icon\",\"href\":\"/favicon.svg\",\"type\":\"image/svg+xml\"}],[\"$\",\"meta\",\"19\",{\"name\":\"next-size-adjust\"}]]\na:null\n"])</script><script>self.__next_f.push([1,"13:I[6523,[\"2972\",\"static/chunks/2972-04611c7b37409cb4.js\",\"4391\",\"static/chunks/app/(marketing)/changelog/page-4734b55cb7463df0.js\"],\"ChangelogNavigation\"]\n14:I[6523,[\"2972\",\"static/chunks/2972-04611c7b37409cb4.js\",\"4391\",\"static/chunks/app/(marketing)/changelog/page-4734b55cb7463df0.js\"],\"ChangelogPostList\"]\n15:T8e8,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1232/derp-servers\"\u003eDERP\u003c/a\u003e functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use \u003ca href=\"https://letsencrypt.org/\"\u003eLet's Encrypt\u003c/a\u003e or WebPKI certificates.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eGo is updated to version 1.24.1\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eNAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available, in the event of a slow or misbehaving server.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1457/captive-portals\"\u003eCaptive portal\u003c/a\u003e detection reliability is improved on some in-flight Wi-Fi networks, including British Airways and WestJet.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003ePort mapping success rate is improved by retrying in additional error cases.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1325/device-web-interface\"\u003eWeb interface\u003c/a\u003e setting changes occur as expected and without error.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003ca href=\"https://pkgs.tailscale.com/stable/#macos\"\u003e.pkg installer\u003c/a\u003e size is decreased by 35%.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eMemory leak issue related to \u003ca href=\"/kb/1233/mac-ios-shortcuts\"\u003eshortcuts\u003c/a\u003e is resolved.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1081/magicdns\"\u003eMagicDNS\u003c/a\u003e intermittent configuration failures no longer occur when waking from sleep.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eSeamless \u003ca href=\"/kb/1028/key-expiry#renewing-keys-for-an-expired-device\"\u003ekey renewals\u003c/a\u003e occur as expected, ensuring the client remains connected.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eMemory leak issue related to \u003ca href=\"/kb/1233/mac-ios-shortcuts\"\u003eshortcuts\u003c/a\u003e is resolved.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1081/magicdns\"\u003eMagicDNS\u003c/a\u003e intermittent configuration failures no longer occur when waking from sleep.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e The Android client release for v1.82.0 was delayed and moved into the v1.82.1 client release instead.\u003c/p\u003e\n\u003ch6\u003eApp connectors\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1411/device-connectivity#port-mapping\"\u003ePort mapping\u003c/a\u003e success rates for \u003ca href=\"/kb/1281/app-connectors\"\u003eapp connectors\u003c/a\u003e are improved.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"16:T470,\u003cp\u003ev0.18.0 of the \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest\"\u003eTailscale Terraform Provider\u003c/a\u003e has been released with the following changes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/logstream_configuration\"\u003etailscale_logstream_configuration\u003c/a\u003e resource can now manage streaming to \u003ca href=\"/kb/1255/log-streaming?tab=amazon+s3#add-configuration-log-streaming\"\u003eAmazon S3\u003c/a\u003e and \u003ca href=\"/kb/1255/log-streaming?tab=s3-compatible#add-configuration-log-streaming\"\u003eS3-compatible services\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/tailnet_key\"\u003etailscale_tailnet_key\u003c/a\u003e resource can now be imported.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdded a \u003ccode\u003ereset_acl_on_destroy\u003c/code\u003e property to the \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/acl\"\u003etailscale_acl\u003c/a\u003e resource which optionally allows for resetting the Tailscale policy file to its default when the resource is destroyed.\u003c/li\u003e\n\u003c/ul\u003e\n17:T4f8,\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eNodes could lose the display names of owners of peers in rare cases. This had manifested in missing names in \u003ca href=\"/kb/1080/cli#status\"\u003e\u003ccode\u003etailscale status\u003c/code\u003e\u003c/a\u003e and could prevent incoming \u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e connections from being accepted. The behavior is reverted to that of v1.78.x and earlier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSSH clients that skip the \u003ca href=\"/kb/1193/tailscale-ssh#authentication-and-authorization\"\u003e\u003ccode\u003enone\u003c/code\u003e\u003c/a\u003e auth method and immediately try \u003ccode\u003epublickey\u003c/code\u003e can connect to \u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e as expected. The behavior is reverted to that of v1.78.x and earlier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSSH clients that skip the \u003ccode\u003enone\u003c/code\u003e auth method and immediately try \u003ccode\u003epublic"])</script><script>self.__next_f.push([1,"key\u003c/code\u003e can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eFreeBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSSH clients that skip the \u003ccode\u003enone\u003c/code\u003e auth method and immediately try \u003ccode\u003epublickey\u003c/code\u003e can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.\u003c/li\u003e\n\u003c/ul\u003e\n18:T473,\u003cp\u003eA new release of the \u003ca href=\"/kb/1282/docker\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\"https://hub.docker.com/r/tailscale/tailscale\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eTLS certificate requests from \u003ca href=\"https://letsencrypt.org\"\u003eLet’s Encrypt\u003c/a\u003e include the device's DNS name in the CSR’s SAN extension and set the \u003ccode\u003eCommon Name\u003c/code\u003e field.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1223/funnel\"\u003eTailscale Funnel\u003c/a\u003e configuration on devices displays errors when \u003ca href=\"/kb/1072/client-preferences#allow-incoming-connections\"\u003eincoming connections\u003c/a\u003e are not permitted and connections are disallowed.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTailscale Funnel disabled on a device no longer displays as enabled in the admin console.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eServe config provided using the \u003ccode\u003eTS_SERVE_CONFIG\u003c/code\u003e environment variable successfully loads for tailnets with HTTPS disabled, as long as the serve config does not define an HTTPS endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n19:T524,\u003cp\u003eA new release of the \u003ca href=\"/kb/1236/kubernetes-operator\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\"/kb/1236/kubernetes-operator#installation\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eThe optional \u003ca href=\"/kb/1445/kubernetes-operator-customization#prometheus-servicemonitor\"\u003e\u003ccode\u003eServiceMonitor\u003c/code\u003e\u003c/a\u003e created for the proxy metrics endpoints can be labelled with user-specified labels.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eProxies crea"])</script><script>self.__next_f.push([1,"ted for the Kubernetes Operator dynamically reload the \u003ca href=\"/kb/1278/tailscaled\"\u003etailscaled\u003c/a\u003e configuration when it has changed. Changes such as a hostname might mean slightly slower change propagation (up to a minute), but less downtime.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTLS certificate requests from \u003ca href=\"https://letsencrypt.org\"\u003eLet’s Encrypt\u003c/a\u003e include the device's DNS name in the CSR’s SAN extension and set the \u003ccode\u003eCommon Name\u003c/code\u003e field.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eImproved failover for egress \u003ca href=\"/kb/1438/kubernetes-operator-cluster-egress#configure-an-egress-service-using-proxygroup\"\u003e\u003ccode\u003eProxyGroup\u003c/code\u003e\u003c/a\u003e replicas. Replica restarts no longer cause downtime for cluster workloads that access tailnet targets using egress \u003ccode\u003eProxyGroup\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n1a:T131b,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1315/mdm-keys#set-whether-device-hostnames-can-be-modified\"\u003e\u003ccode\u003eHostname\u003c/code\u003e\u003c/a\u003e system policy is added for overriding the device hostname configured by the operating system, using an MDM solution.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli#configure\"\u003e\u003ccode\u003etailscale configure\u003c/code\u003e\u003c/a\u003e CLI command and corresponding subcommands are no longer in \u003ca href=\"/kb/1167/release-stages#alpha\"\u003ealpha\u003c/a\u003e, except for the subcommand \u003ccode\u003ekubeconfig\u003c/code\u003e, which remains in alpha.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1325/device-web-interface\"\u003eWeb interface\u003c/a\u003e displays a \u003cstrong\u003eLogin\u003c/strong\u003e button instead of the \u003cstrong\u003eReauthenticate\u003c/strong\u003e button when adding a new device to your tailnet.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1223/funnel\"\u003eTailscale Funnel\u003c/a\u003e configuration on devices displays errors when \u003ca href=\"/kb/1072/client-preferences#allow-incoming-connections\"\u003eincoming connections\u003c/a\u003e are not permitted and connections are disallowed.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eConnections to a \u003ca href=\"/blog/opensource#the-open-source-coordination-server\"\u003ecustom coordination server\u003c/a\u003e that does not support HTTPS will no longer fail when a custom port number is specified.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eTLS certificate requests from \u003ca href=\"https://letsencrypt.org\"\u003eLet’s Encrypt\u003c/a\u003e include the device's DNS name in the CSR’s SAN extension and set the \u003ccode\u003eCommon Name\u003c/code\u003e field.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1223/funnel\"\u003eTailscale Funnel\u003c/a\u003e disabled on a device no longer displays enabled in the admin console.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eOnboarding flow is added for easier initial setup of the app.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTLS certificate requests from \u003ca href=\"https://letsencrypt.org\"\u003eLet’s Encrypt\u003c/a\u003e include the device's DNS name in the CSR’s SAN extension and set the \u003ccode\u003eCommon Name\u003c/code\u003e field.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eClient installs as expected when using \u003ca href=\"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsi/8ac65057-0663-45e5-9718-f490e87945dc\"\u003eGroup Policy Software Installation\u003c/a\u003e (GPSI).\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eRace conditions that result in an incorrect state or a deadlock no longer cause issues when multiple Windows users are logged in simultaneously.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli#configure\"\u003e\u003ccode\u003econfigure sysext activate\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"/kb/1080/cli#configure\"\u003e\u003ccode\u003econfigure sysext deactivate\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"/kb/1080/cli#configure\"\u003e\u003ccode\u003econfigure sysext status\u003c/code\u003e\u003c/a\u003e CLI commands are added to the Standalone variant for managing the activation flow of the macOS system extension programmatically.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eStandalone variant detects if the system extension is manually disabled or uninstalled by the user and displays a notice in the client UI.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eFlush DNS Cache\u003c/strong\u003e option is added to the \u003ca href=\"/kb/1023/troubleshooting#debug-menu-and-options\"\u003eDebug menu\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTLS certificate requests from \u003ca href=\"https://letsencrypt.org\"\u003eLet’s Encrypt\u003c/a\u003e include the device's DNS name in the CSR’s SAN extension and set the \u003ccode\u003eCommon Name\u003c/code\u003e field.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eApp preferences re-set configures \u003cstrong\u003eUse Tailscale Subnets\u003c/strong\u003e to On and \u003cstrong\u003eAllow Incoming Connections\u003c/strong\u003e to Off as these are the default settings.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1233/mac-ios-shortcuts#find-devices\"\u003eFind Devices\u003c/a\u003e shortcut action no longer hangs.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eStandalone variant works as expected when users are not members of \u003ccode\u003estaff\u003c/code\u003e macOS user group.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1085/auth-keys\"\u003eAuth keys\u003c/a\u003e can be used for connecting to a \u003ca href=\"/blog/opensource#the-open-source-coordination-server\"\u003ecustom coordination server\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eVPN extension no longer runs when logging out.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1233/mac-ios-shortcuts#find-devices\"\u003eFind Devices\u003c/a\u003e shortcut action no longer hangs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1085/auth-keys\"\u003eAuth keys\u003c/a\u003e are supported for \u003ca href=\"/kb/1280/appletv#install-tailscale-on-tvos\"\u003eauthenticating an Apple TV\u003c/a\u003e in your tailnet.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAuth keys can be used for connecting to a \u003ca href=\"/blog/opensource#the-open-source-coordination-server\"\u003ecustom coordination server\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eVPN extension no longer runs when logging out.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eDevices can be configured as a \u003ca href=\"/kb/1019/subnets\"\u003esubnet router\u003c/a\u003e in the \u003cstrong\u003eSettings\u003c/strong\u003e menu of the app.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"1b:T10e6,"])</script><script>self.__next_f.push([1,"\u003cp\u003eA new release of the \u003ca href=\"/kb/1236/kubernetes-operator\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\"/kb/1236/kubernetes-operator#installation\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003eTailscale \u003ca href=\"/kb/1482/client-metrics\"\u003eclient metrics\u003c/a\u003e can be enabled using a \u003ccode\u003eProxyClass\u003c/code\u003e with the \u003ccode\u003e.spec.metrics.enable\u003c/code\u003e field set.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003eAll Tailscale container images are annotated with Open Container Initiative (OCI) \u003ca href=\"https://specs.opencontainers.org/image-spec/annotations/\"\u003eannotations\u003c/a\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003e\u003ccode\u003eProxyClass\u003c/code\u003e supports configuring topology spread constraints for the Proxy Pods.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003eConnector Custom Resource Definition (CRD) can be used to configure the Kubernetes Operator to deploy a Tailscale \u003ca href=\"/kb/1281/app-connectors\"\u003eapp connector\u003c/a\u003e on Kubernetes.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003eTailscale running on Kubernetes and using a \u003ca href=\"https://kubernetes.io/docs/concepts/configuration/secret\"\u003eKubernetes Secret\u003c/a\u003e as a state store writes Kubernetes Events to its Pod when changes occur to the state stored in the Kubernetes Secret. The same is true when there are errors related to reading or writing the state. This should help debugging issues related to transient errors when talking to the Kubernetes API server to retrieve or update the state Secret.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003eKubernetes Operator can optionally create a \u003ca href=\"https://prometheus-operator.dev/\"\u003ePrometheus ServiceMonitor\u003c/a\u003e for proxy resources that have Tailscale \u003ca href=\"/kb/1482/client-metrics\"\u003eclient metrics\u003c/a\u003e enabled.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003eContainer Storage Interface (CSI) driver volume for the operator's OAuth client credentials can be configured by using Helm values.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\n\u003cp\u003e\u003ca href=\"/kb/1439/kubernetes-operator-cluster-ingress\"\u003eKubernetes Ingress\u003c/a\u003e has clearer warnings if it has been deployed to a tailnet that has no HTTPS enabled. Specifically, a new warning in proxy logs and empty hostname on the Ingress status.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\n\u003cp\u003e\u003ccode\u003etailscale.com/tailnet-ip\u003c/code\u003e annotation is validated that it holds a valid IP address.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\n\u003cp\u003eTimeout for Kubernetes API server calls for reading/updating \u003ccode\u003etailscaled\u003c/code\u003e state stored in a Kubernetes Secret has been changed from 5 seconds to the total of 30 seconds for the read/update operation and an operation to emit an Event about the state update. This should reduce errors related to slow API server connections.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\n\u003cp\u003eThe \u003ccode\u003eProxyClass\u003c/code\u003e field \u003ccode\u003e.spec.metrics.enable\u003c/code\u003e enables metrics at both \u003ccode\u003e/metrics\u003c/code\u003e and \u003ccode\u003e/debug/metrics\u003c/code\u003e, but \u003ccode\u003e/debug/metrics\u003c/code\u003e is deprecated. Users relying on \u003ccode\u003e/debug/metrics\u003c/code\u003e need to set \u003ccode\u003e.spec.statefulSet.pod.tailscaleContainer.debug.enable\u003c/code\u003e (which is a new field in Tailscale 1.78.1) until Tailscale 1.82.0 releases. When 1.82.0 releases, \u003ccode\u003e/metrics\u003c/code\u003e and \u003ccode\u003e/debug/metrics\u003c/code\u003e will both independently default to false.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\n\u003cp\u003eKubernetes operator proxy containers created for ingress and egress Service resources, Connectors and ProxyGroups are privileged. This is needed because of recent changes in \u003ccode\u003econtainerd\u003c/code\u003e. For more context, see \u003ca href=\"https://github.com/tailscale/tailscale/pull/14262\"\u003etailscale/tailscale/pull/14262\u003c/a\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\n\u003cp\u003eTailscale running on Kubernetes reads its state from a Secret only once, and that is upon initial start. This should reduce bugs caused by transient issues when connecting to the Kubernetes API server as well as reduce the load on the API server and improve latency for state operations.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\n\u003cp\u003e\u003ca href=\"/kb/1438/kubernetes-operator-cluster-egress\"\u003eKubernetes Egress\u003c/a\u003e Service ports for \u003ccode\u003eProxyGroup\u003c/code\u003e can be changed from a single unnamed port to one or more named ports.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\n\u003cp\u003eClients should more accurately detect whether they are in a container when checking for updates.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"1c:Tf37,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1482/client-metrics\"\u003eClient metrics\u003c/a\u003e have been added, to provide insights into Tailscale client behavior, health, and performance.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli#metrics\"\u003e\u003ccode\u003etailscale metrics\u003c/code\u003e\u003c/a\u003e command has been added, to expose and collect client metrics for use with third-party monitoring systems.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli#syspolicy\"\u003e\u003ccode\u003etailscale syspolicy\u003c/code\u003e\u003c/a\u003e command has been added, to list \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policies\u003c/a\u003e, reload system policies, or view errors related to the system policies configured on the device.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTailscale system policies are applied immediately when pushed via mobile device management (MDM) or Group Policy, without requiring a client restart.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1246/tailscale-ssh-session-recording\"\u003eTailscale SSH session recording\u003c/a\u003e detects the disappearance of the recorder node sooner. This fix addresses a security vulnerability described in \u003ca href=\"/security-bulletins#ts-2024-013\"\u003eTS-2024-013\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eUI customization \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policies\u003c/a\u003e are configurable for both devices and users.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe macOS configuration report diagnostic tool can collect a larger amount of diagnostics when requested by Tailscale support. This includes system and process logs on the \u003ca href=\"/kb/1065/macos-variants#standalone-variant\"\u003eStandalone variant\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eUpdate Available\u003c/strong\u003e notifications include a link to the client changelog.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eOn macOS Sequoia, in \u003cstrong\u003eSystem Settings.app\u003c/strong\u003e \u003e \u003cstrong\u003eLogin Items \u0026#x26; Extension\u003c/strong\u003e, Tailscale is listed as \u003cstrong\u003eTailscale Network Extension\u003c/strong\u003e instead of \u003cstrong\u003eIPNExtension\u003c/strong\u003e, to reduce user confusion.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003ePerformance optimizations reduce CPU and memory usage when parsing network maps, especially for users on larger and busy tailnets.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003ePerformance optimizations at the UI layer reduce flickering of the menus, especially for users on larger and busy tailnets where the contents of the network map change very frequently.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eError messages displayed when failing to toggle a setting are improved and easier to understand.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eOn iPhones and iPads running iOS 18, the VPN can be toggled from Control Center. Hold down in an empty space to add the Tailscale Control.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAuthentication by using a \u003ca href=\"/kb/1079/install-android#use-a-generated-code\"\u003egenerated code\u003c/a\u003e is available for Android TV users.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSearch bar shows suggestions.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eThe default avatar displays if the user has no profile picture.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFalse positive health warnings in the UI are reduced.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eHealth warnings are no longer displayed in the UI after stopping Tailscale.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eCrashes when sharing a file using \u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e from another Android app are reduced.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eUI padding of the main app toolbar is improved.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"1d:Tdf2,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eClients lacking UDP connectivity no longer skip performing fallback latency measurements with \u003ca href=\"/kb/1232/derp-servers\"\u003eDERP servers\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eWarnings no longer display unnecessarily.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTailscale connectivity on flights using Inflight Internet Wi-Fi (such as Alaska Airlines) no longer fails.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eService-related processes no longer run unnecessarily when services are disabled on the tailnet.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eError messages include explanations in addition to the HTTP status code.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e supports sending environment variables to hosts. It's also possible to specify permitted environment variables using the \u003ccode\u003eacceptEnv\u003c/code\u003e field.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e no longer breaks some terminal applications by omitting pixel width and height when resizing the application window.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003ePing messages sent through \u003ca href=\"/kb/1019/subnets\"\u003esubnet routers\u003c/a\u003e to unreachable hosts no longer generate ping responses.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e supports sending environment variables to hosts. You must specify permitted environment variables using the \u003ccode\u003eacceptEnv\u003c/code\u003e field.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eTailscale \u003ccode\u003e.pkg\u003c/code\u003e installer for the \u003ca href=\"/kb/1065/macos-variants#standalone-variant\"\u003estandalone variant\u003c/a\u003e prevents potential conflicts by showing a warning if it detects a Homebrew install of Tailscale.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1225/fast-user-switching\"\u003eBug report\u003c/a\u003e view shows a warning if Tailscale detects that Cloudflare WARP is installed. Some Cloudflare WARP configurations conflict with Tailscale.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDNS settings no longer improperly set when keys expire or Tailscale stops.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eBattery usage is improved when \u003ca href=\"/kb/1081/magicdns\"\u003eMagicDNS\u003c/a\u003e is enabled. The improvement comes from adjusting the timeout of \u003ca href=\"/kb/1381/what-is-quad100#10010010010053-is-a-dns-resolver\"\u003eDNS over HTTPS (DoH)\u003c/a\u003e for idle connections and requiring a TLS 1.3 handshake when establishing a connection with the DoH server.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDNS settings no longer improperly set when keys expire or Tailscale stops.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eDNS settings no longer improperly set when keys expire or Tailscale stops.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1225/fast-user-switching\"\u003eAccount switcher\u003c/a\u003e displays the server hostname if the account uses a custom coordination server.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBattery usage is improved when \u003ca href=\"/kb/1081/magicdns\"\u003eMagicDNS\u003c/a\u003e is enabled. The improvement comes from adjusting the timeout of \u003ca href=\"/kb/1381/what-is-quad100#10010010010053-is-a-dns-resolver\"\u003eDNS over HTTPS (DoH)\u003c/a\u003e for idle connections and requiring a TLS 1.3 handshake when establishing a connection with the DoH server.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eQuick tile toggle no longer fails to turn on Tailscale if Tailscale had been manually disconnected before it was last shut down.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- ###### NAS platforms\n\n###### Synology\n\n###### QNAP\n\n###### UNRAID\n\n###### FreeBSD\n\n###### OpenBSD\n\n###### Gokrazy\n\n###### WASI --\u003e\n"])</script><script>self.__next_f.push([1,"1e:T887,"])</script><script>self.__next_f.push([1,"\u003cp\u003ev0.17.0 of the \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest\"\u003eTailscale Terraform Provider\u003c/a\u003e has been released with the following changes:\u003c/p\u003e\n\u003ch5\u003eResources\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eManage \u003ca href=\"/kb/1213/webhooks\"\u003ewebhooks\u003c/a\u003e with \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/webhook\"\u003e\u003ccode\u003etailscale_webhook\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eManage \u003ca href=\"/kb/1224/contact-preferences\"\u003econtact preferences\u003c/a\u003e with \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/contacts\"\u003e\u003ccode\u003etailscale_contacts\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eManage \u003ca href=\"/kb/1288/device-posture\"\u003edevice posture integrations\u003c/a\u003e with \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/posture_integration\"\u003e\u003ccode\u003etailscale_posture_integration\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eManage \u003ca href=\"/kb/1255/log-streaming\"\u003elog streaming\u003c/a\u003e with \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/logstream_configuration\"\u003e\u003ccode\u003etailscale_logstream_configuration\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eManage \u003ca href=\"/api#tag/tailnetsettings/GET/tailnet/%7Btailnet%7D/settings\"\u003eTailnet settings\u003c/a\u003e with \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/tailnet_settings\"\u003e\u003ccode\u003etailscale_tailnet_settings\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eChanging the domain attribute for \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/dns_split_nameservers\"\u003e\u003ccode\u003etailcale_dns_split_nameservers\u003c/code\u003e\u003c/a\u003e now properly removes the previous domain value.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003eData Sources\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eFetch information for multiple users with \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/data-sources/users\"\u003e\u003ccode\u003etailcale_users\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eFetch information for a specific user with \u003ca href=\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/data-sources/user\"\u003e\u003ccode\u003etailscale_user\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"1f:Tb78,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1315/mdm-keys#set-an-auth-key\"\u003e\u003ccode\u003eAuthKey\u003c/code\u003e\u003c/a\u003e system policy can be used to authenticate a device with Tailscale using an \u003ca href=\"/kb/1362/mdm\"\u003eMDM solution\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli#dns\"\u003e\u003ccode\u003etailscale dns\u003c/code\u003e\u003c/a\u003e CLI command is added for accessing \u003ca href=\"/kb/1054/dns\"\u003eTailscale DNS\u003c/a\u003e settings and status.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eGo is updated to version 1.23.1.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"kb/1226/tailnet-lock\"\u003eTailnet Lock\u003c/a\u003e long rotation signatures are truncated automatically to avoid excessive growth.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003cstrong\u003eLog In\u003c/strong\u003e option in the client works as expected.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://docs.kernel.org/networking/segmentation-offloads.html#generic-receive-offload\"\u003eTCP generic receive offload\u003c/a\u003e (GRO) support is added for improved userspace mode throughput.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"https://docs.kernel.org/networking/segmentation-offloads.html#tcp-segmentation-offload\"\u003eTCP generic segmentation offload\u003c/a\u003e (GSO) is re-introduced for supporting improved userspace mode throughput. This was initially introduced in Tailscale v1.72.0 and then rolled back in v1.72.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eThe client no longer connects to a tailnet automatically when restarting or switching profiles.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eProfiles created as Local System with Unattended Mode enabled are retained after a reboot.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003ca href=\"https://github.com/tailscale/tailscale/wiki/Tailscaled-on-macOS\"\u003eopen-source variant\u003c/a\u003e of the Tailscale client can now read the system \u003ca href=\"/kb/1054/dns\"\u003eDNS configuration\u003c/a\u003e to provide DNS resolution when \u003ca href=\"/kb/1080/cli#set\"\u003e\u003ccode\u003etailscale set -—accept-dns\u003c/code\u003e\u003c/a\u003e or \u003ca href=\"/kb/1241/tailscale-up\"\u003e\u003ccode\u003etailscale up -—accept-dns\u003c/code\u003e\u003c/a\u003e is enabled and the \u003cstrong\u003eOverride local DNS\u003c/strong\u003e option in the \u003ca href=\"https://login.tailscale.com/admin/dns\"\u003e\u003cstrong\u003eDNS\u003c/strong\u003e\u003c/a\u003e page of the admin console is disabled.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDNS resolution continues to work after a key expires.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1280/appletv#test-device-latency\"\u003eping\u003c/a\u003e feature allows you to observe connectivity performance between your Apple TV and other devices in your tailnet.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e The Android client release for v1.74.0 was delayed and moved into the v1.74.1 client release instead.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1054/dns\"\u003eTailscale DNS\u003c/a\u003e works as expected when switching between Wi-Fi and cellular networks.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1315/mdm-keys\"\u003eSystem policies\u003c/a\u003e for the Android client on ChromeOS work as expected.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"20:Tb7a,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1457/captive-portals\"\u003eCaptive portal detection\u003c/a\u003e is now supported.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1080/cli/#cert\"\u003e\u003ccode\u003etailscale cert\u003c/code\u003e\u003c/a\u003e command now contains the \u003ccode\u003e--min-validity\u003c/code\u003e flag. Use this flag to request a specified minimum remaining validity on the returned certificate. This flag is intended for automation, like cron jobs, that periodically refreshes certificates.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1243/tailscale-lock\"\u003e\u003ccode\u003etailscale lock\u003c/code\u003e\u003c/a\u003e command now supports passing keys as files. To pass a key as a file, use the prefix \u003ccode\u003efile:\u003c/code\u003e followed by the path to the file: \u003ccode\u003efile:\u0026#x3C;path-to-key-file\u003e\u003c/code\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eA health warning is now raised if Tailscale is unable to forward DNS queries to the configured resolvers.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eAn increase in send and receive buffer sizes for userspace mode TCP improves throughput over high latency paths.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eThe addition of TCP generic segmentation offload (GSO) support to userspace mode improves throughput.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cp\u003e\u003cem\u003eNote\u003c/em\u003e: macOS 10.15 Catalina is no longer supported. See the \u003ca href=\"/changelog#2024-02-15\"\u003ev1.60.0 changelog\u003c/a\u003e for our initial end of life announcement.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eNotifications are sent when a captive portal is detected.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eHealth warnings in the UI are now sorted by their severity level.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eReliability of the authentication process when launching the web browser is improved.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eThe VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling \u003ca href=\"/kb/1291/ios-vpn-on-demand\"\u003eVPN On Demand\u003c/a\u003e first.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eNotifications are sent when a captive portal is detected.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eHealth warnings are displayed when connectivity is impacted.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eAn error message is displayed while attempting to start the VPN when both Wi-Fi and cellular interfaces are down, instead of failing silently.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eThe VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling \u003ca href=\"/kb/1291/ios-vpn-on-demand\"\u003eVPN On Demand\u003c/a\u003e first.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eNotifications are sent when a captive portal is detected.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eThe VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling \u003ca href=\"/kb/1291/ios-vpn-on-demand\"\u003eVPN On Demand\u003c/a\u003e first.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eHealth warnings, if any are present, are displayed in the main view of the app.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"21:T1741,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eRestrict \u003ca href=\"/kb/1392/auto-exit-nodes\"\u003erecommended\u003c/a\u003e and automatically selected exit nodes using the new \u003ccode\u003eAllowedSuggestedExitNodes\u003c/code\u003e \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e. Applies only to platforms that support \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policies\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved \u003ca href=\"/blog/how-nat-traversal-works\"\u003eNAT traversal\u003c/a\u003e for some uncommon scenarios.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eOptimized \u003ca href=\"/kb/1018/acls\"\u003esending firewall rules to clients\u003c/a\u003e more efficiently.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1392/auto-exit-nodes\"\u003eExit node suggestion\u003c/a\u003e CLI command now prints the hostname (which you can use with the \u003ca href=\"/kb/1080/cli#set\"\u003e\u003ccode\u003etailscale set\u003c/code\u003e\u003c/a\u003e command).\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1369/taildrive\"\u003eTaildrive\u003c/a\u003e share paths configured through the CLI resolve relative to where you run the \u003ccode\u003etailscale\u003c/code\u003e command.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSwitching from unstable to stable tracks using the \u003ca href=\"/kb/1080/cli#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command now works correctly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUse the value \u003ccode\u003eauto:any\u003c/code\u003e to automatically select an \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit node\u003c/a\u003e for the existing \u003ccode\u003eExitNodeID\u003c/code\u003e \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e. Available for \u003ca href=\"/pricing\"\u003eEnterprise plan\u003c/a\u003e users only.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe new \u003ccode\u003eAllowedSuggestedExitNodes\u003c/code\u003e \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e restricts which exit nodes Tailscale \u003ca href=\"/kb/1392/auto-exit-nodes\"\u003erecommends\u003c/a\u003e or automatically selects.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDNS leak issue.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eSwitching from unstable to stable tracks using the \u003ca href=\"/kb/1080/cli#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command now works correctly.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1369/taildrive\"\u003eTaildrive\u003c/a\u003e server no longer starts unnecessarily when no drives are configured.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: As previously announced, Tailscale v1.70 is the last version to support macOS 10.15 Catalina. macOS 10.15 is no longer supported by Apple and no longer receives security updates. Users still running macOS 10.15 should update to a newer version of macOS to continue receiving security updates and new features.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eToggle Tailscale DNS from Siri or the Shortcuts app.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eReceive health notifications in the client menu on macOS to inform you about lack of internet connectivity, firewalls blocking Tailscale, misconfiguration issues, and other issues. Health issues that affect \u003ca href=\"/kb/1411/device-connectivity\"\u003econnectivity\u003c/a\u003e also change the Tailscale icon in the system menubar to show an exclamation mark.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eOn MacBooks with a notch in the display, a notification window will now appear if the Tailscale icon is hidden behind the notch due to too many menubar items.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe Tailscale client now warns you when the built-in macOS \u003ca href=\"/kb/1420/macos-webfilterproxyd\"\u003econtent filter (Screen Time)\u003c/a\u003e prevents Tailscale from connecting.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse the value \u003ccode\u003eauto:any\u003c/code\u003e to automatically select an exit node for the existing \u003ccode\u003eExitNodeID\u003c/code\u003e \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e. Available for \u003ca href=\"/pricing\"\u003eEnterprise plan\u003c/a\u003e users only.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe exit node picker no longer presents exit node suggestions if the organization enforces always using the suggested exit node using the \u003ccode\u003eExitNodeID\u003c/code\u003e \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDisconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1369/taildrive\"\u003eTaildrive\u003c/a\u003e server no longer starts unnecessarily when no drives are configured.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eIncreased the reliability of the \u003cstrong\u003eInstall Updates Automatically\u003c/strong\u003e setting.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eToggle Tailscale DNS from Siri or the Shortcuts app.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse the value \u003ccode\u003eauto:any\u003c/code\u003e to automatically select an exit node for the existing \u003ccode\u003eExitNodeID\u003c/code\u003e \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e. Available for \u003ca href=\"/pricing\"\u003eEnterprise plan\u003c/a\u003e users only.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"https://github.com/WireGuard/wireguard-go/pull/106\"\u003e\u003ccode\u003ewireguard-go\u003c/code\u003e\u003c/a\u003e memory pool deadlock issue is resolved.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDisconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eUser interface no longer flickers when selecting an exit node.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUse the value \u003ccode\u003eauto:any\u003c/code\u003e to automatically select an exit node for the existing \u003ccode\u003eExitNodeID\u003c/code\u003e \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e. Available for \u003ca href=\"/pricing\"\u003eEnterprise plan\u003c/a\u003e users only.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"https://github.com/WireGuard/wireguard-go/pull/106\"\u003e\u003ccode\u003ewireguard-go\u003c/code\u003e\u003c/a\u003e memory pool deadlock issue is resolved.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eUser interface no longer flickers when selecting an exit node.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAccess ping information and connection status by long-pressing on a device in the devices list and selecting \u003cstrong\u003ePing\u003c/strong\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse \u003ca href=\"/kb/1444/android-app-split-tunneling\"\u003esplit tunneling\u003c/a\u003e to force or exclude app traffic through your tailnet.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"https://github.com/WireGuard/wireguard-go/pull/106\"\u003e\u003ccode\u003ewireguard-go\u003c/code\u003e\u003c/a\u003e memory pool deadlock issue is resolved.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"22:T19a6,"])</script><script>self.__next_f.push([1,"\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAccess an \u003ca href=\"https://api.tailscale.com/api/v2\"\u003eOpenAPI spec for the Tailscale API\u003c/a\u003e. The spec is used to generate our new interactive documentation. Note that the spec definition may change without notice, so should not be relied upon for stability.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAccess \u003ca href=\"/api\"\u003einteractive documentation\u003c/a\u003e for the Tailscale API.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eNew API endpoints\u003c/h4\u003e\n\u003cp\u003eWe have added the following endpoints to Tailscale's public API:\u003c/p\u003e\n\u003ch5\u003eLogging endpoints\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream/status\"\u003eGet log streaming status\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream\"\u003eGet log streaming configuration\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/logging/PUT/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream\"\u003eSet log streaming configuration\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/logging/DELETE/tailnet/%7Btailnet%7D/logging/%7BlogType%7D/stream\"\u003eDisable log streaming\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eCreated a new endpoint for \u003ca href=\"/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/configuration\"\u003elisting configuration audit logs\u003c/a\u003e. An earlier version of this endpoint is still supported for backwards compatibility.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eCreated a new endpoint for \u003ca href=\"/api#tag/logging/GET/tailnet/%7Btailnet%7D/logging/network\"\u003elisting network flow logs\u003c/a\u003e. An earlier version of this endpoint is still supported for backwards compatibility.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003eWebhook management endpoints\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://tailscale.com/api#tag/webhooks/GET/tailnet/%7Btailnet%7D/webhooks\"\u003eList all webhooks for a tailnet\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://tailscale.com/api#tag/webhooks/POST/tailnet/%7Btailnet%7D/webhooks\"\u003eCreate a new webhook\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://tailscale.com/api#tag/webhooks/PATCH/webhooks/%7BendpointId%7D\"\u003eUpdate a webhook\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://tailscale.com/api#tag/webhooks/DELETE/webhooks/%7BendpointId%7D\"\u003eDelete a webhook\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://tailscale.com/api#tag/webhooks/POST/webhooks/%7BendpointId%7D/test\"\u003eTest a webhook\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://tailscale.com/api#tag/webhooks/POST/webhooks/%7BendpointId%7D/rotate\"\u003eRotate a webhook secret\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003eDevice posture endpoints\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceposture/GET/tailnet/%7Btailnet%7D/posture/integrations\"\u003eList all posture integrations\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceposture/POST/tailnet/%7Btailnet%7D/posture/integrations\"\u003eCreate a posture integration\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceposture/PATCH/posture/integrations/%7Bid%7D\"\u003eUpdate a posture integration\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceposture/DELETE/posture/integrations/%7Bid%7D\"\u003eDelete a posture integration\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003eUser management endpoints\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/users/GET/tailnet/%7Btailnet%7D/users\"\u003eList all users in the tailnet\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/users/GET/users/%7BuserId%7D\"\u003eGet details about a specific user\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/users/POST/users/%7BuserId%7D/role\"\u003eUpdate the role for a specific user\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/users/POST/users/%7BuserId%7D/approve\"\u003eApprove a pending user's access to the tailnet\u003c/a\u003e. This is only applicable to tailnets that have enabled \u003ca href=\"/kb/1239/user-approval\"\u003euser approval\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/users/POST/users/%7BuserId%7D/suspend\"\u003eSuspend a user\u003c/a\u003e. Available for the \u003ca href=\"/pricing\"\u003ePersonal and Enterprise plans\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/users/POST/users/%7BuserId%7D/restore\"\u003eRestore a suspended user\u003c/a\u003e. Available for the \u003ca href=\"/pricing\"\u003ePersonal and Enterprise plans\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/users/POST/users/%7BuserId%7D/delete\"\u003eDelete a user\u003c/a\u003e. Available for the \u003ca href=\"/pricing\"\u003ePersonal and Enterprise plans\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003eUser invite endpoints\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/userinvites/GET/tailnet/%7Btailnet%7D/user-invites\"\u003eList all open (not yet accepted) user invites to the tailnet\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/userinvites/POST/tailnet/%7Btailnet%7D/user-invites\"\u003eCreate user invite links and send user invite emails\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/userinvites/GET/user-invites/%7BuserInviteId%7D\"\u003eGet details for a specific user invite\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/userinvites/DELETE/user-invites/%7BuserInviteId%7D\"\u003eDelete an open (not yet accepted) user invite\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/userinvites/POST/user-invites/%7BuserInviteId%7D/resend\"\u003eResend an open (not yet accepted) user invite that was originally sent via email\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003eDevice invite endpoints\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceinvites/GET/device/%7BdeviceId%7D/device-invites\"\u003eList all open (not yet accepted) device invites\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceinvites/POST/device/%7BdeviceId%7D/device-invites\"\u003eCreate device invite links and send device invite emails\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceinvites/GET/device-invites/%7BdeviceInviteId%7D\"\u003eGet details for a specific device invite\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceinvites/DELETE/device-invites/%7BdeviceInviteId%7D\"\u003eDelete an open (not yet accepted) device invite\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceinvites/POST/device-invites/%7BdeviceInviteId%7D/resend\"\u003eResend an open (not yet accepted) device invite\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/deviceinvites/POST/device-invites/-/accept\"\u003eAccept a device invite to your tailnet\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003eContact preferences endpoints\u003c/h5\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/contacts/GET/tailnet/%7Btailnet%7D/contacts\"\u003eList the tailnet's current contact preferences\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/contacts/PATCH/tailnet/%7Btailnet%7D/contacts/%7BcontactType%7D\"\u003eUpdate a tailnet contact\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/api#tag/contacts/POST/tailnet/%7Btailnet%7D/contacts/%7BcontactType%7D/resend-verification-email\"\u003eResend the verification email for a tailnet contact\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"23:T4f0,\u003cp\u003eA new release of the \u003ca href=\"/kb/1282/docker\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\"https://hub.docker.com/r/tailscale/tailscale\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/blog/quic-udp-throughput\"\u003eUDP GRO\u003c/a\u003e forwarding can be turned on for containers configured as Tailscale subnet routers or exit nodes, using the new environment variable \u003ccode\u003eTS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS\u003c/code\u003e. To learn more, see \u003ca href=\"/kb/1320/performance-best-practices\"\u003ePerformance best practices\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eContainers that run on Kubernetes and store the \u003ca href=\"/kb/1278/tailscaled\"\u003e\u003ccode\u003etailscaled\u003c/code\u003e\u003c/a\u003e state in a Kubernetes \u003ccode\u003eSecret\u003c/code\u003e can now be enforced to read the Kubernetes API server address and port from the environment variables \u003ccode\u003eKUBERNETES_SERVICE_HOST\u003c/code\u003e and \u003ccode\u003eKUBERNETES_SERVICE_PORT_HTTPS\u003c/code\u003e. By default, the values are read from the Kubernetes \u003ccode\u003eService\u003c/code\u003e in the default namespace. To enforce the environment variables, set \u003ccode\u003eTS_KUBERNETES_READ_API_SERVER_ADDRESS_FROM_ENV\u003c/code\u003e to \u003ccode\u003etrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n24:T40f,\u003cp\u003eA new release of the \u003ca href=\"/kb/1236/kubernetes-operator\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see our \u003ca href=\"/kb/1236/kubernetes-operator#installation\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eTailscale Kubernetes operator proxies can now be configured to accept routes advertised by tailnet peers using the new \u003ccode\u003eproxyClass.spec.tailscale.acceptRoutes\u003c/code\u003e field. To learn more, see our \u003ca href=\"https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass\"\u003eProxyClass documentation\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eImages and image pull policies can be configured for individual Tailscale Kubernetes operator proxies using ProxyClass.\u003c/li\u003e\n\u003cli data-change=\"new\""])</script><script>self.__next_f.push([1,"\u003eConnector Custom Resources status now includes the proxy's tailnet IP addresses and MagicDNS name.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eHelm values file now allows configuring image repositories using a repository key, which is a standard and expected by some tools.\u003c/li\u003e\n\u003c/ul\u003e\n25:T5bd,\u003cp\u003eA new release of the \u003ca href=\"/kb/1246/tailscale-ssh-session-recording\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\"https://hub.docker.com/r/tailscale/tsrecorder/tags\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--state\u003c/code\u003e flag or the \u003ccode\u003eTS_STATE\u003c/code\u003e environment variable can be used to specify a Kubernetes \u003ccode\u003eSecret\u003c/code\u003e as \u003ca href=\"/kb/1278/tailscaled\"\u003e\u003ccode\u003etailscaled\u003c/code\u003e\u003c/a\u003e state store when \u003ca href=\"/kb/1263/session-recording-s3#deploy-the-recorder-node\"\u003edeploying the \u003ccode\u003etsrecorder\u003c/code\u003e container\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--dst\u003c/code\u003e flag for destination can be set as the environment variable \u003ccode\u003eTSRECORDER_DST\u003c/code\u003e when deploying the \u003ccode\u003etsrecorder\u003c/code\u003e container.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--bucket\u003c/code\u003e flag for the S3 bucket name can be set as the environment variable \u003ccode\u003eTSRECORDER_BUCKET\u003c/code\u003e when deploying the \u003ccode\u003etsrecorder\u003c/code\u003e container.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--hostname\u003c/code\u003e flag for the hostname can be set as the environment variable \u003ccode\u003eTSRECORDER_HOSTNAME\u003c/code\u003e when deploying the \u003ccode\u003etsrecorder\u003c/code\u003e container.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--ui\u003c/code\u003e flag for the user interface can be set as the environment variable \u003ccode\u003eTSRECORDER_UI\u003c/code\u003e when deploying the \u003ccode\u003etsrecorder\u003c/code\u003e container.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAWS ambient credentials can be used to access the S3 backend.\u003c/li\u003e\n\u003c/ul\u003e\n26:T13b9,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1067/update#auto-updates\"\u003eAuto-updates\u003c/a\u003e are available for containers. The tailnet-wide default is ignored in containers.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eWhen enabled, auto-updates get applied even if the node is down or disconnected from the \u003ca href=\"/kb/1155/terminology-and-concepts#coordination-server\"\u003ecoordination server\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1243/tailscale-lock#lock-status\"\u003e\u003ccode\u003etailscale lock status\u003c/code\u003e\u003c/a\u003e now prints the node's signature.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eGo is updated to version 1.22.4.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1022/install-windows\"\u003e\u003ccode\u003e.exe\u003c/code\u003e installer\u003c/a\u003e no longer downloads MSI packages for Windows 7 and Windows 8, automatically. See the \u003ca href=\"/changelog#2023-05-24\"\u003ev1.42.0 changelog\u003c/a\u003e for our initial end of life announcement.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1016/install-mac\"\u003eStandalone\u003c/a\u003e variant of the client can now install a launcher for the \u003ca href=\"/kb/1080/cli\"\u003eTailscale CLI\u003c/a\u003e in \u003ccode\u003e/usr/local/bin\u003c/code\u003e by going to \u003cstrong\u003eSettings\u003c/strong\u003e, \u003cstrong\u003eCLI integration\u003c/strong\u003e, then \u003cstrong\u003eShow me how\u003c/strong\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eStandalone variant of the client now supports notifications when a file is received using \u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003ePop-up notification displays when a network might be vulnerable to a potential TunnelVision attack. For more information, see \u003ca href=\"/kb/1412/tunnel-vision\"\u003eTunnelVision vulnerability and Tailscale\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eClient starts up more reliably if another VPN app is running when Tailscale is enabled.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"https://pkgs.tailscale.com/stable/#macos\"\u003e\u003ccode\u003e.pkg\u003c/code\u003e installer\u003c/a\u003e terminates pre-existing copies of Tailscale and the VPN extension before proceeding with installation if Tailscale was already installed.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTunnelBear installation is properly detected, and warns the user about incompatibility.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ccode\u003eUsing Exit Node\u003c/code\u003e label no longer appears incorrectly in the app menu before completing onboarding, upon the first time app launch.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFixed a bug with split DNS domains being used as search domains after a network change.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eBattery life is optimized by offloading DNS resolution to iOS in more cases.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eClient now starts more reliably if another VPN app is running when Tailscale is enabled.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eBug report view no longer copies the bug report ID to the clipboard automatically.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003cstrong\u003eReauthenticate\u003c/strong\u003e button for in-app key expiry notifications works as expected.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDark mode contains minor changes to UI colors.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFixed a bug with split DNS domains being used as search domains after a network change.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eClient now starts more reliably if another VPN app is running when Tailscale is enabled.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003cstrong\u003eReauthenticate\u003c/strong\u003e button for in-app key expiry notifications works as expected.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eOn-off toggle state better matches the actual client state.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eStatus notifications when Tailscale is disconnected are now background notifications, and tapping on notifications launches the Tailscale app.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eClient starts automatically after the first login.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1315/mdm-keys\"\u003eSystem policy\u003c/a\u003e (MDM) support is added for mandatory exit nodes.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eOrganization name is now rendered properly when set in the \u003ca href=\"/kb/1315/mdm-keys#set-your-organization-name\"\u003e\u003ccode\u003eManagedByOrganizationName\u003c/code\u003e\u003c/a\u003e system policy.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eCrashing no longer occurs when launching Tailscale and another VPN application was already running.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1103/exit-nodes#advertise-a-device-as-an-exit-node\"\u003eRunning an exit node\u003c/a\u003e no longer lets you \u003ca href=\"/kb/1103/exit-nodes#use-the-exit-node\"\u003euse another device as an exit node\u003c/a\u003e and vice versa.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eHome screen shows the selected exit node country and city when using \u003ca href=\"/kb/1258/mullvad-exit-nodes\"\u003eMullvad exit nodes\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cbr /\u003e\u003cbr /\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: The Tailscale client releases for containers such as the \u003ca href=\"/kb/1236/kubernetes-operator\"\u003eKubernetes operator\u003c/a\u003e, \u003ca href=\"/kb/1282/docker\"\u003eDocker\u003c/a\u003e image, and \u003ca href=\"/kb/1246/tailscale-ssh-session-recording\"\u003etsrecorder\u003c/a\u003e are typically released a few days after the initial client release. A separate changelog will be published when client updates for containers are available.\u003c/p\u003e\n"])</script><script>self.__next_f.push([1,"27:Tea5,"])</script><script>self.__next_f.push([1,"\u003cp\u003e\u003cem\u003eNote\u003c/em\u003e: Tailscale v1.66.2 was an internal-only release.\u003c/p\u003e\n\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eLogin URLs did not always appear in the console when running \u003ca href=\"/kb/1080/cli#up\"\u003e\u003ccode\u003etailscale up\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eReintroduced the Quick Settings title that v1.66.0 temporarily removed.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved the VPN service connection logic, especially when rebooting the device with Always-On VPN enabled.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe persistent VPN status notification now informs the user with a muted icon when the VPN is disconnected. VPN status notifications can be disabled in the system notification settings.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eThe \"Enable\" button in the exit node selector banner now renders with the correct background color.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eKubernetes operator\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"breaking change\"\u003eStarting with v1.66, the Kubernetes operator must always run the same or later version as the proxies it manages.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1440/kubernetes-operator-cloud-services\"\u003eExpose cloud services\u003c/a\u003e on cluster network to the tailnet, using Kubernetes \u003ccode\u003eExternalName\u003c/code\u003e Services. This allows exposing cloud services, such as RDS instances, to tailnet by their DNS names.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eExpose tailnet services that use \u003ca href=\"/kb/1153/enabling-https\"\u003eTailscale HTTPS\u003c/a\u003e to cluster workloads. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/pull/11019\"\u003e#11019\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eCluster workloads can now refer to Tailscale Ingress resources by their MagicDNS names. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/pull/11019\"\u003e#11019\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eConfigure environment variables for Tailscale Kubernetes operator proxies using \u003ccode\u003eProxyClass\u003c/code\u003e CRD.\nRefer to \u003ca href=\"https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass\"\u003e\u003ccode\u003eProxyClass\u003c/code\u003e API\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eExpose \u003ccode\u003etailscaled\u003c/code\u003e metrics endpoint for Tailscale Kubernetes operator proxies through \u003ccode\u003eProxyClass\u003c/code\u003e CRD. Note that the \u003ccode\u003etailscaled\u003c/code\u003e metrics are unstable and will likely change in the future. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass\"\u003e\u003ccode\u003eProxyClass\u003c/code\u003e API\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eConfigure labels for the Kubernetes operator Pods with Helm chart values. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/chart/values.yaml\"\u003eHelm chart values\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eConfigure affinity rules for Kubernetes operator proxy Pods with \u003ccode\u003eProxyClass\u003c/code\u003e. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclass\"\u003e\u003ccode\u003eProxyClass\u003c/code\u003e API\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eKubernetes operator proxy \u003ccode\u003einit\u003c/code\u003e container no longer attempts to enable IPv6 forwarding on systems that don't have IPv6 module loaded. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/pull/11867\"\u003e#11867\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eContainers\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eTailscale containers running on Kubernetes no longer error if an empty Kubernetes \u003ccode\u003eSecret\u003c/code\u003e is pre-created for the \u003ccode\u003etailscaled\u003c/code\u003e state. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/pull/11326\"\u003e#11326\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eImproved the ambiguous error messages when Tailscale running on Kubernetes does not have the right permissions to perform actions against the \u003ccode\u003etailscaled\u003c/code\u003e state \u003ccode\u003eSecret\u003c/code\u003e. Refer to \u003ca href=\"https://github.com/tailscale/tailscale/pull/11326\"\u003e#11326\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"28:T455,\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eAs part of a security fix to address an issue related to exit nodes and subnet routing (\u003ca href=\"/security-bulletins/#ts-2024-005\"\u003eTS-2024-005\u003c/a\u003e), changes are made to \u003ca href=\"/kb/1018/acls\"\u003eACLs\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eThe meaning of \u003ccode\u003e*\u003c/code\u003e when used in the \u003ca href=\"/kb/1337/acl-syntax#src\"\u003e\u003ccode\u003esrc\u003c/code\u003e\u003c/a\u003e field in ACLs has been changed. Previously, \u003ccode\u003e*\u003c/code\u003e expanded to include any IPv4 and IPv6 address. With this change, \u003ccode\u003e*\u003c/code\u003e expands to all \u003ca href=\"/kb/1015/100.x-addresses\"\u003eTailscale IP addresses\u003c/a\u003e and all IP addresses from approved \u003ca href=\"/kb/1019/subnets\"\u003esubnet routes\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eThe new \u003ccode\u003eautogroup:danger-all\u003c/code\u003e ACL type has been added, which matches the previous definition of \u003ccode\u003e*\u003c/code\u003e when used in the \u003ccode\u003esrc\u003c/code\u003e field. If you are using default ACLs or have specified \u003ccode\u003e*\u003c/code\u003e in \u003ccode\u003esrc\u003c/code\u003e, you don't need to make any ACL changes to get the new secure behavior.\u003c/li\u003e\n\u003cli\u003eWe recommend updating all Tailscale clients to v1.66 to benefit from the additional security improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n29:T1718,"])</script><script>self.__next_f.push([1,"\u003cp\u003eWe recommend updating all Tailscale clients to v1.66.0 or later to benefit from additional security improvements.\u003c/p\u003e\n\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eImplemented client-side quarantining for shared-in exit nodes, as a mitigation for a security vulnerability described in \u003ca href=\"/security-bulletins#ts-2024-005\"\u003eTS-2024-005\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUse the \u003ccode\u003e--stateful-filtering\u003c/code\u003e flag for the \u003ca href=\"/kb/1241/tailscale-up\"\u003e\u003ccode\u003etailscale up\u003c/code\u003e\u003c/a\u003e to enable stateful filtering for \u003ca href=\"/kb/1019/subnets\"\u003esubnet routers\u003c/a\u003e and \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit nodes\u003c/a\u003e, as a mitigation for a security vulnerability described in \u003ca href=\"/security-bulletins#ts-2024-005\"\u003eTS-2024-005\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This change can break existing setups that depend on forwarding connections from external hosts (internet, LAN, Docker containers, etc.) into the tailnet through a Tailscale node. If your setup depends on such forwarding, you can disable stateful filtering with the \u003ccode\u003etailscale up --stateful-filtering=false\u003c/code\u003e command.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUse \u003ca href=\"/kb/1080/cli#tab-completion\"\u003etab completion\u003c/a\u003e to type the first few letters of a Tailscale CLI command, flag, or arguments, followed by the \u003ccode\u003etab\u003c/code\u003e key to complete the item being typed. Set up tab completion by using the \u003ca href=\"/kb/1080/cli#completion\"\u003e\u003ccode\u003etailscale completion\u003c/code\u003e\u003c/a\u003e command.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse the \u003ca href=\"/kb/1080/cli#exit-node\"\u003e\u003ccode\u003etailscale exit-node suggest\u003c/code\u003e\u003c/a\u003e command to automatically pick an available exit node that is likely to perform best.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1214/site-to-site\"\u003eSite-to-site networking\u003c/a\u003e now also requires \u003ccode\u003e--stateful-filtering=false\u003c/code\u003e in addition to \u003ccode\u003e--snat-subnet-routes=false\u003c/code\u003e on new subnet routers. Existing subnet routers with \u003ccode\u003e--snat-subnet-routes=false\u003c/code\u003e will default to \u003ccode\u003e--stateful-filtering=false\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eView a suggested \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit node\u003c/a\u003e in the \u003cstrong\u003eExit Node\u003c/strong\u003e picker when available.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eGenerate a macOS Configuration Report \u003ccode\u003e.txt\u003c/code\u003e file from the \u003cstrong\u003eBug Report\u003c/strong\u003e view to help the Tailscale support team diagnose issues.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSee direct vs. relayed connections in the \u003cstrong\u003ePing\u003c/strong\u003e view.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eView a suggested \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit node\u003c/a\u003e in the \u003cstrong\u003eExit Node\u003c/strong\u003e picker when available.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse \u003ca href=\"/kb/1085/auth-keys\"\u003eauth keys\u003c/a\u003e to log in without using the browser.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSearch \u003ca href=\"/kb/1068/acl-tags\"\u003etagged devices\u003c/a\u003e by tag in the \u003cstrong\u003eDevices\u003c/strong\u003e list.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eRemove accounts in the \u003cstrong\u003eFast User Switching\u003c/strong\u003e view by using a long press, without having to log out.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved UI experience to log into a custom coordination server like \u003ca href=\"/blog/opensource#the-open-source-coordination-server\"\u003eHeadscale\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003cstrong\u003eFast User Switching\u003c/strong\u003e view can now be used when Tailscale is disconnected.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eReduced app launch time.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eManage DNS configuration in the \u003cstrong\u003eDNS Settings\u003c/strong\u003e view.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eGenerate a \u003ca href=\"/kb/1227/bug-report\"\u003ebug report\u003c/a\u003e identifier by navigating to \u003cstrong\u003eAbout Tailscale\u003c/strong\u003e \u003e \u003cstrong\u003eReport an issue\u003c/strong\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cp\u003eWe've rebuilt the Android app from the ground up, adopting a similar design that we've previously rolled out on iOS and using the latest Android best practices.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUse new status indicators to see at-a-glance insights into node connectivity. Tap on a node to see detailed information.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSee detailed information about resolvers, domains, and routing configurations in a dedicated \u003cstrong\u003eDNS Settings\u003c/strong\u003e view.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSee the status of \u003ca href=\"/kb/1226/tailnet-lock\"\u003eTailnet lock\u003c/a\u003e and node keys.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse \u003ca href=\"/kb/1225/fast-user-switching\"\u003eFast user switching\u003c/a\u003e to switch between two or more logged-in accounts on the same device, without requiring you to re-authenticate.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse \u003ca href=\"/kb/1085/auth-keys\"\u003eauth keys\u003c/a\u003e to log in without using the browser.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eManage Android devices in your tailnet using \u003ca href=\"/kb/1384/android-mdm\"\u003eMobile Device Management\u003c/a\u003e (MDM) solutions such as \u003ca href=\"/kb/1386/mdm-google-workspace\"\u003eGoogle Workspace\u003c/a\u003e, \u003ca href=\"/kb/1327/mmdm-microsoft-intune\"\u003eMicrosoft Intune\u003c/a\u003e, or \u003ca href=\"/kb/1385/tinymdm\"\u003eTinyMDM\u003c/a\u003e, among other tools.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAccessibility support.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse dark mode as an alternative to light mode.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003cstrong\u003eQuick Settings\u003c/strong\u003e tile has been temporarily disabled, pending resolution of an issue.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eMore intuitive behavior switching between exit nodes.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eIssue with LAN access during exit node use.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"2a:T935,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e headers are now \u003ca href=\"https://datatracker.ietf.org/doc/html/rfc2047\"\u003eRFC 2047\u003c/a\u003e Q-encoded.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eDevice web interface enabled by default locally on \u003ca href=\"/kb/1381/what-is-quad100\"\u003e\u003ccode\u003e100.100.100.100\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eGo is updated to version 1.22.2.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUse Tailscale for macOS as a Tailscale SSH client (Standalone variant only).\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eReceive alerts when an error occurs while changing client preferences.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdded a new \u003ca href=\"https://www.obdev.at/iap/index.html\"\u003eInternet Access Policy\u003c/a\u003e for \u003ca href=\"https://www.obdev.at/products/littlesnitch/index.html\"\u003eLittle Snitch\u003c/a\u003e users.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003ccode\u003e.pkg\u003c/code\u003e installer no longer requires a system restart after installing the client (Standalone variant only).\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eUnexpected terminations for some macOS 10.15 Catalina users.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eReduced number of alerts if the network extension terminates unexpectedly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eImproved reliability of the ping chart presentation.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUpdate certificates using the \u003ca href=\"/kb/1080/cli/#cert\"\u003e\u003ccode\u003ecert\u003c/code\u003e\u003c/a\u003e CLI command.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1121/ipv6\"\u003eIPv6\u003c/a\u003e addresses are available again.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eKubernetes operator\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli#configure\"\u003e\u003ccode\u003etailscale configure kubeconfig\u003c/code\u003e\u003c/a\u003e now respects \u003ccode\u003eKUBECONFIG\u003c/code\u003e environment variable.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1080/cli#configure\"\u003e\u003ccode\u003etailscale configure kubeconfig\u003c/code\u003e\u003c/a\u003e now works with partially empty \u003ccode\u003ekubeconfig\u003c/code\u003e.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"https://en.wikipedia.org/wiki/\"\u003eMSS\u003c/a\u003e clamping for Kubernetes operator proxies using \u003ca href=\"https://wiki.nftables.org/wiki-nftables/index.php/What_is_nftables%3F\"\u003enftables\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eContainers\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eContainers on hosts with partial support for \u003ca href=\"https://www.man7.org/linux/man-pages/man8/iptables.8.html\"\u003eip6tables\u003c/a\u003e no longer crash.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"2b:T1228,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1325/device-web-interface\"\u003eWeb interface\u003c/a\u003e now uses ACL grants to manage access on tagged devices\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e connections now disable unnecessary hostname \u003ca href=\"https://en.wikipedia.org/wiki/Canonicalization\"\u003ecanonicalization\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1227/bug-report\"\u003e\u003ccode\u003etailscale bugreport\u003c/code\u003e\u003c/a\u003e command for generating diagnostic logs now contain ethtool information\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eMullvad's \u003ca href=\"https://mullvad.net/en/blog/family-friendly-dns-content-blocking-now-added-to-our-encrypted-dns-service\"\u003efamily-friendly server\u003c/a\u003e is added to the list of well known DNS over HTTPS (DoH) servers\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDNS over HTTP requests now contain a timeout\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTCP forwarding attempts in \u003ca href=\"/kb/1177/kernel-vs-userspace-routers#userspace-netstack-mode\"\u003euserspace mode\u003c/a\u003e now have a per-client limit\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eEndpoints with link-local IPv6 addresses is preferred over private addresses\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eWireGuard logs are less verbose\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eGo is updated to version 1.22.1\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1232/derp-servers\"\u003eDERP server\u003c/a\u003e region no longer changes if connectivity to the new DERP region is degraded\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1067/update#auto-updates\"\u003eAuto-update\u003c/a\u003e version detection on Alpine Linux is improved\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eIPv6 support detection in a container environment is improved\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDNS configuration on Amazon Linux 2023 no longer causes an infinite loop\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1315/mdm-keys#set-your-organization-name\"\u003e\u003ccode\u003eManagedByOrganizationName\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"/kb/1315/mdm-keys#set-an-info-message\"\u003e\u003ccode\u003eManagedByCaption\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"/kb/1315/mdm-keys#set-a-support-url\"\u003e\u003ccode\u003eManagedByURL\u003c/code\u003e\u003c/a\u003e system policy keys are now supported\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTailscale Tunnel WinTun adapter handling is improved\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1189/install-windows-msi\"\u003eMSI\u003c/a\u003e upgrades no longer ignore policy properties set during initial install\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eA \u003ccode\u003e.pkg\u003c/code\u003e installer package is now available for the \u003ca href=\"/kb/1065/macos-variants\"\u003estandalone\u003c/a\u003e release of the Tailscale client\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e notifications now include actions to reveal the received file in the Finder, or delete it\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1226/tailnet-lock\"\u003eTailnet lock\u003c/a\u003e settings UI displays more information about the status, including key and public key trust status\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe onboarding flow now guides the user in enabling the Tailscale system extension\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eLaunch Tailscale at login\u003c/strong\u003e settings item can now be toggled when the Tailscale client is disconnected\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDNS behavior is improved when handling transitions between network interfaces\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eBattery usage is improved\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e notifications now include actions to reveal the received file in the Files app, or delete it\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1226/tailnet-lock\"\u003eTailnet lock\u003c/a\u003e settings UI displays more information about the status, including key and public key trust status\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eUnnecessary log messages are removed when triggered by changes to device power state and routing\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDNS behavior is improved when handling interface transitions between Wi-Fi and Cellular\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eSettings persist from previous sign-ins\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eAlways-on VPN handling is improved\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eCustom control server is applied on first start\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eKubernetes operator\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1439/kubernetes-operator-cluster-ingress\"\u003eIngress\u003c/a\u003e resource handling is improved when deployed before its backing \u003ccode\u003eService\u003c/code\u003e resource\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDestination NAT (DNAT) rule management by egress proxies in \u003ca href=\"/kb/1294/firewall-mode\"\u003e\u003ccode\u003enftables\u003c/code\u003e\u003c/a\u003e mode when IP address of \u003ccode\u003etailscale.com/tailnet-fqdn\u003c/code\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"2c:T407,\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eThe Free \u003ca href=\"/pricing\"\u003epricing plan\u003c/a\u003e is now called the Personal plan. All other aspects of the plan remain the same.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eCustomers who sign up with a custom domain will be auto-enrolled into a 14-day trial of the Enterprise plan with no provisioned user limits\u003c/li\u003e\n\u003cli data-change=\"new\"\u003ePersonal plan customers who use a custom or vanity domain for their tailnet can opt out of the trial and continue to use the Personal plan\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eCustomers who use Tailscale for commercial purposes will be billed for all of their \u003ca href=\"/kb/1251/pricing-faq#how-are-monthly-active-users-defined\"\u003eactive users\u003c/a\u003e once they sign up for a plan\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cem\u003eNote\u003c/em\u003e: Free trials are available for business customers. For details about billing, plan comparison, and support, see \u003ca href=\"/kb/1251/pricing-faq\"\u003ePricing \u0026#x26; Plans FAQ\u003c/a\u003e. For instructions on how to change your plan, see \u003ca href=\"/kb/1182/billing-information\"\u003eModify billing\u003c/a\u003e.\u003c/p\u003e\n2d:T136d,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli#status\"\u003e\u003ccode\u003etailscale status\u003c/code\u003e\u003c/a\u003e command output now includes location-based exit nodes\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli#web\"\u003e\u003ccode\u003etailscale web\u003c/code\u003e\u003c/a\u003e command flag \u003ccode\u003e--read-only\u003c/code\u003e is added to run the web UI in read-only mode\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eA warning is logged when unable to find SSH host keys\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSupport added for legacy \"urn:dslforum-org\" port mapping services\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBuild with Go 1.22\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDetect when Tailscale is running on Digital Ocean and automatically use Digital Ocean's DNS resolvers\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eExpose gVisor metrics in debug mode\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImprove error message when running as non-root\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eA valid login page is presented to users when attempting to log in even after leaving device unattended for several days\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eAn issue with noisy peer mtu discovery errors\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eA potential crash when no supported port mapping services are found\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli\u003eFixed:\u003ccode\u003etailscaled\u003c/code\u003e could be slow or cause increased CPU usage with large routing tables\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cp\u003e\u003cem\u003eNote\u003c/em\u003e: Tailscale v1.60.0 is built with Go 1.22 and Go 1.22 is the last release that will run on macOS 10.15 Catalina (\u003ca href=\"https://tip.golang.org/doc/go1.22#darwin\"\u003esource\u003c/a\u003e). We are providing notice that around August 15, 2024, Tailscale will be built with Go 1.23 at which time macOS users that want to run the latest version of Tailscale will require macOS 11 Big Sur or later. Note that macOS 10.15 Catalina is no longer supported by Apple and is no longer receiving security updates.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eNew UI to add, remove, and switch between user accounts, including using custom control servers\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eNew UI to change client preferences\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eNew UI to manage updates for the Standalone variant of the client, including switching in-app between stable and unstable builds\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1291/ios-vpn-on-demand\"\u003eVPN On Demand\u003c/a\u003e is now supported on macOS, to automatically connect/disconnect Tailscale when specific conditions are triggered\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eReset VPN Configuration\u003c/strong\u003e menu item in the \u003cstrong\u003eDebug\u003c/strong\u003e menu is now available to reset the system VPN configuration if needed\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAn alert window is presented when the Tailscale network extension fails to start, providing suggested troubleshooting steps\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTailscale appears in the macOS Dock when an app window is presented\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003cstrong\u003eNetwork Devices\u003c/strong\u003e list now shows all devices known to the control server, not only those seen in the last 4 days\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe onboarding flow automatically advances once the user is connected\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eA potential crash and excessive logging upon client launch\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003cstrong\u003eStart on Login\u003c/strong\u003e is set correctly on macOS Ventura and earlier versions\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eA potential crash and excessive logging upon client launch\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eStale devices are no longer presented in the devices list\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eA potential crash and excessive logging upon client launch\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eStale devices are no longer presented in the devices list\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eMullvad exit nodes now sorted to make it easier to find the best node for each location\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eMullvad tunnels are no longer shown as regular nodes in UI\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eQuick settings tile now works\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eAn issue with stalling of SMB transfers of large files\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eKubernetes operator\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eA new \u003ccode\u003eProxyClass\u003c/code\u003e custom resource that allows you to provide a custom configuration for cluster resources that the operator creates\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1068/acl-tags\"\u003eACL tags\u003c/a\u003e for the operator can now be configured via Helm chart values\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eRouting to Ingress backends that require an exact path without a slash (\u003ccode\u003e/\u003c/code\u003e) suffix\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eApp connectors\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1281/app-connectors\"\u003eApp connectors\u003c/a\u003e now flatten DNS CNAME chains down to a target A/AAAA routing record, for apps that are configured with a DNS record that is a CNAME\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eApps can be preconfigured with known routes to have those routes auto-advertised by all selected app connectors, and immediately begin to route traffic\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"2e:T16e6,"])</script><script>self.__next_f.push([1,"\u003cp\u003e\u003cem\u003eNote:\u003c/em\u003e Rollout of 1.58.0 paused on 21-Jan-2024 while we investigate reports of a regression with portmapping.\u003c/p\u003e\n\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eThe number of \u003ca href=\"/kb/1201/4via6-subnets\"\u003e4via6\u003c/a\u003e site IDs are increased from 256 to 65,536\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e allows category Z unicode characters\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1232/derp-servers\"\u003eDERP\u003c/a\u003e flapping (flipping back and forth between two regions rapidly) is reduced when there's still an active connection for the home DERP server\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1257/connection-types#hard-nat\"\u003ePortmap\u003c/a\u003e checks the epoch from NAT-PMP \u0026#x26; PCP, and establishes a new portmapping if it changes\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003ePortmap better handles multiple interfaces\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003ePortmap handles multiple UPnP discovery responses\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eIncreased binary size with Tailscale 1.56 is resolved\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1325/device-web-interface\"\u003eWeb interface\u003c/a\u003e issue related to accessing shared devices\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eWeb interface login issue when accessed over HTTPS\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eShell shebang is added in postinstall script, which fixes some Debian installations\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eDNS Settings\u003c/strong\u003e view is added and displays the DNS configuration used when Tailscale is running\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eQuit the app without terminating the VPN tunnel by holding down the \u003cstrong\u003eOption\u003c/strong\u003e button and selecting \u003cstrong\u003eQuit (Leave VPN Active)\u003c/strong\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eToggle Tailscale\u003c/strong\u003e shortcut action can be used to connect or disconnect the VPN tunnel, depending on its current state\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1315/mdm-keys#set-the-key-expiration-notice-period\"\u003e\u003ccode\u003eKeyExpirationNotice\u003c/code\u003e\u003c/a\u003e system policy is now supported to customize the time interval before a key expiration notice is displayed to the user\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1325/device-web-interface\"\u003eweb interface\u003c/a\u003e is now supported in the \u003ca href=\"/kb/1065/macos-variants\"\u003estandalone\u003c/a\u003e variant of the client\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eOnboarding flow includes a step to ask the user to approve key expiry notifications\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eOnboarding flow asks the user to approve the system extension if necessary, when using the standalone variant of the client\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003ePre-Sonoma compatibility is improved\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eVPN tunnel terminates upon closing the app\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eOpening the \u003cstrong\u003eAbout\u003c/strong\u003e window triggers a check for updates\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eThe standalone variant of the client checks for updates every 72 hours\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eToggle Tailscale\u003c/strong\u003e shortcut action can be used to connect or disconnect the VPN tunnel, depending on its current state. Ideal for the \u003cstrong\u003eAction Button\u003c/strong\u003e on iPhone 15 Pro.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1315/mdm-keys#set-the-key-expiration-notice-period\"\u003e\u003ccode\u003eKeyExpirationNotice\u003c/code\u003e\u003c/a\u003e system policy is now supported to customize the time interval before a key expiration notice is displayed to the user\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003cstrong\u003eSign\u003c/strong\u003e button in the \u003ca href=\"/kb/1226/tailnet-lock\"\u003eTailnet lock\u003c/a\u003e device sign view is rendered correctly\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eConnectivity is no longer lost when transitioning from Wi-Fi to Cellular while an \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit node\u003c/a\u003e is in use\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1325/device-web-interface\"\u003eweb interface\u003c/a\u003e is now supported\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe lookup for \u003ccode\u003enetsh.exe\u003c/code\u003e uses the absolute path instead of the relative path\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eADMX \u003ca href=\"/kb/1315/mdm-keys\"\u003esystem policy\u003c/a\u003e descriptions are now available\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eVestigial wintun support is removed, which might have caused Chocolatey installs to break\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eA goroutine leak in winMon no longer occurs if the monitor is never started\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\"This package requires Windows 10 or newer\" message no longer falsely displays during an uninstall or repair\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eActive network change detection is improved\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eImprovements to persistence of the client when running in the background\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eKubernetes Operator\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eA Connector custom resource is added, allowing users to configure the operator to deploy an \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit node\u003c/a\u003e, \u003ca href=\"/kb/1019/subnets\"\u003esubnet router\u003c/a\u003e, or both\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eA warning displays if the unsupported ingress \u003ccode\u003eExact\u003c/code\u003e path type is used\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eStatefulSet labels are synced to their Pods\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eA Tailscale \u003ca href=\"https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class\"\u003eIngressClass\u003c/a\u003e resource is added\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eExtra long \u003ca href=\"/kb/1439/kubernetes-operator-cluster-ingress#loadbalancerclass\"\u003eService\u003c/a\u003e names are properly truncated\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eContainers\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eExperimental support is added for configuring \u003ca href=\"/kb/1278/tailscaled\"\u003e\u003ccode\u003etailscaled\u003c/code\u003e\u003c/a\u003e using a mounted config file\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTailscale images now contain layers of the same media type and can be parsed by \u003ca href=\"https://podman.io/\"\u003ePodman\u003c/a\u003e and \u003ca href=\"https://buildah.io/\"\u003eBuildah\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"2f:T13fe,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#whois\"\u003e\u003ccode\u003etailscale whois\u003c/code\u003e\u003c/a\u003e command shows the machine and user associated with a Tailscale IP address\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1315/mdm-keys\"\u003eSystem policies\u003c/a\u003e are now in \u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#switch\"\u003e\u003ccode\u003etailscale switch --list\u003c/code\u003e\u003c/a\u003e command shows name and profile ID to disambiguate profiles with common login names\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eResponsiveness is improved under load, especially with bidirectional traffic\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eUPnP port mapping is improved\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1325/device-web-interface\"\u003eweb interface\u003c/a\u003e allows users to configure some device settings such as \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit nodes\u003c/a\u003e, \u003ca href=\"/kb/1019/subnets\"\u003esubnet routers\u003c/a\u003e, and \u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e using a browser-based GUI instead of the \u003ca href=\"/kb/1080/cli/\"\u003eTailscale CLI\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command is supported for \u003ca href=\"/kb/1307/nas/#unraid\"\u003eUnraid\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003econtainerboot\u003c/code\u003e symlinks its socket file if possible, making the Tailscale CLI work without \u003ccode\u003e--socket=/tmp/tailscale.sock\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eThroughput is improved for \u003ca href=\"/kb/1177/kernel-vs-userspace-routers/#userspace-netstack-mode\"\u003euserspace (\"netstack\") mode\u003c/a\u003e in the presence of packet loss\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eProfile switcher displays the tailnet name\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDynamic DNS updates are disabled in the client interface via the registry setting\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eClient improvements when restarting after an upgrade\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e notification displays when a file is received (App Store variant only)\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTaildrop shortcut action is added for file sharing\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eProfile switcher displays the tailnet name\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eAbout Tailscale\u003c/strong\u003e dialog indicates when the app is running a \u003ca href=\"/kb/1083/install-unstable\"\u003eTestFlight\u003c/a\u003e build\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eIn-app warnings and push notifications display when internet connectivity is blocked because the current \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit node\u003c/a\u003e is offline or its key has expired\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eVPN tunnel fully terminates when Tailscale is stopped, using the menu bar toggle\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ccode\u003e/etc/resolv\u003c/code\u003e file formatting with Tailscaled-on-macOS is improved\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eDNS Settings\u003c/strong\u003e view is added\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e shortcut action is added for file sharing\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTaildrop notifications include the received file names\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eProfile switcher displays the tailnet name\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eAbout Tailscale\u003c/strong\u003e dialog indicates when the app is running a \u003ca href=\"/kb/1083/install-unstable\"\u003eTestFlight\u003c/a\u003e build\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eAllow Local Network Access\u003c/strong\u003e option is added to the exit node picker UI\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eIn-app warning and push notification displays when internet connectivity is blocked because the current \u003ca href=\"/kb/1103/exit-nodes\"\u003eexit node\u003c/a\u003e is offline or its key has expired\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eApp size is reduced by about 2 MB with better asset compression\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1280/appletv\"\u003eApple TV\u003c/a\u003e can be configured as a subnet router, allowing you to remotely access resources on your home network that may not have Tailscale installed, such as a printer\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eAbout Tailscale\u003c/strong\u003e dialog indicates when the app is running a \u003ca href=\"/kb/1083/install-unstable\"\u003eTestFlight\u003c/a\u003e build\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eKubernetes\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1236/kubernetes-operator/#helm\"\u003eHelm charts\u003c/a\u003e for the \u003ca href=\"https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/manifests/operator.yaml\"\u003eTailscale Kubernetes Operator\u003c/a\u003e are now available on \u003ca href=\"https://pkgs.tailscale.com/helmcharts/index.yaml\"\u003epkgs.tailscale.com/helmcharts\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1437/kubernetes-operator-api-server-proxy\"\u003eKubernetes API server proxy\u003c/a\u003e supports impersonating groups via \u003ca href=\"/kb/1324/acl-grants\"\u003eACL Grants\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eKubernetes operator \u003ca href=\"/kb/1438/kubernetes-operator-cluster-egress\"\u003ecluster egress\u003c/a\u003e now supports referring to a tailnet service by its MagicDNS name in the \u003ccode\u003eService\u003c/code\u003e annotation\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eGoKrazy\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eTUN mode is used by default\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"30:T788,\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eGo is updated to version 1.21.4\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1320/performance-best-practices/#ethtool-configuration\"\u003eSubstantially improve throughput\u003c/a\u003e for UDP packets over TUN device with recent Linux kernels\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eAdded a security fix to address privilege escalation with \u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"/kb/1311/tailscale-funnel\"\u003e\u003ccode\u003etailscale funnel\u003c/code\u003e\u003c/a\u003e that allowed low-privilege users to serve files they did not have access to if the machine administrator had previously granted that user \u003ca href=\"/kb/1241/tailscale-up\"\u003e\u003ccode\u003etailscale up --operator\u003c/code\u003e\u003c/a\u003e privilege (\u003ca href=\"/security-bulletins/#ts-2024-001\"\u003eTS-2024-001\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eOpen menu with a regular click in addition to a right-click\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eImplement MDM settings for the \u003ca href=\"/kb/1065/macos-variants\"\u003estandalone macOS application\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSupport for the \u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command for the standalone macOS application\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDon't run Taildrop cleanup loop until the first file transfer, and avoid spurious security dialog\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eShow a helpful banner if there are no other devices on the tailnet\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003cstrong\u003eAllow Local Network Access\u003c/strong\u003e setting when using an exit node\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eShow info bubble when key expires within 8 hours, or has expired\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eWidgets now reflect the state of the VPN tunnel more accurately\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eQNAP\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for the \u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command\u003c/li\u003e\n\u003c/ul\u003e\n31:T1780,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#cert\"\u003e\u003ccode\u003etailscale cert\u003c/code\u003e\u003c/a\u003e command renews in the background. The current certificate only displays if it has expired.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#status\"\u003e\u003ccode\u003etailscale status\u003c/code\u003e\u003c/a\u003e command displays a message about client updates when newer versions are available\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#up\"\u003e\u003ccode\u003etailscale up\u003c/code\u003e\u003c/a\u003e command displays a message about client updates when newer versions are available\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e now resumes file transfers after partial transfers are interrupted\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTaildrop prevents file duplication\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTaildrop detects conflicting file transfers and only proceeds with one transfer\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eWake on LAN (WoL) is now supported for peer node wake-ups\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTCP DNS queries are speculatively started if UDP hasn't responded quickly enough\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTruncated UDP DNS results are properly retried using TCP\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eGo is updated to version 1.21.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#set\"\u003e\u003ccode\u003etailscale set\u003c/code\u003e\u003c/a\u003e command flag \u003ccode\u003e--auto-update\u003c/code\u003e is added to opt in to automatic client updates (\u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"/kb/1311/tailscale-funnel\"\u003e\u003ccode\u003etailscale funnel\u003c/code\u003e\u003c/a\u003e commands are updated for improved usability\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command for manual updates is now in \u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e file transfer displays a progress meter\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1294/firewall-mode\"\u003e\u003ccode\u003enftables\u003c/code\u003e\u003c/a\u003e auto-detection is improved when \u003ccode\u003eTS_DEBUG_FIREWALL_MODE=auto\u003c/code\u003e is used\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDNS detection of \u003ccode\u003eNetworkManager\u003c/code\u003e with configured but absent \u003ccode\u003esystemd-resolved\u003c/code\u003e, such as EndeavourOS\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDNS detection for Debian \u003ccode\u003eresolvconf\u003c/code\u003e version 1.90 or later\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#set\"\u003e\u003ccode\u003etailscale set\u003c/code\u003e\u003c/a\u003e command flag \u003ccode\u003e--auto-update\u003c/code\u003e is added to opt in to automatic client updates (\u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003ePreferences\u003c/strong\u003e section contains auto-update setting\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUpdate notice displays, when a new version is available\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSystem policies allow system administrators to set a forced/suggested tailnet name, hide settings menu items, and more\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"/kb/1311/tailscale-funnel\"\u003e\u003ccode\u003etailscale funnel\u003c/code\u003e\u003c/a\u003e commands are updated for improved usability\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command for manual updates is now in \u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003eiphlpsvc\u003c/code\u003e, \u003ccode\u003enetprofm\u003c/code\u003e, and \u003ccode\u003eWinHttpAutoProxySvc\u003c/code\u003e service dependencies are checked during installation\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eAdded a security fix to address privilege escalation with \u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"/kb/1311/tailscale-funnel\"\u003e\u003ccode\u003etailscale funnel\u003c/code\u003e\u003c/a\u003e that allowed low-privilege users to serve files they did not have access to (\u003ca href=\"/security-bulletins/#ts-2024-001\"\u003eTS-2024-001\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#set\"\u003e\u003ccode\u003etailscale set\u003c/code\u003e\u003c/a\u003e command flag \u003ccode\u003e--auto-update\u003c/code\u003e is added to opt in to automatic client updates (\u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eApp menu displays a notification item when a newer version is available\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSystem policies allow system administrators to set a forced/suggested tailnet name, prevent the VPN from stopping, hide categories of network devices and setting menu items, and more\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eSettings\u003c/strong\u003e section has an option added for turning on auto-updates\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eReauthenticate\u003c/strong\u003e menu item shows time until expiry more prominently, presenting alerts when necessary\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"/kb/1311/tailscale-funnel\"\u003e\u003ccode\u003etailscale funnel\u003c/code\u003e\u003c/a\u003e commands are updated for improved usability\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command for manual updates is now in \u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eAbout\u003c/strong\u003e window more clearly distinguishes between the Standalone and App Store \u003ca href=\"/kb/1065/macos-variants\"\u003evariants\u003c/a\u003e of the client\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eSparkle is updated to version 2.5.1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eSettings\u003c/strong\u003e page displays a notification banner when a newer version is available on the App Store\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eHome and lock screen widgets are supported\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSystem policies allow system administrators to set a forced/suggested tailnet name, prevent the VPN from stopping, hide the VPN On Demand settings, categories of network devices and settings menu items, and more\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003etvOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eDNS support when operating as an \u003ca href=\"/kb/1280/appletv/#use-a-device-exit-node\"\u003eexit node\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"32:Tdeb,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://meta.wikimedia.org/wiki/Wikimedia_DNS\"\u003eWikimedia DNS\u003c/a\u003e using DNS-over-HTTPS is supported\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBuild with Go 1.21.1\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command is unhidden on most platforms\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#ping\"\u003e\u003ccode\u003etailscale ping\u003c/code\u003e\u003c/a\u003e command sends an ICMP Ping code of \u003ccode\u003e0\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#web\"\u003e\u003ccode\u003etailscale web\u003c/code\u003e\u003c/a\u003ecommand updated to use React\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003etailscale debug portmap\u003c/code\u003e command now has the \u003ccode\u003e--log-http\u003c/code\u003e option\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1080/cli/#netcheck\"\u003e\u003ccode\u003etailscale netcheck\u003c/code\u003e\u003c/a\u003e command works even if the OS platform lacks CA certificates\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eUPnP falls back to a permanent lease if a limited lease fails\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eWireGuard peer endpoint selections are improved\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eDebian package lists the \u003ccode\u003eiptables\u003c/code\u003e and \u003ccode\u003eiproute2\u003c/code\u003e packages as recommended, not required\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003enftables\u003c/code\u003e support interoperates with Uncomplicated Firewall (UFW)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1227/bug-report\"\u003e\u003ccode\u003etailscale bugreport\u003c/code\u003e\u003c/a\u003e logs contain additional diagnostic information\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1022/install-windows\"\u003eWindows executable installer\u003c/a\u003e detects when it is running on Windows 7 or Windows 8.x and will automatically download the appropriate v1.44.2 MSI package, which is the final release supporting those operating systems\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eWindows executable installer no longer embeds MSI packages in the executable. Instead, it automatically downloads the correct package. Users desiring the previous behavior may download the \"full\" executable installer at \u003ca href=\"https://pkgs.tailscale.com/\"\u003epkgs.tailscale.com\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eShortcuts are added for finding and pinging devices\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1258/mullvad-exit-nodes\"\u003eMullvad Exit Nodes\u003c/a\u003e allows you to select nodes by country and city\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1226/tailnet-lock\"\u003eTailnet lock\u003c/a\u003e reliability improvements\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e no longer replaces spaces with \u003ccode\u003e%20\u003c/code\u003e in file names when sending files to Windows devices\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1225/fast-user-switching\"\u003eFast user switching\u003c/a\u003e is available\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eiOS 17 supports customized device naming from \u003cstrong\u003eSettings\u003c/strong\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eApp Shortcuts in Spotlight and Siri are supported. Try saying: \"\u003cem\u003eHey Siri, connect to Tailscale\u003c/em\u003e\" or \"\u003cem\u003eHey Siri, is Tailscale connected?\u003c/em\u003e\".\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eShortcuts are added for finding and pinging devices\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eMullvad Exit Nodes includes an option to pick the best available node\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eUI accessibility improvements when using VoiceOver\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTaildrop no longer replaces spaces with \u003ccode\u003e%20\u003c/code\u003e in file names when sending files to Windows devices\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1291/ios-vpn-on-demand\"\u003eVPN On Demand\u003c/a\u003e rules are no longer reset when disabled and then restarted\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"33:T755,\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#exit-node\"\u003e\u003ccode\u003etailscale exit-node\u003c/code\u003e\u003c/a\u003e subcommand\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--upstream\u003c/code\u003e flag in the \u003ca href=\"/kb/1080/cli/#version\"\u003e\u003ccode\u003etailscale version\u003c/code\u003e\u003c/a\u003e command\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1080/cli/#funnel\"\u003e\u003ccode\u003etailscale funnel\u003c/code\u003e\u003c/a\u003e command provides an interactive web UI that prompts you to allow Tailscale to enable Tailscale Funnel on your behalf\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe \u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e command provides an interactive web UI that prompts you to allow Tailscale to enable HTTPS and Tailscale Funnel on your behalf\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1226/tailnet-lock/\"\u003eTailnet lock\u003c/a\u003e is in \u003ca href=\"/kb/1167/release-stages/#beta\"\u003ebeta\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cp\u003e\u003cem\u003eNote:\u003c/em\u003e 1.48.0 introduced a regression in the interaction between Tailscale and Linux \u003ccode\u003eufw\u003c/code\u003e. The Linux release has been withdrawn pending a fix.\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for \u003ca href=\"/kb/1294/firewall-mode\"\u003e\u003ccode\u003enftables\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eRPM packages are now fully signed\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSupport for the \u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command on Alpine, Arch and Fedora distro families\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for the \u003ccode\u003etailscale update\u003c/code\u003e command\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for the \u003ccode\u003etailscale update\u003c/code\u003e command\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for \u003ca href=\"/kb/1291/ios-vpn-on-demand\"\u003eVPN On Demand\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eVPN tunnel lifecycle improvements\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved exit node selection\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eMinor UI tweaks\u003c/li\u003e\n\u003c/ul\u003e\n34:Tc91,"])</script><script>self.__next_f.push([1,"\u003cp\u003eNote: This is the last release to support the following operating systems:\u003c/p\u003e\n\u003cp\u003e• macOS 10.13 High Sierra\u003cbr/\u003e\n• macOS 10.14 Mojave\u003cbr/\u003e\u003c/p\u003e\n\u003cp\u003eTailscale releases after 1.44.0 will no longer install on these operating systems, though we expect to maintain forward compatibility and critical security updates for 1.44.0 with future releases until at least June 30, 2024.\u003c/p\u003e\n\u003cp\u003eTo install Tailscale on a High Sierra or Mojave system, visit the Purchased Items in the App Store Account page. macOS High Sierra or Mojave systems will be offered Tailscale 1.44 when the download link is clicked. If Tailscale does not appear in the Purchased Items it must first be successfully installed using a recent macOS system. The Tailscale app will then be available for the High Sierra or Mojave system to install from Purchased Items.\u003c/p\u003e\n\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve http\u003c/code\u003e\u003c/a\u003e command to serve over HTTP (tailnet only)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#ssh\"\u003e\u003ccode\u003etailscale ssh\u003c/code\u003e\u003c/a\u003e command now supports remote port forwarding\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eRecursive DNS resolution is now initially supported to replace bootstrapDNS when operating in a parallel mode\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBuild with Go 1.20.5\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003e--tun-userspace-networking\u003c/code\u003e stability improvements for userspace subnet routers\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eMagicSock private addresses are given preference when both private and public are available, to help keep traffic in private VPCs, where possible\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eAsync support is removed from the \u003ccode\u003eportlist\u003c/code\u003e package. Update to use synchronous \u003ccode\u003ePoll()\u003c/code\u003e if this breaks your package.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003eWatchIPNBus\u003c/code\u003e now only requires read-only permissions to read\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#cert\"\u003e\u003ccode\u003etailscale cert\u003c/code\u003e\u003c/a\u003e renewal decision is now based on the lifetime of the certificate instead of hard-coded. This better supports 14 day certificate lifetimes.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli\u003eChanged:\u003ccode\u003etailscale ssh\u003c/code\u003e support improvements for Security-Enhanced Linux (SELinux) systems\u003c/li\u003e\n\u003cli\u003eChanged:\u003ccode\u003etailscale ssh\u003c/code\u003e supports user names with up to 256 characters\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003ebuild_dist.sh\u003c/code\u003e better supports operating systems and CPU architectures which Tailscale release builds do not include\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe iputils package can now be installed on Alpine-based Docker containers\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003ePreferGo supports better DNS caching\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eICMP6 forwarding works as expected when running as a subnet router\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eFreeBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eICMP6 forwarding works as expected when running as a subnet router\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eOpenBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eICMP6 forwarding works as expected when running as a subnet router\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWASI\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003etsnet applications compiled to WebAssembly are now better supported\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"35:T710,\u003cp\u003eNote: This is the last release to support the following operating systems:\u003c/p\u003e\n\u003cp\u003e• Microsoft Windows 7\u003cbr/\u003e\n• Microsoft Windows 8\u003cbr/\u003e\n• Microsoft Windows Server 2008\u003cbr/\u003e\n• Microsoft Windows Server 2012\u003cbr/\u003e\u003c/p\u003e\n\u003cp\u003eTailscale releases after 1.42.0 will no longer install on these operating systems, though we expect to maintain forward compatibility and critical security updates for 1.42.0 with future releases until at least May 31, 2024.\u003c/p\u003e\n\u003cp\u003eNote: Do not install this version of the Tailscale client on macOS 10.13. Upgrade to version 1.44.0 instead.\u003c/p\u003e\n\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1242/tailscale-serve/\"\u003e\u003ccode\u003etailscale serve reset\u003c/code\u003e\u003c/a\u003e command to clear out the current\nserve configuration\u003c/li\u003e\n\u003cli\u003eChanged: Update internal DNS handling to better support mixtures of global and private DNS\nservers\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSSH login on platforms which lack \u003ccode\u003egetent\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cp\u003e\u003cem\u003eNote: This release switches to a new application signing certificate, which is valid through 2025.\u003c/em\u003e\u003cbr/\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eNotification icons are updated\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eUpdate Sparkle to check more regularly\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTaildrop delivery of incomplete files\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eDelete Account\u003c/strong\u003e button to redirect to the admin panel\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBetter handle memory management to avoid hitting 50 MByte memory limit\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eUnraid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport Unraid as a NAS platform similar to how Synology and QNAP are handled\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eKubernetes\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for \u003ccode\u003epriorityClassName\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n36:T692,\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1241/tailscale-up\"\u003e\u003ccode\u003etailscale up --force-reauth\u003c/code\u003e\u003c/a\u003e will now display a warning and 5 second countdown\nif you are connected over SSH over Tailscal"])</script><script>self.__next_f.push([1,"e, unless \u003ccode\u003e--accept-risk=lose-ssh\u003c/code\u003e is also given\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eTailscale now dynamically increases the buffer size for DERP relay messages based on the amount of available RAM (\u003ca href=\"https://github.com/tailscale/tailscale/pull/7776\"\u003e#7776\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImprovements were made to how Tailscale advertises available endpoints to reduce the likelihood of a spurious loss of direct connections (\u003ca href=\"https://github.com/tailscale/tailscale/pull/7877\"\u003e#7877\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eSubstantially higher throughput—for details, see \u003ca href=\"/blog/more-throughput\"\u003eSurpassing 10Gb/s over Tailscale\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImproved CPU consumption on systems with a very large (1M+) routing table\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eRedo migration of pre-\u003ca href=\"/kb/1225/fast-user-switching\"\u003eFast-User-Switching\u003c/a\u003e state for better robustness\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\"Settings\" replaces \"Preferences\" as a menu item on macOS Ventura\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdded intents \u003ccode\u003ecom.tailscale.ipn.CONNECT_VPN\u003c/code\u003e and \u003ccode\u003ecom.tailscale.ipn.DISCONNECT_VPN\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003egokrazy\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e now works\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eQNAP\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eUI failure after reboot\u003c/li\u003e\n\u003c/ul\u003e\n37:T43d,\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eBuild with Go 1.20.3 to address security fixes (\u003ca href=\"https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8\"\u003eCVE-2023-24537, CVE-2023-24538, CVE-2023-24534, and CVE-2023-24536\u003c/a\u003e). These address potential DoS attacks against DNS over HTTPS and Funnel that can occur over the public internet, and PeerAPI attacks launched from other nodes already on the tailnet.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eAdded path support for proxy targets with \u003ca href=\"/kb/1080/cli/#serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\""])</script><script>self.__next_f.push([1,"fixed\"\u003eError displays when trying to use \u003ca href=\"/kb/1223/tailscale-funnel\"\u003eFunnel\u003c/a\u003e and \u003ca href=\"/kb/1241/tailscale-up\"\u003e\u003ccode\u003etailscale up --shields-up\u003c/code\u003e\u003c/a\u003e simultaneously\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eWhen connected to a Windows 10 client using \u003ca href=\"/kb/1095/secure-rdp-windows\"\u003eWindows RDP\u003c/a\u003e, the Tailscale taskbar right-click option for the remote client works as expected (\u003ca href=\"https://github.com/tailscale/tailscale/issues/7698\"\u003e#7698\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n38:T8b1,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#configure\"\u003e\u003ccode\u003etailscale configure\u003c/code\u003e\u003c/a\u003e command to configure resources that you want to include in your tailnet\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1243/tailscale-lock/#lock-sign\"\u003e\u003ccode\u003etailscale lock sign\u003c/code\u003e\u003c/a\u003e to sign \u003ca href=\"/kb/1085/auth-keys\"\u003epre-approved auth keys\u003c/a\u003e for use with \u003ca href=\"/kb/1226/tailnet-lock\"\u003etailnet lock\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale debug derp\u003c/code\u003e command to help diagnose DERP-related difficulty\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale debug capture\u003c/code\u003e command to write packet capturing for debugging\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eThe \u003ccode\u003etailscale debug portmap\u003c/code\u003e command replaces \u003ccode\u003etailscaled debug -portmap\u003c/code\u003e. This is now available on platforms without a \u003ccode\u003etailscaled\u003c/code\u003e binary (like the macOS App Store).\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1242/tailscale-serve\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e command has been overhauled\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003etailscale serve funnel\u003c/code\u003e has been made into its own command, \u003ca href=\"/kb/1080/cli#funnel\"\u003etailscale funnel\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eSeveral improvements to UPnP port mapping have been made that allow it to work with a broader set of home routers\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eCertificates can be stored in Kubernetes secret storage\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eMSI installers start the GUI without user interaction to allow remote upgrades\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eNotification upon node key expiration (only on macOS 10.14 and later)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e server component is available for macOS open source \u003ca href=\"https://github.com/tailscale/tailscale/wiki/Tailscaled-on-macOS\"\u003eTailscale + tailscaled CLI devices\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for alternate control servers by setting the URL in Settings page of the admin console\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eChromecast support while Tailscale is active\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cem\u003eNote: v1.38.0 was never released.\u003c/em\u003e\u003c/p\u003e\n"])</script><script>self.__next_f.push([1,"39:T78e,\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://login.tailscale.com/admin/settings/device-management\"\u003e\u003cstrong\u003eDevice management\u003c/strong\u003e\u003c/a\u003e section is added to the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eSettings\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"https://login.tailscale.com/admin/settings/user-management\"\u003e\u003cstrong\u003eUser management\u003c/strong\u003e\u003c/a\u003e section is added to the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eSettings\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eFeature Previews\u003c/strong\u003e section is removed from the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eSettings\u003c/strong\u003e\u003c/a\u003e page of the admin console. All feature previews are now located in the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eGeneral\u003c/strong\u003e\u003c/a\u003e page.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eIdentity Provider\u003c/strong\u003e and \u003cstrong\u003eUser \u0026#x26; Group Provisioning\u003c/strong\u003e options are moved from the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eGeneral\u003c/strong\u003e\u003c/a\u003e page to the \u003ca href=\"https://login.tailscale.com/admin/settings/user-management\"\u003e\u003cstrong\u003eUser management\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eDevice Approval\u003c/strong\u003e and \u003cstrong\u003eKey Expiry\u003c/strong\u003e options are moved from the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eGeneral\u003c/strong\u003e\u003c/a\u003e page to the \u003ca href=\"https://login.tailscale.com/admin/settings/device-management\"\u003e\u003cstrong\u003eDevice management\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003cstrong\u003eBilling\u003c/strong\u003e drop-down option for logged in users is removed from the admin console. Use the \u003cstrong\u003eBilling\u003c/strong\u003e section in the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eGeneral\u003c/strong\u003e\u003c/a\u003e page instead.\u003c/li\u003e\n\u003c/ul\u003e\n3a:T655,\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\"\u003ca href=\"/kb/1099/device-approval\"\u003eDevice approval\u003c/a\u003e\" replaces \""])</script><script>self.__next_f.push([1,"Device authorization\" as the name of the feature in the \u003ca href=\"https://login.tailscale.com/admin/settings/general\"\u003e\u003cstrong\u003eGeneral\u003c/strong\u003e\u003c/a\u003e settings page of the admin console\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\"\u003ca href=\"/kb/1176/filter-devices/#filter-by-disabled\"\u003eNeeds approval\u003c/a\u003e\" replaces \"Needs authorization\" in the \u003ca href=\"https://login.tailscale.com/admin/machines?q=disabled%3Aneeds-approval\"\u003e\u003cstrong\u003eDisabled\u003c/strong\u003e\u003c/a\u003e filter of the \u003ca href=\"https://login.tailscale.com/admin/machines\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\"\u003ca href=\"/kb/1085/auth-keys/#types-of-auth-keys\"\u003ePre-approved\u003c/a\u003e\" replaces \"Pre-authorized\" in the \u003cstrong\u003eGenerate auth key\u003c/strong\u003e dialog of the \u003ca href=\"https://login.tailscale.com/admin/settings/keys\"\u003e\u003cstrong\u003eKeys\u003c/strong\u003e\u003c/a\u003e page\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\"nodeApproved\" replaces \"nodeAuthorized\" in \u003ca href=\"/kb/1213/webhooks/#events\"\u003ewebhook events\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\"nodeNeedsApproval\" replaces \"nodeNeedsAuthorization\" in webhook events\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\"Enable device approval for tailnet\" replaces \"Enable device authorization for tailnet\" in \u003ca href=\"/kb/1203/audit-logging/#events\"\u003eConfiguration audit logging events\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\"Disable device approval for tailnet\" replaces \"Disable device authorization for tailnet\" in Configuration audit logging events\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\"Approve node\" replaces \"Authorize node\" in Configuration audit logging events\u003c/li\u003e\n\u003c/ul\u003e\n3b:T10f1,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--json\u003c/code\u003e flag for the \u003ca href=\"/kb/1243/tailscale-lock/#lock-status\"\u003e\u003ccode\u003etailscale lock status\u003c/code\u003e\u003c/a\u003e and\n\u003ca href=\"/kb/1243/tailscale-lock/#lock-log\"\u003e\u003ccode\u003etailscale lock log\u003c/code\u003e\u003c/a\u003e commands\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003e--json\u003c/code\u003e flag for the \u003ca href=\"/kb/1080/cli/#version\"\u003e\u003ccode\u003etailscale version\u003c/code\u003e\u003c/a\u003e command\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#update\"\u003e\u003ccode\u003etailscale update\u003c/code\u003e\u003c/a\u003e command to update client\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale debug daemon-logs\u003c/code\u003e to watch server logs\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#status\"\u003e\u003ccode\u003etailscale status --json\u003c/code\u003e\u003c/a\u003e now includes \u003ccode\u003eKeyExpiry\u003c/code\u003e time and \u003ccode\u003eExpired\u003c/code\u003e boolean on nodes\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/kb/1080/cli/#version\"\u003e\u003ccode\u003etailscale version\u003c/code\u003e\u003c/a\u003e now advertises when you're on the \u003ca href=\"/kb/1083/install-unstable\"\u003eunstable\u003c/a\u003e (dev) track\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e(Unix platforms) When \u003ccode\u003e/etc/resolv.conf\u003c/code\u003e needs to be overwritten for lack of options, a\ncomment in the file now links to \u003ca href=\"https://tailscale.com/s/resolvconf-overwrite\"\u003ehttps://tailscale.com/s/resolvconf-overwrite\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e: SSH to \u003ccode\u003etailscaled\u003c/code\u003e as a non-root user works again,\nas long as you only SSH to the same user that \u003ccode\u003etailscaled\u003c/code\u003e is running as\u003c/li\u003e\n\u003cli\u003eFixed: Handle cases where a node expires and we don't receive an update about it from the control\nserver (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6929\"\u003e#6929\u003c/a\u003e and\n\u003ca href=\"https://github.com/tailscale/tailscale/issues/6937\"\u003e#6937\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed: Support UPnP port mapping of gateway devices where they are deployed as a highly available\npair (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6946\"\u003e#6946\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eSupport arbitrary IP protocols like EOIP and GRE (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6423\"\u003e#6423\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eExit node handling of a large number of split DNS domains (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6875\"\u003e#6875\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eAccept DNS-over-TCP responses up to 4K bytes (\u003ca href=\"https://github.com/tailscale/tailscale/pull/6805\"\u003e#6805\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd build support for Loongnix CPU architecture\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ca href=\"/blog/throughput-improvements\"\u003eImproved throughput performance\u003c/a\u003e on Linux (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6663\"\u003e#6663\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eTailscale actions (connect, disconnect, switch profile, use exit node) are available in the Shortcuts app (read the \u003ca href=\"/blog/ios-macos-shortcuts\"\u003eblog post\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTailscale traffic looping upon certain sleep/resume/Wi-Fi change transitions (\u003ca href=\"https://github.com/tailscale/tailscale/issues/5156\"\u003e#5156\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eTailscale actions (connect, disconnect, use exit node) are available in the Shortcuts app\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTailscale using cellular data even after Wi-Fi becomes available (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6565\"\u003e#6565\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eAdd a more robust mechanism to remove WinTun (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6433\"\u003e#6433\u003c/a\u003e)\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eUpdate taskbar menu radio button implementation\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eNew version of the Gio UI library with internationalization and accessibility fixes\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eAllow Sonos app to discover local devices while Tailscale is connected\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eShow whether outgoing connections are configured in the web UI\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eContainers\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eRun in a Kubernetes environment without setting \u003ccode\u003eTS_KUBE_SECRET\u003c/code\u003e (\u003ca href=\"https://github.com/tailscale/tailscale/issues/6704\"\u003e#6704\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eOpenBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e runs on OpenBSD\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"3c:Tdd3,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#switch\"\u003e\u003ccode\u003etailscale switch\u003c/code\u003e\u003c/a\u003e command to switch between accounts using \u003ca href=\"/blog/fast-user-switching\"\u003efast user switching\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#login\"\u003e\u003ccode\u003etailscale login\u003c/code\u003e\u003c/a\u003e command to \u003ca href=\"/kb/1225/fast-user-switching\"\u003elogin with a specified account\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1080/cli/#set\"\u003e\u003ccode\u003etailscale set\u003c/code\u003e\u003c/a\u003e command to modify configuration settings without needing to repeat the others\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1243/tailscale-lock\"\u003e\u003ccode\u003etailscale lock\u003c/code\u003e\u003c/a\u003e command to manage \u003ca href=\"/kb/1226/tailnet-lock\"\u003etailnet lock\u003c/a\u003e for your tailnet\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdditional \u003ca href=\"/kb/1201/4via6-subnets/#magicdns-name-for-the-ipv4-subnet-devices\"\u003e4via6 DNS name\u003c/a\u003e\nformat, \u003ccode\u003eQ-R-S-T-via-X\u003c/code\u003e (or \u003ccode\u003eQ-R-S-T-via-X.yak-bebop.ts.net\u003c/code\u003e), for systems that required dashes instead\nof dots\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDisplay decoded punycode hostnames in status list\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eWarn in \u003ca href=\"/kb/1080/cli/#status\"\u003e\u003ccode\u003etailscale status\u003c/code\u003e\u003c/a\u003e health and \u003ca href=\"/kb/1241/tailscale-up\"\u003e\u003ccode\u003etailscale up\u003c/code\u003e\u003c/a\u003e if there are nodes advertising routes but \u003ccode\u003e--accept-routes=false\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ca href=\"/kb/1225/fast-user-switching\"\u003efast user switching\u003c/a\u003e using \u003ca href=\"/kb/1080/cli/#login\"\u003e\u003ccode\u003etailscale login\u003c/code\u003e\u003c/a\u003e\nand \u003ca href=\"/kb/1080/cli/#switch\"\u003e\u003ccode\u003etailscale switch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eWarn in \u003ca href=\"/kb/1080/cli/#status\"\u003e\u003ccode\u003etailscale status\u003c/code\u003e\u003c/a\u003e health if something else overwrites\n\u003ccode\u003e/etc/resolv.conf\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ca href=\"/kb/1225/fast-user-switching\"\u003efast user switching\u003c/a\u003e by selecting the desired tailnet from the\nTailscale icon in the menubar, or via the \u003ca href=\"/kb/1080/cli/#login\"\u003e\u003ccode\u003etailscale login\u003c/code\u003e\u003c/a\u003e and\n\u003ca href=\"/kb/1080/cli/#switch\"\u003e\u003ccode\u003etailscale switch\u003c/code\u003e\u003c/a\u003e commands\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ca href=\"/kb/1225/fast-user-switching\"\u003efast user switching\u003c/a\u003e by selecting the desired tailnet from the\nTailscale icon in the taskbar, or via the \u003ca href=\"/kb/1080/cli/#login\"\u003e\u003ccode\u003etailscale login\u003c/code\u003e\u003c/a\u003e and\n\u003ca href=\"/kb/1080/cli/#switch\"\u003e\u003ccode\u003etailscale switch\u003c/code\u003e\u003c/a\u003e commands\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eUse named pipes to communicate between UI and Service\u003c/li\u003e\n\u003cli\u003eChanged: Move state storage responsibility from frontend to backend. The current state is migrated, this\nshould not be a noticeable change.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eSwitch to \u003ccode\u003ewingoes\u003c/code\u003e for OLE support, use multithreaded apartment\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eReceived \u003ca href=\"/kb/1106/taildrop\"\u003eTaildrop\u003c/a\u003e files get placed in the \u003ccode\u003eC:\\Users\\(username)\\Downloads\u003c/code\u003e directory (previously they were placed in the \u003ccode\u003eC:\\Users\\(username)\\Desktop\u003c/code\u003e directory)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eAllow Sonos app to discover speakers on the local LAN\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eBetter detect DSM version, locate local socket correctly\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eContainers\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eReplace \u003ccode\u003erun.sh\u003c/code\u003e with \u003ccode\u003ecmd/containerboot\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eFreeBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport for \u003ca href=\"/kb/1193/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e (Thanks Pat Maddox!)\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"3d:T6bd,\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport NextDNS\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ccode\u003etailscaled --no-logs-no-support\u003c/code\u003e (or \u003ccode\u003eTS_NO_LOGS_NO_SUPPORT=true\u003c/code\u003e environment variable)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale bugreport --record\u003c/code\u003e flag to pause and write another bug report\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eMore in-depth health checks in a bugreport\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003etailscale netcheck\u003c/code\u003e looks for a captive portal\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBuild with Go 1.19.2\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eIP fragmentation handling as an exit node\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eSSH inadvertently closing tmux/etc panes at disconnect\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eAlways respond to 4via6 ICMP echo requests\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eNormalize more process names in Services report\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eCoexist with mwan3 package iptables rule fwmark masks, for OpenWRT\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd an eBPF helper to pass the first packet on a new flow up to \u003ccode\u003etailscaled\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBetter detect when running in a container\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eIncorrect list of Taildrop target devices\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eLog Windows service diagnostics when the wintun device fails to install\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eIncorrect list of Taildrop target devices\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eShow an error when unable to accommodate multiple users\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eenvknob support\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eConfigure-host version parsing\u003c/li\u003e\n\u003c/ul\u003e\n3e:Tb0b,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eUse DNS-over-HTTPS for Mullvad DNS servers\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eReport whether a subnet router is running in userspace-networking or kernel mode\u003c/li\u003e\n\u003cli data-change=\"new\"\u003esend Tailscale client version number in ACME requests (to Let's Encrypt, for example)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eReport whether host kernel supports IPv6\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ccode\u003etailscale licenses\u003c/code\u003e with link to open source licenses\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDelete node immediately if \u003ccode\u003etailscaled\u003c/code\u003e exists and was using \u003ccode\u003emem:\u003c/code\u003e state storage\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003etsnet ephemeral nodes will delete themselves on \u003ccode\u003eClose()\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eAdd a timeout when writing to BIRD socket\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eClients can use Noise with any HTTPS port with capver 39 (mainly for Headscale)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003e100.100.100.100 will respond with SERVFAIL if there are no upstream resolvers\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eGracefully handle restarts in resolved support\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eReport \u003ca href=\"/kb/1065/macos-variants\"\u003evariant\u003c/a\u003e (App Store, system extension) in the about box\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFix missing IP address display in the status menu\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd native ARM build for backend Tailscale service (only in NSIS installer in this release)\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eUpdate Proxy support\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eNotice when group policy entries change and move our NRPT rules between the local and group policy subkeys as needed\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eAvoid 2.3 second DNS lookup delay when Smart Name Resolution is enabled by adding MagicDNS names to hosts file\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eDisable NetBIOS nameservice on Tailscale interfaces\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eFix potential crash in notification handling\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFix dismissing of error indication if a bugreport fails\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAllow coordination server URL to be set. Click the Authentication menu three times quickly to enable\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFix Google Stadia, Android Auto, GoPro, and Messages RCS with the VPN active\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eFix \u003ccode\u003e/dev/net\u003c/code\u003e permissions in \u003ccode\u003etailscale configure-host\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eOpenBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport functioning as a subnet router or exit node using hybrid netstack mode\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eOther\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eAccommodate shared nodes in nginx-auth\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFix race in derper (Custom DERP servers) with manual certificates\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"3f:T787,\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ccode\u003eExitNodeStatus\u003c/code\u003e to \u003ccode\u003etailscale status --json\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFix \u003ccode\u003etailscale ping -c N\u003c/code\u003e to properly exit after N ping requests even if there are timeouts\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eMagicDNS recursive resolution now returns \u003ccode\u003eSERVFAIL\u003c/code\u003e if all upstream resolvers fail\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eportmapper: Send discovery packet for IGD specifically, some routers don't respond to \u003ccode\u003essdp:all\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eImplement specific DNS support for AWS, Google Cloud, and Azure to add internal split DNS domain and fallback DNS\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eUse one large 100.64.0.0/10 route entry if there are no other interfaces using CGNAT, to avoid Network Changed errors in browsers where possible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSuppress nonfunctional link-local IPv6 addresses on Tailscale interface, PowerShell \u003ccode\u003eping (hostname)\u003c/code\u003e\nnow works correctly\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eSet registry values to not send DNS changes concerning our interface to AD domain controllers\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eUpdate Windows split DNS settings to work alongside other NRPT entries set by group policy\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eSet \u003ccode\u003eAllowSameVersionUpgrades\u003c/code\u003e attribute on \u003ccode\u003eMajorUpgrade\u003c/code\u003e tag in Windows MSI script\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd portmapper support for NAT-PMP, PCP, UPnP\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd MagicDNS support for TCP\u003c/li\u003e\n\u003cli\u003eChanged: The minimum iOS version is now iOS 15, which makes substantially more memory available (the App Store\nwill offer Tailscale 1.26.2 for iOS 13 and 14 devices)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAndroid can now be an exit node (previously available but hidden)\u003c/li\u003e\n\u003c/ul\u003e\n40:Ta06,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ccode\u003e--peerapi \u0026#x3C;peer\u003e\u003c/code\u003e flag in \u003ca href=\"/kb/1080/cli/#ping\"\u003e\u003ccode\u003etailscale ping\u003c/code\u003e\u003c/a\u003e to check connectivity to a peer using the PeerAPI\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ccode\u003e--timeout \u0026#x3C;duration\u003e\u003c/code\u003e flag in \u003ca href=\"/kb/1241/tailscale-up\"\u003e\u003ccode\u003etailscale up\u003c/code\u003e\u003c/a\u003e to enforce a maximum amount of time to wait for the Tailscale service to initialize\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAllow \u003ccode\u003eLoginInteractive\u003c/code\u003e via \u003ccode\u003eLocalAPI\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eMagicDNS supports DNS/TCP and handling IP fragmented UDP frames\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd an overall 10 second timeout for recursive MagicDNS queries\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ccode\u003eWake-on-LAN\u003c/code\u003e function to PeerAPI. There is no UI for it currently.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eProvide \u003ca href=\"https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh\"\u003e\u003ccode\u003e/run.sh\u003c/code\u003e\u003c/a\u003e as an entrypoint for Docker container builds\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eConfigured MTU is now consistent between a TUN device and a userspace device\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eRefactor \u003ccode\u003etailscale.com/client/tailscale\u003c/code\u003e package with \u003ccode\u003eLocalClient\u003c/code\u003e type\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eChange MagicDNS \"via route\" DNS names from \"via-SITEID.10.2.3.4\" to \"10.2.3.4.via-SITEID\". The old format will continue to work for the next one or two releases.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBuild with Go 1.18.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ca href=\"/kb/1065/macos-variants\"\u003eTailscaled-on-macOS\u003c/a\u003e now supports MagicDNS, including Split DNS\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eInitial release of a standalone macOS client, which is independent of the App Store, in the \u003ca href=\"https://pkgs.tailscale.com/stable/#macos\"\u003estable track\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAdd \u003ca href=\"/kb/1189/install-windows-msi/#ts_nolaunch\"\u003e\u003ccode\u003eTS_NOLAUNCH\u003c/code\u003e\u003c/a\u003e property to allow admins to deploy silent MSI installs without automatically starting the GUI\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eMagicDNS lookup of own hostname\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eHandle more than 50 Split DNS domains\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eResolve one source of shutdown delay (there may still be more)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAllow the NAS disks to hibernate by moving telemetry buffering to tmpfs\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImprove HTTP proxy handling\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003cstrong\u003eBug report\u003c/strong\u003e menu option in the UI\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"41:T546,\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eInitial support for site-relative IPv4 addressing using IPv6\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eFirst for-keepsies deployment of ts2021 protocol\u003c/li\u003e\n\u003cli data-change=\"new\"\u003etsnet now supports providing a custom ipn.StateStore\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eImprove netstack performance via better GC tuning\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eMagicDNS: PTR records for TS service IPs\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eBuild with Go 1.18\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003etaildrop: add \u003ccode\u003efile get --loop\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"new\"\u003etaildrop: add \u003ccode\u003efile get --conflict=(skip|overwrite|rename)\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eDefault to userspace-networking mode on \u003ca href=\"https://gokrazy.org/\"\u003egokrazy\u003c/a\u003e\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eSet tailscale0 link speed to UNKNOWN, not 1Gbps\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eAttempt to load the xt_mark kernel module when it is not present\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eImprove HTTPS proxy handling\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eImprove HTTPS proxy handling\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eAndroid TV support\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eFix and reintroduce Talkback support\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eFreeBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003ePortmapping support\u003c/li\u003e\n\u003c/ul\u003e\n42:T94c,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli\u003eNew: DERP Return Path Optimization (DRPO), allows a pair of nodes in different DERP regions to connect more quickly\nby only requiring one side to connect to the other, cutting down some DERP setup latency\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscaled --state=mem:\u003c/code\u003e registers as an ephemeral node and does not store state to disk\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale status --json\u003c/code\u003e now shows \u003ccode\u003eTags\u003c/code\u003e and \u003ccode\u003ePrimaryRoutes\u003c/code\u003e for Peers. \u003ccode\u003ePrimaryRoutes\u003c/code\u003e shows whether a HA\nsubnet router is currently the active one.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale status --json | jq .TailnetName\u003c/code\u003e will show the name of the tailnet\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eThe optional \u003ccode\u003etailscaled\u003c/code\u003e debug server's Prometheus metrics exporter now also includes Go runtime metrics\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscaled\u003c/code\u003e supports a new \u003ccode\u003eTS_PERMIT_CERT_UID\u003c/code\u003e environment variable containing either a userid or username to\nallow to fetch Tailscale TLS certificates for the node. This environment variable can be set in\n\u003ccode\u003e/etc/default/tailscaled\u003c/code\u003e to permit non-root web servers on the local machine to fetch certs from \u003ccode\u003etailscaled\u003c/code\u003e.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eSend heartbeats less often, saving some battery, matching v1.20 change on mobile platforms.\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003e--auth-key\u003c/code\u003e and \u003ccode\u003e--authkey\u003c/code\u003e both work as \u003ccode\u003etailscale up\u003c/code\u003e arguments\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eMore robust detection of systemd-resolved\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eEfficiently parse extremely large \u003ccode\u003e/proc/net/route\u003c/code\u003e files\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eBe more helpful in suggesting \u003ccode\u003etailscale --operator=USER\u003c/code\u003e to use with Taildrop\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eSome broken host DNS configurations are now detected and reported in \u003ccode\u003etailscale status\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eMSI installer\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eReject SIDs from deleted/invalid security principals to avoid \u003ccode\u003efailed to look up user from userid\u003c/code\u003e error\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eAdd \u003ccode\u003e/var/packages/Tailscale/target/bin/tailscale configure-host\u003c/code\u003e to restore needed\npermissions. We recommend adding this as a scheduled task at boot.\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"43:Tb15,"])</script><script>self.__next_f.push([1,"\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eWhen using an exit node, DNS queries will be forwarded to the exit node for resolution\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscaled\u003c/code\u003e now allows running the outgoing SOCKS5 and HTTP proxies on the same port.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eSOCKS5/HTTP proxies now allow connecting via subnet routers \u0026#x26; exit nodes when run in \u003ccode\u003euserspace-networking\u003c/code\u003e mode\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eMore debug metrics available\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale ip -1\u003c/code\u003e flag\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eCLI now lets you select exit node by name\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eCLI now shows you which nodes are offering exit nodes\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eCLI now refuses to let you pick an invalid exit node (when connected)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003ePacket filter now supports matching any IP protocol number when enabled in ACLs (previously only TCP, UDP, ICMP and SCTP)\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdded \u003ccode\u003eOnline\u003c/code\u003e boolean to \u003ccode\u003etailscale status --json\u003c/code\u003e, made \u003ccode\u003etailscale status\u003c/code\u003e show offline nodes\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eAdded \u003ccode\u003etailscale up --json\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eMagicDNS now works over IPv6 when CGNAT IPv4 is disabled using \u003ccode\u003edisableIPv4: true\u003c/code\u003e in ACL\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eChoose a new DERP relay server if the current DERP is removed from the DERPmap\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eBug fixes, cleanups, log spam reduction\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003e\u003ccode\u003etailscale file cp\u003c/code\u003e sends via the local tailscaled now, so it now supports \u003ccode\u003etailscaled\u003c/code\u003e running in tun-free, \u003ccode\u003euserspace-networking\u003c/code\u003e mode (such as on Synology DSM7 unless you \u003ca href=\"/kb/1131/synology#enable-outbound-connections\"\u003eenable TUN mode\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eGUI support for running an exit node\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eGUI support for running an exit node\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eSend heartbeats less often to conserve battery\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eTalkback support\u003c/li\u003e\n\u003cli data-change=\"new\"\u003eMenu selection to generate a bug report\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\"Allow LAN Access\" checkbox in Exit Node menu\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eSend heartbeats less often to conserve battery\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eImplement DNS config reporting\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eNo longer require fallback DNS to be configured in admin console\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eReport in the UI when connectivity is lost; this functionality was present but broken in prior releases\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eFreeBSD\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eNow supports running in a jail (if devd isn't available, it falls back to network status polling mode)\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"44:T7cc,\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscaled\u003c/code\u003e debug server now exports Prometheus metrics at \u003ccode\u003e/debug/metrics\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eImproved UPnP discovery so that eero devices now work, allowing a port to be opened for direct connections (also in 1.16.2)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eState machine transition regarding expired key extension\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eIf unable to upload telemetry, limit amount buffered to 50MB\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eRetry more transient DNS errors, instead of passing the failure back to the client\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"new\"\u003eSupport storing Tailscale state using AWS SSM (for example, \u003ccode\u003etailscaled -state arn:aws:ssm:eu-west-1:123456789:parameter/foo\u003c/code\u003e) (thank you Maxime Visonneau)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eIf resolvconf wrote \u003ccode\u003e/etc/resolv.conf\u003c/code\u003e but pointed it to \u003ccode\u003esystemd-resolved\u003c/code\u003e, use \u003ccode\u003esystemd-resolved\u003c/code\u003e for DNS not resolvconf\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eIf NetworkManager wrote \u003ccode\u003e/etc/resolv.conf\u003c/code\u003e but pointed it to \u003ccode\u003esystemd-resolved\u003c/code\u003e, use \u003ccode\u003esystemd-resolved\u003c/code\u003e for DNS not NetworkManager\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eHandle \u003ccode\u003e/etc/resolv.conf\u003c/code\u003e being a bind mount into a container, such that we cannot \u003ccode\u003erename()\u003c/code\u003e it.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eWork around Ubuntu 18.04 setLinkDomain length limit by omitting reverse lookup information\u003c/li\u003e\n\u003cli data-change=\"changed\"\u003eUse AF_NETLINK messages to configure IP, not the \u003ccode\u003eip\u003c/code\u003e command. Set \u003ccode\u003eTS_DEBUG_USE_IP_COMMAND\u003c/code\u003e environment variable to revert to use of \u003ccode\u003e/sbin/ip\u003c/code\u003e if this breaks your device\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eOn iOS 15+, where Network Extensions have more memory available, allow the same number of DNS-over-HTTPS requests in flight as other platforms\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eSynology\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"changed\"\u003eOnly use AmbientCaps on DSM7+\u003c/li\u003e\n\u003c/ul\u003e\n45:T6c2,\u003ch6\u003eAll Platforms\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data"])</script><script>self.__next_f.push([1,"-change=\"new\"\u003eSupport storage of node state as a Kubernetes secret.\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale up --authkey=file:/path/to/secret\u003c/code\u003e support\u003c/li\u003e\n\u003cli data-change=\"new\"\u003e\u003ccode\u003etailscale up --qr\u003c/code\u003e for QR codes\u003c/li\u003e\n\u003cli data-change=\"new\"\u003etailscaled in userspace-networking mode can now run an HTTP proxy server (in addition to the prior SOCKS5 proxy server support)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eNo longer need the \u003ccode\u003ewhile tailscale up; do sleep 0.1; done\u003c/code\u003e loops in Docker startup scripts.\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eCPU/memory profiling support in \u003ccode\u003etailscale debug\u003c/code\u003e\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eBake in LetsEncrypt's ISRG Root X1 root (also in 1.14.6)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eLinux\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSupport containers with !CAP_NET_RAW and !CAP_NET_ADMIN (like CircleCI runners)\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eService (portlist) scanning optimized; uses much less CPU on busy servers\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eWindows\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eMove state to C:\\ProgramData (also in 1.14.4)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003emacOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSuper rare Wireguard packet loop network flood when using a DNS server behind a subnet router, when a macOS device resumes from sleep and the network changes (also iOS, but triggers less there). Fixes \u003ca href=\"https://github.com/tailscale/tailscale/issues/1526\"\u003e#1526\u003c/a\u003e (also in 1.14.6).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eiOS\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eTurn the radio on less often to improve battery performance\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch6\u003eAndroid\u003c/h6\u003e\n\u003cul\u003e\n\u003cli data-change=\"fixed\"\u003eSupport Taildrop on older Android releases\u003c/li\u003e\n\u003cli data-change=\"fixed\"\u003eTurn the radio on less often to improve battery performance\u003c/li\u003e\n\u003c/ul\u003e\n"])</script><script>self.__next_f.push([1,"b:[[\"$\",\"section\",null,{\"className\":\"overflow-hidden pt-24 md:pt-[164px]\",\"children\":[\"$\",\"div\",null,{\"className\":\"container\",\"children\":[\"$\",\"div\",null,{\"className\":\"flex w-full max-w-[1060px] gap-[30px]\",\"children\":[[\"$\",\"div\",null,{\"className\":\"hidden flex-[0_1_200px] md:block\"}],[\"$\",\"div\",null,{\"className\":\"flex-[1_1_843px] border-b border-stroke-gray pb-10\",\"children\":[[\"$\",\"h1\",null,{\"className\":\"t-72\",\"children\":\"Changelog\"}],[\"$\",\"p\",null,{\"className\":\"t-b20 mt-[30px] text-subheading-black\",\"children\":\"Updates to the Tailscale client and service.\"}],[\"$\",\"div\",null,{\"className\":\"items mt-[30px] flex gap-[30px]\",\"children\":[\"$\",\"a\",null,{\"href\":\"/changelog/index.xml\",\"className\":\"flex items-center gap-[10px] transition-colors duration-200 hover:text-blue-500\",\"data-track\":\"Link Clicked\",\"data-track-properties\":\"{\\\"label\\\":\\\"Subscribe via RSS\\\"}\",\"children\":[[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"viewBox\":\"0 0 17 17\",\"className\":\"h-auto w-[0.9em]\",\"children\":[\"$\",\"use\",null,{\"href\":\"/sprite.svg#rss\"}]}],[\"$\",\"span\",null,{\"children\":\"Subscribe via RSS\"}]]}]}]]}]]}]}]}],[\"$\",\"section\",null,{\"className\":\"mt-10 overflow-hidden\",\"children\":[[\"$\",\"div\",null,{\"className\":\"container mb-12 md:mb-[60px]\",\"children\":[\"$\",\"div\",null,{\"className\":\"flex w-full max-w-[1060px] gap-[30px]\",\"children\":[[\"$\",\"div\",null,{\"className\":\"hidden flex-[0_1_200px] md:block\"}],[\"$\",\"div\",null,{\"className\":\"flex-[1_1_843px]\",\"children\":[\"$\",\"$L13\",null,{\"kinds\":[\"service\",\"client\",\"other\"]}]}]]}]}],[\"$\",\"div\",null,{\"className\":\"container space-y-10 md:space-y-20\",\"children\":[\"$\",\"$L14\",null,{\"allPosts\":[{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-04-02-k8s-session-recording-beta.mdx\",\"title\":\"Tailscale Kubernetes Operator session recording\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1454/kubernetes-operator-session-recording\\\"\u003eTailscale Kubernetes Operator session recording\u003c/a\u003e to record \u003ca href=\\\"https://kubernetes.io/docs/reference/kubectl/generated/kubectl_exec/\\\"\u003ekubectl exec\u003c/a\u003e session contents when using the \u003ca href=\\\"/kb/1437/kubernetes-operator-api-server-proxy\\\"\u003eKubernetes API server proxy\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages#beta\\\"\u003ebeta\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-04-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-04-02-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes Operator GA\",\"kind\":\"service\",\"link\":\"/blog/k8s-operator-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes Operator\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\\n\u003cul\u003e\\n\u003cli\u003eUse the Kubernetes Operator to integrate Tailscale with Kubernetes clusters.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-04-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-31-docker.mdx\",\"title\":\"Tailscale Docker image v1.82.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAlpine image is updated to version 3.19.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-31-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.82.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see our \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eIngress TLS certificates can be issued from \u003ca href=\\\"https://letsencrypt.org/docs/staging-environment/\\\"\u003eLet's Encrypt's staging environment\u003c/a\u003e to avoid bumping into rate limits during initial setup. See our \u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#proxyclassspec\\\"\u003eGitHub documentation on ProxyClass APIs\u003c/a\u003e to learn more.\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAlpine image is updated to version 3.19.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-31-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.82.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2025-03-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-27-client.mdx\",\"title\":\"Tailscale v1.82.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.82.1\",\"content\":\"\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e v1.82.1 includes fixes for Android devices only, and is exclusively released for Android.\u003c/p\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eDevice search is available on Android TV running Android 13 or later.\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eEnhanced device search UI is available on all devices running Android 13 or later.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-26-client.mdx\",\"title\":\"Tailscale v1.82.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.82.0\",\"content\":\"$15\",\"date\":\"2025-03-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-13-github-action-windows-mac.mdx\",\"title\":\"Tailscale GitHub Action support for Windows and macOS\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ca href=\\\"https://github.com/tailscale/github-action\\\"\u003eTailscale GitHub Action\u003c/a\u003e supports running on Windows \u003ca href=\\\"https://docs.github.com/en/actions/about-github-actions/understanding-github-actions#runners\\\"\u003erunners\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e).\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ca href=\\\"https://github.com/tailscale/github-action\\\"\u003eTailscale GitHub Action\u003c/a\u003e supports running on macOS \u003ca href=\\\"https://docs.github.com/en/actions/about-github-actions/understanding-github-actions#runners\\\"\u003erunners\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-07-security-bulletin.mdx\",\"title\":\"Admin console session timeout update\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAn issue related to admin console sessions remaining active longer than the configured \u003ca href=\\\"/kb/1461/admin-console-session-timeout\\\"\u003econsole session inactivity timeouts\u003c/a\u003e (\u003ca href=\\\"/security-bulletins/#ts-2025-001\\\"\u003eTS-2025-001\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-05-helsinki.mdx\",\"title\":\"Helsinki DERP region\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eHelsinki is added as a \u003ca href=\\\"/kb/1232/derp-servers\\\"\u003eDERP region\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-05-promo-codes.mdx\",\"title\":\"Tailscale promo codes for plan upgrades\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePromo codes can be applied when upgrading to a Tailscale \u003ca href=\\\"/pricing\\\"\u003epaid plan\u003c/a\u003e in the \u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003eBilling\u003c/a\u003e page of the admin console. While upgrading your plan, go to the \u003cstrong\u003eUpgrading to\u003c/strong\u003e section and select \u003cstrong\u003eApply promo code\u003c/strong\u003e. For more information, see \u003ca href=\\\"/kb/1251/pricing-faq#how-do-i-get-a-tailscale-promo-code\\\"\u003ePricing \u0026#x26; Plans FAQ\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-04-client.mdx\",\"title\":\"Tailscale v1.80.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.80.3\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1325/device-web-interface\\\"\u003eWeb interface\u003c/a\u003e setting changes occur as expected and without error.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eApp connectors\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1281/app-connectors\\\"\u003eApp connectors\u003c/a\u003e respond to DNS queries and update routes without failure. Previously, DNS resolution failures may have occurred due to a routing deadlock issue.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-03-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-04-docker.mdx\",\"title\":\"Tailscale Docker image v1.80.3\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2025-03-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-04-kubenetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.80.3\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see our \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2025-03-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-03-04-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.80.3\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2025-03-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-26-terraform.mdx\",\"title\":\"Tailscale Terraform Provider v0.18.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$16\",\"date\":\"2025-02-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-13-ashburn.mdx\",\"title\":\"Ashburn and Nuremberg DERP regions\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAshburn and Nuremberg are added as \u003ca href=\\\"/kb/1232/derp-servers\\\"\u003eDERP regions\u003c/a\u003e. We added them December 5, 2024, and apologize for the late notice.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-02-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-13-client.mdx\",\"title\":\"Tailscale v1.80.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.80.2\",\"content\":\"$17\",\"date\":\"2025-02-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-07-country-code-ga.mdx\",\"title\":\"Country device posture attribute GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUse \u003ccode\u003eip:country\u003c/code\u003e as a geolocation \u003ca href=\\\"/kb/1288/device-posture#device-posture-attributes\\\"\u003edevice posture attribute\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-02-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-06-client.mdx\",\"title\":\"Tailscale v1.80.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.80.1\",\"content\":\"\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ccode\u003eSystem extension uninstalled\u003c/code\u003e message no longer appears erroneously when removing third-party system extensions while Tailscale is running.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eResolved an issue that could have caused the network extension to crash in rare cases while parsing the macOS routing table.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eResolved an issue that could have caused the network extension to crash in rare cases while parsing the iOS routing table.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003etvOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eResolved an issue that could have caused the network extension to crash in rare cases while parsing the tvOS routing table.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-02-06\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-03-docker.mdx\",\"title\":\"Tailscale Docker image v1.80.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$18\",\"date\":\"2025-02-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-03-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.80.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$19\",\"date\":\"2025-02-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-02-03-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.80.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTLS certificate requests from \u003ca href=\\\"https://letsencrypt.org\\\"\u003eLet’s Encrypt\u003c/a\u003e include the device's DNS name in the CSR’s SAN extension and set the \u003ccode\u003eCommon Name\u003c/code\u003e field.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-02-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-30-client.mdx\",\"title\":\"Tailscale v1.80.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.80.0\",\"content\":\"$1a\",\"date\":\"2025-01-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-29-github-user-rename.mdx\",\"title\":\"GitHub username change automatically updates tailnet name\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eWhen a user changes their GitHub username used to authenticate to a \u003ca href=\\\"/kb/1284/sso-github#create-a-github-personal-tailnet\\\"\u003eGitHub personal tailnet\u003c/a\u003e, upon next Tailscale login their \u003ca href=\\\"/kb/1217/tailnet-name\\\"\u003etailnet name\u003c/a\u003e will automatically be renamed. This is a change from the previous behavior, which required the user to file a request with the Tailscale support team to rename the tailnet.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-29\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-4via6.mdx\",\"title\":\"4via6 subnet routers GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e Use \u003ca href=\\\"/kb/1201/4via6-subnets\\\"\u003e4via6 subnet routers\u003c/a\u003e to route traffic when you have existing subnets with overlapping IPv4 addresses (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-acl-autoapprovers.mdx\",\"title\":\"Auto approvers GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUse \u003ca href=\\\"/kb/1337/acl-syntax/#autoapprovers\\\"\u003eauto approvers\u003c/a\u003e to auto-approve advertised subnet routes and exit nodes (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-acl-nodeattrs.mdx\",\"title\":\"Node attributes GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eConfigure \u003ca href=\\\"/kb/1218/nextdns#use-different-nextdns-profiles-for-different-devices\\\"\u003edifferent NextDNS profiles for different devices\u003c/a\u003e using \u003ca href=\\\"/kb/1337/acl-syntax/#nodeattrs\\\"\u003e\u003ccode\u003enodeAttrs\u003c/code\u003e\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-download-invoices.mdx\",\"title\":\"Download invoices GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1182/billing-information/#download-invoices\\\"\u003eDownload invoices\u003c/a\u003e for your Tailscale account in the \u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003e\u003cstrong\u003eBilling\u003c/strong\u003e\u003c/a\u003e page of the admin console (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-fus.mdx\",\"title\":\"Fast user switching GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUse \u003ca href=\\\"/kb/1225/fast-user-switching\\\"\u003efast user switching\u003c/a\u003e to quickly switch between two or more logged-in accounts on the same device, without requiring you to re-authenticate (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-log-config-s3.mdx\",\"title\":\"Configuration log streaming integration with S3 buckets GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eStream \u003ca href=\\\"/kb/1255/log-streaming#configuration-log-streaming\\\"\u003econfiguration audit logs\u003c/a\u003e to \u003ca href=\\\"/kb/1255/log-streaming?tab=amazon+s3#add-configuration-log-streaming\\\"\u003eAmazon S3\u003c/a\u003e and \u003ca href=\\\"/kb/1255/log-streaming?tab=s3-compatible#add-configuration-log-streaming\\\"\u003eS3-compatible services\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-log-network-s3.mdx\",\"title\":\"Network flow log streaming integration with S3 buckets GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eStream \u003ca href=\\\"/kb/1255/log-streaming#network-log-streaming\\\"\u003enetwork flow logs\u003c/a\u003e to \u003ca href=\\\"/kb/1255/log-streaming?tab=amazon+s3#add-a-network-log-streaming-destination\\\"\u003eAmazon S3\u003c/a\u003e and \u003ca href=\\\"/kb/1255/log-streaming?tab=s3-compatible#add-a-network-log-streaming-destination\\\"\u003eS3-compatible services\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-27-ga-nextdns.mdx\",\"title\":\"NextDNS profiles per device GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUse \u003ca href=\\\"/kb/1218/nextdns#use-different-nextdns-profiles-for-different-devices\\\"\u003edifferent NextDNS profiles for different devices\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2025/2025-01-22-github-secrets.mdx\",\"title\":\"GitHub secret scanning\",\"kind\":\"service\",\"link\":\"/blog/github-secret-scanning\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://docs.github.com/code-security/secret-scanning/introduction/about-secret-scanning\\\"\u003eGitHub secret scanning\u003c/a\u003e supports \u003ca href=\\\"https://tailscale.com/kb/1301/secret-scanning#github\\\"\u003edetecting and revoking leaked Tailscale secrets\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2025-01-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-13-client.mdx\",\"title\":\"Tailscale v1.78.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.78.3\",\"content\":\"\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: Tailscale v1.78.2 was an internal-only release.\u003c/p\u003e\\n\u003ch6\u003eContainers\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eUnit test that would previously fail if run in a container.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003cstrong\u003eAdvanced DNS Settings\u003c/strong\u003e view unexpectedly dismissed on iPhone.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eWork in progress search bar is hidden behind a flag until the feature is ready.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-12-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-12-docker.mdx\",\"title\":\"Tailscale Docker image v1.78.3\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eA nil pointer exception when serve config is provided via the \u003ccode\u003eTS_SERVE_CONFIG\u003c/code\u003e environment variable.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-12-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-12-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.78.3\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2024-12-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-12-mullvad-during-trial.mdx\",\"title\":\"Mullvad exit nodes with trial tailnets\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003ca href=\\\"/kb/1258/mullvad-exit-nodes\\\"\u003eMullvad exit nodes\u003c/a\u003e add-on can be purchased for tailnets that are in \u003ca href=\\\"/kb/1182/billing-information#how-plans-are-assigned-to-new-tailnets\\\"\u003etrial mode\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003cbr /\u003e\\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: Purchasing the Mullvad exit nodes add-on for your trial tailnet will result in changes requiring action. For more information, see the \u003ca href=\\\"/kb/1251/pricing-faq#can-i-use-the-mullvad-exit-nodes-add-on-with-a-tailnet-trial\\\"\u003ePricing \u0026#x26; Plans FAQ\u003c/a\u003e topic.\u003c/p\u003e\\n\",\"date\":\"2024-12-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-12-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.78.3\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2024-12-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-11-posture-integrations.mdx\",\"title\":\"Device posture integrations GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eDevice posture integrations GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eRestrict device access with Tailscale \u003ca href=\\\"/kb/1288/device-posture\\\"\u003edevice posture management\u003c/a\u003e and additional GA integrations: \u003ca href=\\\"/kb/1409/jamf-pro\\\"\u003eJamf Pro\u003c/a\u003e, \u003ca href=\\\"/kb/1405/kandji\\\"\u003eKandji\u003c/a\u003e, \u003ca href=\\\"/kb/1410/intune\\\"\u003eMicrosoft Intune\u003c/a\u003e, and \u003ca href=\\\"/kb/1390/sentinelone\\\"\u003eSentinelOne\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-12-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-10-docker.mdx\",\"title\":\"Tailscale Docker image v1.78.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAll Tailscale container images are annotated with Open Container Initiative (OCI) \u003ca href=\\\"https://specs.opencontainers.org/image-spec/annotations/\\\"\u003eannotations\u003c/a\u003e.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eClients should more accurately detect whether they are in a container when checking for updates.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-12-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-10-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.78.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$1b\",\"date\":\"2024-12-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-10-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.78.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAll Tailscale container images are annotated with Open Container Initiative (OCI) \u003ca href=\\\"https://specs.opencontainers.org/image-spec/annotations/\\\"\u003eannotations\u003c/a\u003e.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eClients should more accurately detect whether they are in a container when checking for updates.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-12-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-05-client-patch.mdx\",\"title\":\"Tailscale v1.78.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.78.1\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIssue which resulted in an unwanted change in source code line endings.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-12-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-12-05-client.mdx\",\"title\":\"Tailscale v1.78.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.78.0\",\"content\":\"$1c\",\"date\":\"2024-12-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-27-country-code.mdx\",\"title\":\"Country device posture attribute\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003eip:country\u003c/code\u003e has been added as a \u003ca href=\\\"/kb/1288/device-posture#device-posture-attributes\\\"\u003edevice posture attribute\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-11-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-14-oauth-scopes.mdx\",\"title\":\"New and more granular OAuth scopes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eNew scopes for \u003ca href=\\\"/kb/1215/oauth-clients\\\"\u003eOAuth clients\u003c/a\u003e have been added with more granular permissions. Existing OAuth clients using the previous set of scopes, and keys generated using these clients, are still valid.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-11-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-08-docker.mdx\",\"title\":\"Tailscale Docker image v1.76.6\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eLogging for when clients move home \u003ca href=\\\"/kb/1232/derp-servers\\\"\u003eDERP\u003c/a\u003e regions is improved.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eTailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-11-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-08-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.76.6\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eLogging for when clients move home \u003ca href=\\\"/kb/1232/derp-servers\\\"\u003eDERP\u003c/a\u003e regions is improved.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eTailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-11-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-08-s3-logging.mdx\",\"title\":\"Log streaming integration with S3 buckets\",\"kind\":\"service\",\"link\":\"/blog/s3-log-streaming\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eTailscale \u003ca href=\\\"/kb/1255/log-streaming#network-log-streaming\\\"\u003enetwork flow logs\u003c/a\u003e and \u003ca href=\\\"/kb/1255/log-streaming#configuration-log-streaming\\\"\u003econfiguration audit logs\u003c/a\u003e can now be streamed to \u003ca href=\\\"https://aws.amazon.com/s3/\\\"\u003eAmazon S3\u003c/a\u003e and S3-compatible services (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-11-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-08-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.76.6\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eLogging for when clients move home \u003ca href=\\\"/kb/1232/derp-servers\\\"\u003eDERP\u003c/a\u003e regions is improved.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eTailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-11-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-06-client.mdx\",\"title\":\"Tailscale v1.76.6\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.76.6\",\"content\":\"\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: v1.76.4 and v1.76.5 were internal-only releases.\u003c/p\u003e\\n\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"updated\\\"\u003eLogging for when clients move home \u003ca href=\\\"/kb/1232/derp-servers\\\"\u003eDERP\u003c/a\u003e regions is improved.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eTailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c!-- ###### Linux\\n\\n###### Windows\\n\\n###### macOS\\n\\n###### iOS\\n\\n###### tvOS --\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAndroid app no longer terminates unexpectedly when performing network transitions.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c!--\\n###### NAS platforms\\n\\n###### Synology\\n\\n###### QNAP\\n\\n###### UNRAID\\n\\n###### FreeBSD\\n\\n###### OpenBSD\\n\\n###### Gokrazy\\n\\n###### WASI --\u003e\\n\",\"date\":\"2024-11-06\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-11-05-user-ga.mdx\",\"title\":\"User approval and Invite any user GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1239/user-approval\\\"\u003eUser approval\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1271/invite-any-user\\\"\u003eInvite any user\u003c/a\u003e GA\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-11-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-24-1password-xam.mdx\",\"title\":\"1Password XAM device posture integration GA\",\"kind\":\"service\",\"link\":\"/blog/1password-extended-access-kolide\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e1Password Extended Access Management (XAM) GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003e\u003ca href=\\\"/kb/1407/kolide\\\"\u003eRestrict device access with 1Password XAM\u003c/a\u003e (formerly known as Kolide) and Tailscale \u003ca href=\\\"/kb/1288/device-posture\\\"\u003edevice posture management\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-21-client.mdx\",\"title\":\"Tailscale v1.76.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.76.3\",\"content\":\"\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: v1.76.3 includes fixes for Windows devices only, and is exclusively released for Windows.\u003c/p\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eMullvad VPN submenu no longer fails to populate with \u003ca href=\\\"/kb/1258/mullvad-exit-nodes\\\"\u003eMullvad exit nodes\u003c/a\u003e if there aren't any non-Mullvad exit nodes in the tailnet.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-17-client.mdx\",\"title\":\"Tailscale v1.76.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.76.2\",\"content\":\"\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: v1.76.2 includes fixes for Android TV devices only, and is exclusively released for Android.\u003c/p\u003e\\n\u003c!--\\n###### All platforms\\n\\n###### Linux\\n\\n###### Windows\\n\\n###### macOS\\n\\n###### iOS\\n\\n###### tvOS --\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eD-Pad navigation is optimized in the Tailscale app on Android TV devices.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c!-- ###### NAS platforms\\n\\n###### Synology\\n\\n###### QNAP\\n\\n###### UNRAID\\n\\n###### FreeBSD\\n\\n###### OpenBSD\\n\\n###### Gokrazy\\n\\n###### WASI --\u003e\\n\",\"date\":\"2024-10-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-16-client.mdx\",\"title\":\"Tailscale v1.76.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.76.1\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1080/cli#netcheck\\\"\u003e\u003ccode\u003etailscale netcheck\u003c/code\u003e\u003c/a\u003e CLI command no longer crashes when performing diagnostics on networks lacking UDP connectivity.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eImproperly formatted \u003ccode\u003eSERVFAIL\u003c/code\u003e responses no longer cause DNS timeouts when using an \u003ca href=\\\"/kb/1103/exit-nodes\\\"\u003eexit node\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003edbus login sessions no longer fail on systems where \u003ccode\u003e/bin/login\u003c/code\u003e is missing.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c!-- ###### Windows\\n\\n###### macOS\\n\\n###### iOS\\n\\n###### tvOS --\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAndroid application no longer crashes in certain configurations when editing the \u003ca href=\\\"/kb/1444/android-app-split-tunneling\\\"\u003eapp-based split tunneling\u003c/a\u003e settings.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c!-- ###### NAS platforms\\n\\n###### Synology\\n\\n###### QNAP\\n\\n###### UNRAID\\n\\n###### FreeBSD\\n\\n###### OpenBSD\\n\\n###### Gokrazy\\n\\n###### WASI --\u003e\\n\",\"date\":\"2024-10-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-16-docker.mdx\",\"title\":\"Tailscale Docker image v1.76.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2024-10-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-16-google-group-sync.mdx\",\"title\":\"Google Workspace integration GA\",\"kind\":\"service\",\"link\":\"/blog/google-workspace-sync-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1317/sso-google-sync\\\"\u003eUser \u0026#x26; group provisioning for Google Workspace\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eSync Google Workspace groups and users to use in your \u003ca href=\\\"/kb/1337/acl-syntax/#provisioned-groups\\\"\u003eTailscale ACLs\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-16-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.76.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1438/kubernetes-operator-cluster-egress\\\"\u003eTailnet services can be exposed\u003c/a\u003e to cluster workloads on multiple proxy replicas using a ProxyGroup. It's also possible to expose multiple tailnet services on a single set of ProxyGroup replicas.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eSingle use proxy \u003ca href=\\\"/kb/1085/auth-keys\\\"\u003eauth keys\u003c/a\u003e no longer persist in the state Secrets after the proxies have logged in. This should fix an issue where, in some edge cases, the leftover keys were causing the proxies to attempt to re-authenticate after Pod restart.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-16-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.76.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eState directory can be set with the \u003ccode\u003eTS_STATE_DIR\u003c/code\u003e environment variable. The state directory also defaults to \u003ccode\u003e/tmp/\u003c/code\u003e for all tsrecorder installations that explicitly set the statefile location.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-10-client.mdx\",\"title\":\"Tailscale v1.76.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.76.0\",\"content\":\"$1d\",\"date\":\"2024-10-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-03-pricing-personal-plus.mdx\",\"title\":\"Personal Plus pricing plan\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe Personal Plus \u003ca href=\\\"/pricing\\\"\u003epricing plan\u003c/a\u003e offers the same features as the Personal plan with up to 6 users for a flat rate. For details about billing, plan comparison, and support, see \u003ca href=\\\"/kb/1251/pricing-faq\\\"\u003ePricing \u0026#x26; Plans FAQ\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-02-client.mdx\",\"title\":\"Tailscale v1.74.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.74.2\",\"content\":\"\u003cp\u003eTailscale v1.74.2 addresses an issue for iOS, and is exclusively released for that platform.\u003c/p\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eThe Tailscale app launches as expected when \u003cstrong\u003eWi-Fi Calling on This iPhone\u003c/strong\u003e is enabled in the iOS \u003cstrong\u003eCellular\u003c/strong\u003e settings.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-10-02-delete-tailnet.mdx\",\"title\":\"Tailnet deletion\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTailnets containing multiple users can be \u003ca href=\\\"/kb/1237/delete-tailnet\\\"\u003edeleted\u003c/a\u003e from the admin console without first deleting the users manually.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-10-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-27-attribute-expiry.mdx\",\"title\":\"Parameters added to Set custom device posture attributes endpoint\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe optional \u003ccode\u003eexpiry\u003c/code\u003e and \u003ccode\u003ecomment\u003c/code\u003e parameters have been added to the \u003ca href=\\\"https://tailscale.com/api#tag/devices/POST/device/%7BdeviceId%7D/attributes/%7BattributeKey%7D\\\"\u003eSet custom device posture attributes\u003c/a\u003e endpoint of the \u003ca href=\\\"/kb/1288/device-posture#posture-attributes-api\\\"\u003edevice posture attribute API\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-09-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-18-client.mdx\",\"title\":\"Tailscale v1.74.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.74.1\",\"content\":\"\u003cp\u003eTailscale v1.74.1 addresses issues for Linux and Android, and is exclusively released for those platforms.\u003c/p\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eLinux-only NAT traversal optimization added in v1.74.0 is now disabled following a bug report. The behavior is reverted to that of v1.72.x and earlier and will be re-added in a future release.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e The Android client release for v1.74.0 was delayed and moved into the v1.74.1 client release instead.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDevice network change detection is improved to reflect accurate \u003ca href=\\\"/kb/1054/dns\\\"\u003eTailscale DNS\u003c/a\u003e configuration updates.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1315/mdm-keys\\\"\u003eSystem policies\u003c/a\u003e for the Android client on ChromeOS work as expected.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-09-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-18-docker.mdx\",\"title\":\"Tailscale Docker image v1.74.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2024-09-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-18-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.74.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eRecorder CRD (custom resource) is added for deploying the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e to Kubernetes.\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eDefault \u003ca href=\\\"/kb/1445/kubernetes-operator-customization\\\"\u003e\u003ccode\u003eProxyClass\u003c/code\u003e\u003c/a\u003e can now be specified for the Kubernetes Operator proxies. If you are using Helm, the default \u003ccode\u003eProxyClass\u003c/code\u003e can be configured in the \u003ccode\u003eproxyConfig.defaultProxyClass\u003c/code\u003e Helm value or set using \u003ccode\u003ePROXY_DEFAULT_CLASS\u003c/code\u003e environment variable.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eWildcards in \u003ca href=\\\"https://kubernetes.io/docs/reference/access-authn-authz/rbac/\\\"\u003eRBAC\u003c/a\u003e role definitions are replaced with exact verbs.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-09-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-18-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.74.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e This version contains no changes except for library updates.\u003c/p\u003e\\n\",\"date\":\"2024-09-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-13-terraform.mdx\",\"title\":\"Tailscale Terraform Provider v0.17.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$1e\",\"date\":\"2024-09-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-12-client.mdx\",\"title\":\"Tailscale v1.74.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.74.0\",\"content\":\"$1f\",\"date\":\"2024-09-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-09-11-posture-identity-hwaddr.mdx\",\"title\":\"MAC addresses matching in CrowdStrike Falcon\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1288/device-posture\\\"\u003eDevice posture\u003c/a\u003e integration with \u003ca href=\\\"/kb/1289/crowdstrike-zta\\\"\u003eCrowdStrike Falcon\u003c/a\u003e can now use MAC addresses to match devices that lack serial numbers. When Falcon integration is configured, \u003ca href=\\\"/kb/1326/device-identity-collection\\\"\u003eDevice Identity Collection\u003c/a\u003e will automatically collect MAC addresses.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-09-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-26-client.mdx\",\"title\":\"Tailscale v1.72.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.72.2\",\"content\":\"\u003cp\u003eTailscale v1.72.2 addresses issues for macOS, iOS, and tvOS, and is exclusively released for those platforms.\u003c/p\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAn issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAn issue that could prevent Tailscale from automatically launching at login on some Macs is fixed.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAn issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003etvOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAn issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-23-session-expiry.mdx\",\"title\":\"Configurable session timeouts\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAdmin console \u003ca href=\\\"/kb/1461/admin-console-session-timeout\\\"\u003esession timeouts from inactivity\u003c/a\u003e are now configurable from the \u003ca href=\\\"https://login.tailscale.com/admin/settings/user-management\\\"\u003eUser Management Settings\u003c/a\u003e page of the admin console.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-22-client.mdx\",\"title\":\"Tailscale v1.72.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.72.1\",\"content\":\"\u003cp\u003eTailscale v1.72.1 addresses a Linux-specific issue, and is exclusively released for the Linux platform and containers.\u003c/p\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTCP generic segmentation offload (GSO) support for userspace mode is removed.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDNS over TCP failures when querying the Tailscale-internal resolver are fixed.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-22-docker.mdx\",\"title\":\"Tailscale Docker image v1.72.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDNS over TCP failures when querying the Tailscale-internal resolver are fixed.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-22-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.72.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDNS over TCP failures when querying the Tailscale-internal resolver are fixed.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-22-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.72.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDNS over TCP failures when querying the Tailscale-internal resolver are fixed.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-21-docker.mdx\",\"title\":\"Tailscale Docker image v1.72.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAn HTTP health check endpoint at \u003ccode\u003e/healthz\u003c/code\u003e can be enabled by setting \u003ccode\u003eTS_HEALTHCHECK_ADDR_PORT\u003c/code\u003e to \u003ccode\u003e[addr]:port\u003c/code\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-21-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.72.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAdditional environment variables can now be passed for the Kubernetes Operator deployment via \u003ca href=\\\"/kb/1236/kubernetes-operator#helm\\\"\u003eHelm chart\u003c/a\u003e options.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ccode\u003eDNSConfig CRD\u003c/code\u003e reconcile logic is fixed for dual-stack clusters.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-21-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.72.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eRunning without HTTPS is now allowed when UI is disabled.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-19-client.mdx\",\"title\":\"Tailscale v1.72.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.72.0\",\"content\":\"$20\",\"date\":\"2024-08-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-15-via-in-previews.mdx\",\"title\":\"Via in Access Control Previews\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1393/access-control\\\"\u003eAccess control policies\u003c/a\u003e using \u003ca href=\\\"/kb/1378/via\\\"\u003e\u003ccode\u003evia\u003c/code\u003e\u003c/a\u003e are included in the \u003cstrong\u003ePreview rules\u003c/strong\u003e tab of the \u003ca href=\\\"https://login.tailscale.com/admin/acls/preview\\\"\u003e\u003cstrong\u003eAccess Controls\u003c/strong\u003e\u003c/a\u003e page of the admin console.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-13-entra.mdx\",\"title\":\"Microsoft Entra ID SCIM GA\",\"kind\":\"service\",\"link\":\"/blog/entra-id\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1249/sso-entra-id-scim\\\"\u003eUser \u0026#x26; group provisioning for Microsoft Entra ID\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eSync Microsoft Entra ID groups and users to use in your \u003ca href=\\\"/kb/1337/acl-syntax/#provisioned-groups\\\"\u003eTailscale ACLs\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-08-ssh-autogroups.mdx\",\"title\":\"Autogroups allowed as SSH source in ACLs\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSSH \u003ccode\u003esrc\u003c/code\u003e in \u003ca href=\\\"/kb/1018/acls\\\"\u003eACL\u003c/a\u003e rules supports all role-based \u003ca href=\\\"/kb/1337/acl-syntax#autogroups\\\"\u003eautogroups\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-08-02-device-posture-integrations.mdx\",\"title\":\"New device posture integrations\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1407/kolide\\\"\u003e1Password XAM\u003c/a\u003e is available as a device posture integration (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e \u003ca href=\\\"/kb/1409/jamf-pro\\\"\u003eJamf Pro\u003c/a\u003e is available as a device posture integration (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1405/kandji\\\"\u003eKandji\u003c/a\u003e is available as a device posture integration (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1410/intune\\\"\u003eMicrosoft Intune\u003c/a\u003e is available as a device posture integration (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1390/sentinelone\\\"\u003eSentinelOne\u003c/a\u003e is available as a device posture integration (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-08-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-25-control-d.mdx\",\"title\":\"Control D integration\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1403/control-d\\\"\u003eControl D DNS\u003c/a\u003e is available as a global nameserver in your tailnet.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-22-api.mdx\",\"title\":\"New API endpoints\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eWe have added the following endpoints to Tailscale's public API:\u003c/p\u003e\\n\u003ch5\u003eDevice endpoints\u003c/h5\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/api#tag/devices/POST/device/%7BdeviceId%7D/name\\\"\u003eSet device name\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch5\u003eWebhook management endpoints\u003c/h5\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/api#tag/webhooks/GET/webhooks/%7BendpointId%7D\\\"\u003eGet a webhook\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch5\u003eTailnet settings endpoints\u003c/h5\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/api#tag/tailnetsettings/GET/tailnet/%7Btailnet%7D/settings\\\"\u003eGet tailnet settings\u003c/a\u003e.\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/api#tag/tailnetsettings/PATCH/tailnet/%7Btailnet%7D/settings\\\"\u003eUpdate tailnet settings\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-22-client-docker.mdx\",\"title\":\"Tailscale Docker image v1.70.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1282/docker\\\"\u003eTailscale Docker image\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e or from our \u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub packages repo\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eEgress proxies specified by an \u003ca href=\\\"https://en.wikipedia.org/wiki/Fully_qualified_domain_name\\\"\u003eFQDN\u003c/a\u003e now work also for IPv6-only network stacks.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-22-client-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.70.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is available. For guidance on installing and updating, see our \u003ca href=\\\"/kb/1236/kubernetes-operator#installation\\\"\u003einstallation instructions\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eEgress proxies specified by an \u003ca href=\\\"https://en.wikipedia.org/wiki/Fully_qualified_domain_name\\\"\u003eFQDN\u003c/a\u003e now work also for IPv6-only network stacks.\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eTailscale \u003ccode\u003eService\u003c/code\u003e status now includes a custom Tailscale proxy status condition.\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eOptionally record \u003ccode\u003ekubectl exec\u003c/code\u003e sessions.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCluster resources for failed egress proxies are now correctly cleaned up when the parent \u003ccode\u003eService\u003c/code\u003e is deleted.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-22-client-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.70.0\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cp\u003eA new release of the \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale \u003ccode\u003etsrecorder\u003c/code\u003e\u003c/a\u003e is available. You can download it from \u003ca href=\\\"https://hub.docker.com/r/tailscale/tsrecorder/tags\\\"\u003eDocker Hub\u003c/a\u003e.\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ccode\u003etsrecorder\u003c/code\u003e now plays session recordings for interactive sessions initiated by a command that explicitly specifies shell.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-17-client.mdx\",\"title\":\"Tailscale v1.70.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.70.0\",\"content\":\"$21\",\"date\":\"2024-07-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-15-indent.mdx\",\"title\":\"Indent has shut down\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://indent.com\\\"\u003eIndent\u003c/a\u003e shut down their service effective July 15, 2024.\\nIf you were using Indent with your Tailscale network, migrate to another on-demand access system or Tailscale's \u003ca href=\\\"/kb/1383/tailscale-slack-accessbot\\\"\u003ejust-in-time accessbot (alpha)\u003c/a\u003e, or otherwise turn off your Indent integration with Tailscale.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-11-onboarding.mdx\",\"title\":\"Plan enrollment changes for new tailnets\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe process for creating a new tailnet now asks you if the tailnet will be primarily used \u003cstrong\u003eAt work\u003c/strong\u003e or \u003cstrong\u003eAt home\u003c/strong\u003e. This determines whether to enroll the tailnet into a 14-day trial or the \u003ca href=\\\"/pricing\\\"\u003ePersonal plan\u003c/a\u003e. For more details, see the \u003ca href=\\\"/kb/1017/install#create-a-tailnet\\\"\u003eTailscale quickstart\u003c/a\u003e topic.\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eNewly created tailnets using custom domains are no longer automatically enrolled in a trial. Instead, the \u003cstrong\u003eAt work\u003c/strong\u003e or \u003cstrong\u003eAt home\u003c/strong\u003e selection determines trial enrollment.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-10-api.mdx\",\"title\":\"New API endpoints, OpenAPI spec, and interactive API docs\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$22\",\"date\":\"2024-07-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-10-invites.mdx\",\"title\":\"Automatically cleanup invites\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1064/invite-team-members\\\"\u003eInvite team member\u003c/a\u003e invites are now automatically deleted 90 days after the last welcome email was sent.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-08-ipsets.mdx\",\"title\":\"IP sets GA\",\"kind\":\"service\",\"link\":\"/blog/via\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eIP sets GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1387/ipsets\\\"\u003eIP sets\u003c/a\u003e to target and manage cross-sections of your tailnet independently of other groupings like subnets, tags, and groups.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-08-via.mdx\",\"title\":\"Via in grants\",\"kind\":\"service\",\"link\":\"/blog/via\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1378/via\\\"\u003eVia\u003c/a\u003e to add routing awareness to \u003ca href=\\\"/kb/1324/acl-grants\\\"\u003egrants\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages#beta\\\"\u003ebeta\u003c/a\u003e).\\n\u003cul\u003e\\n\u003cli\u003eDefine the exit nodes, subnet routers, or app connectors a source can access when they use a specific destination.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-07-02-client.mdx\",\"title\":\"Tailscale v1.68.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.68.2\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003eTailnet lock\u003c/a\u003e validation of rotation signatures now permits multiple nodes signed by the same pre-signed reusable auth key.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eWake from sleep reliability is improved for re-connections and transitions between networks.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eWake from sleep reliability is improved for re-connections and transitions between networks.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-07-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-06-25-google-group-sync.mdx\",\"title\":\"Sync Google Workspace groups to use in your Tailscale ACLs\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1317/sso-google-sync\\\"\u003eUser \u0026#x26; group provisioning for Google Workspace\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-06-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-06-21-indent.mdx\",\"title\":\"Indent shutting down July 15, 2024\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://indent.com\\\"\u003eIndent\u003c/a\u003e has announced they are shutting down 12:00 PM PST July 15, 2024.\\nIf you are using Indent with your Tailscale network, migrate to another on-demand access system or Tailscale's \u003ca href=\\\"/kb/1383/tailscale-slack-accessbot\\\"\u003ejust-in-time accessbot (alpha)\u003c/a\u003e, or otherwise turn off your \u003ca href=\\\"/kb/1205/ondemand-indent\\\"\u003eIndent integration\u003c/a\u003e by that time.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-06-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-06-20-client-docker.mdx\",\"title\":\"Tailscale Docker image v1.68.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$23\",\"date\":\"2024-06-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-06-20-client-kubernetes.mdx\",\"title\":\"Tailscale Kubernetes operator v1.68.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$24\",\"date\":\"2024-06-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-06-20-client-tsrecorder.mdx\",\"title\":\"Tailscale tsrecorder v1.68.1\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$25\",\"date\":\"2024-06-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-06-14-client.mdx\",\"title\":\"Tailscale v1.68.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.68.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1201/4via6-subnets\\\"\u003e4via6 subnet router\u003c/a\u003e advertisement works as expected.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e access to Security-Enhanced Linux (SELinux) machines works as expected.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAndroid TV navigation is improved.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-06-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-06-12-client.mdx\",\"title\":\"Tailscale v1.68.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.68.0\",\"content\":\"$26\",\"date\":\"2024-06-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-30-auto-exit-nodes.mdx\",\"title\":\"Auto exit nodes\",\"kind\":\"service\",\"link\":\"blog/auto-exit-nodes\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eYou can now automatically select a \u003ca href=\\\"/kb/1392/auto-exit-nodes\\\"\u003erecommended exit node\u003c/a\u003e based on client information (such as location).\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-05-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-24-exit-node-destination-logging.mdx\",\"title\":\"Exit node destination logging\",\"kind\":\"service\",\"link\":\"/blog/egress-logging\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1103/exit-nodes\\\"\u003eExit node\u003c/a\u003e destination logging can now be configured from the \u003ca href=\\\"https://login.tailscale.com/admin/logs/network\\\"\u003e\u003cstrong\u003eNetwork flow logs\u003c/strong\u003e\u003c/a\u003e tab in the \u003cstrong\u003eLogs\u003c/strong\u003e page of the admin console.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-05-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-20-client.mdx\",\"title\":\"Tailscale v1.66.4\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.66.4\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eRestored UDP connectivity through \u003ca href=\\\"/kb/1258/mullvad-exit-nodes\\\"\u003eMullvad exit nodes\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eStateful filtering is now off by default. Stateful filtering was introduced in 1.66.0 as a mitigation for a vulnerability described in \u003ca href=\\\"/security-bulletins#ts-2024-005\\\"\u003eTS-2024-005\u003c/a\u003e, and inadvertently broke DNS resolution from containers running on the host. Most vulnerable setups are protected by other mitigations already, except when \u003ccode\u003eautogroup:danger-all\u003c/code\u003e is used in \u003ca href=\\\"/kb/1018/acls\\\"\u003eACLs\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-05-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-15-client.mdx\",\"title\":\"Tailscale v1.66.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.66.3\",\"content\":\"$27\",\"date\":\"2024-05-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-15-dark-mode.mdx\",\"title\":\"Dark mode in the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse the \u003cstrong\u003eLight\u003c/strong\u003e, \u003cstrong\u003eDark\u003c/strong\u003e, or \u003cstrong\u003eUse system setting\u003c/strong\u003e theme in the admin console by clicking the avatar menu on the top-right and selecting \u003cstrong\u003eAppearance\u003c/strong\u003e. The default theme is \u003cstrong\u003eUse system setting\u003c/strong\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-05-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-10-amazon-fire.mdx\",\"title\":\"Support for Amazon Fire devices\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe Tailscale app for Android is now available in the \u003ca href=\\\"https://www.amazon.com/dp/B0D38TRB3N\\\"\u003eAmazon Appstore\u003c/a\u003e for \u003ca href=\\\"/kb/1394/install-amazon-fire\\\"\u003eAmazon Fire TVs and tablets\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-05-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-09-client.mdx\",\"title\":\"Tailscale v1.66.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.66.1\",\"content\":\"\u003cp\u003eThis release is exclusively for Linux platforms and the \u003ca href=\\\"/kb/1065/macos-variants\\\"\u003estandalone variant\u003c/a\u003e of the macOS client. It is not available for other platforms.\u003c/p\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1080/cli#set\\\"\u003e\u003ccode\u003etailscale set\u003c/code\u003e\u003c/a\u003e command flags \u003ccode\u003e--netfilter-mode\u003c/code\u003e, \u003ccode\u003e--snat-subnet-routes\u003c/code\u003e, and \u003ccode\u003e--stateful-filtering\u003c/code\u003e are added.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIssue with \u003ca href=\\\"/kb/1294/firewall-mode\\\"\u003e\u003ccode\u003enftables\u003c/code\u003e\u003c/a\u003e rules for stateful filtering, introduced in v1.66.0.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eA version mismatch warning no longer displays when upgrading, if no mismatch is detected.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-05-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-08-acl-updates.mdx\",\"title\":\"ACL syntax updates\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$28\",\"date\":\"2024-05-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-08-client.mdx\",\"title\":\"Tailscale v1.66.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.66.0\",\"content\":\"$29\",\"date\":\"2024-05-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-05-01-device-posture.mdx\",\"title\":\"Device posture management GA\",\"kind\":\"service\",\"link\":\"/blog/crowdstrike\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eDevice posture management GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1288/device-posture\\\"\u003eDevice posture management\u003c/a\u003e to collect device properties and set device connectivity rules within your Tailscale network. Leverage \u003ca href=\\\"/kb/1289/crowdstrike-zta\\\"\u003eTailscale's integration with CrowdStrike\u003c/a\u003e to use Falcon Zero Trust Assessment (ZTA) scores to enable granular access control based on device health and security.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-05-01\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-30-split-dns.mdx\",\"title\":\"Manage split DNS in API and Terraform\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe API can now \u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/api.md#get-split-dns\\\"\u003eread\u003c/a\u003e, \u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/api.md#update-split-dns\\\"\u003eupdate\u003c/a\u003e, and \u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/api.md#set-split-dns\\\"\u003eset\u003c/a\u003e \u003ca href=\\\"/kb/1054/dns#nameservers\\\"\u003esplit DNS\u003c/a\u003e.\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ca href=\\\"https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/dns_split_nameservers\\\"\u003eTailscale Terraform provider\u003c/a\u003e can now manage \u003ca href=\\\"/kb/1054/dns#nameservers\\\"\u003esplit DNS\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-23-axiom.mdx\",\"title\":\"Log streaming with Axiom\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eLog streaming integration with \u003ca href=\\\"https://axiom.co\\\"\u003eAxiom\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e).\\n\u003cul\u003e\\n\u003cli\u003eUse Axiom for \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003elog streaming\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-22-winver.mdx\",\"title\":\"Windows OS versions in admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eWindows machines in the admin console are now displayed using their marketing version number instead of their internal version number.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-18-sso-all-plans.mdx\",\"title\":\"All identity providers available to everyone\",\"kind\":\"service\",\"link\":\"/blog/sso-tax-cut\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAllowable \u003ca href=\\\"/kb/1013/sso-providers\\\"\u003eidentity providers\u003c/a\u003e are no longer limited by \u003ca href=\\\"/pricing\\\"\u003epricing plan\u003c/a\u003e. Any supported identity provider is available to all plans.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-17-client.mdx\",\"title\":\"Tailscale v1.64.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.64.2\",\"content\":\"\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eInstallers are now built using WiX toolchain \u003ca href=\\\"https://www.firegiant.com/blog/2024/2/6/wix-security-releases-available/\\\"\u003eversion 3.14.1\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDiskStation Manager UI no longer freezes for a few minutes at startup when attempting to clean unused routes. This update is applicable to the version provided on \u003ca href=\\\"https://pkgs.tailscale.com/stable/#spks\\\"\u003epkgs.tailscale.com\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-15-changelog.mdx\",\"title\":\"Changelog update\",\"kind\":\"other\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe Tailscale changelog has migrated to a new server. To prevent disruptions to RSS readers that subscribe to our changelog, we have limited the RSS feed to entries published on or after 2024-04-15. Existing RSS subscriptions should not lose access to older entries that have already been downloaded. The full changelog history is always available on our website\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-15-email-device-invites.mdx\",\"title\":\"Share devices by email from the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1084/sharing\\\"\u003eShare devices\u003c/a\u003e by sending emails directly from the admin console. The email will contain the invitation and instructions on how to accept the device share.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-11-client.mdx\",\"title\":\"Tailscale v1.64.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.64.0\",\"content\":\"$2a\",\"date\":\"2024-04-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-11-salesforce.mdx\",\"title\":\"Salesforce available as a preset app\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://www.salesforce.com\\\"\u003eSalesforce\u003c/a\u003e is available as a \u003ca href=\\\"/kb/1339/preset-apps\\\"\u003epreset app\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-09-invite-expiry.mdx\",\"title\":\"Unused external invites expire\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1271/invite-any-user\\\"\u003eExternal user invites\u003c/a\u003e that are unused for 30 days will expire. This includes external invites sent by \u003ca href=\\\"/kb/1271/invite-any-user#send-an-invite-email\\\"\u003eemail\u003c/a\u003e and \u003ca href=\\\"/kb/1271/invite-any-user#send-an-invite-link\\\"\u003elink\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-04-05-user-invites.mdx\",\"title\":\"Invite users by email from the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1271/invite-any-user\\\"\u003eInvite external users\u003c/a\u003e by sending emails directly from the admin console. The email will contain the invitation and instructions on how to join the tailnet.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-04-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-26-acl-preview-posture.mdx\",\"title\":\"ACL Preview\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1338/acl-edit\\\"\u003eACL Preview\u003c/a\u003e now shows posture conditions\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-03-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-26-client.mdx\",\"title\":\"Tailscale v1.62.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.62.1\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSend load balancing hint HTTP request header\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDo not allow \u003ccode\u003emsiexec\u003c/code\u003e to reboot the operating system\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIssue that could cause the Tailscale system extension to not be installed upon app launch, when deploying Tailscale using MDM and using a configuration profile to pre-approve the VPN tunnel (applies to \u003ca href=\\\"/kb/1065/macos-variants\\\"\u003estandalone\u003c/a\u003e variant only)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIPv6 routing\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eKubernetes operator\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eKubernetes operator\u003c/a\u003e proxies should not accept subnet routes\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-03-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-22-device-attr.mdx\",\"title\":\"Device posture attributes API\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eCall \u003ca href=\\\"/kb/1288/device-posture#posture-attributes-api\\\"\u003edevice posture attribute API\u003c/a\u003e endpoints using the \u003ca href=\\\"/kb/1215/oauth-clients#scopes\\\"\u003eOAuth access token\u003c/a\u003e scope ID \u003ccode\u003edevices\u003c/code\u003e and personal access tokens belonging to users with the \u003ca href=\\\"/kb/1138/user-roles#it-admin\\\"\u003eIT admin\u003c/a\u003e user role\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-03-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-22-ssh-ga.mdx\",\"title\":\"Tailscale SSH GA\",\"kind\":\"service\",\"link\":\"/blog/tailscale-ssh-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTailscale SSH GA (\u003ca href=\\\"/kb/1167/release-stages#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e to manage the authentication and authorization of SSH connections in your tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-03-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-18-invoicing.mdx\",\"title\":\"Download invoices\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1182/billing-information/#download-invoices\\\"\u003eDownload invoices\u003c/a\u003e for your Tailscale account in the \u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003e\u003cstrong\u003eBilling\u003c/strong\u003e\u003c/a\u003e page of the admin console (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-03-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-13-client.mdx\",\"title\":\"Tailscale v1.62.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.62.0\",\"content\":\"$2b\",\"date\":\"2024-03-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-07-gitlab.mdx\",\"title\":\"Secret scanning with GitLab\",\"kind\":\"service\",\"link\":\"/blog/gitlab/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSecret scanning integration with \u003ca href=\\\"https://gitlab.com/\\\"\u003eGitLab\u003c/a\u003e\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1301/secret-scanning\\\"\u003esecret scanning\u003c/a\u003e to help mitigate accidental disclosure and prevent fraudulent use of \u003ca href=\\\"/kb/1252/key-secret-management\\\"\u003eTailscale-generated keys\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-03-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-03-07-ssh.mdx\",\"title\":\"ACL groups and tests for Tailscale SSH\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1337/acl-syntax/#sshtests\\\"\u003e\u003ccode\u003esshTests\u003c/code\u003e\u003c/a\u003e ACL top-policy section lets you write assertions about your SSH access rules and functions similarly to ACL \u003ca href=\\\"/kb/1337/acl-syntax/#tests\\\"\u003e\u003ccode\u003etests\u003c/code\u003e\u003c/a\u003e, but for \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003euser:*@\u0026#x3C;domain\u003e\u003c/code\u003e \u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003eACL autogroup\u003c/a\u003e allows access for any user whose login is in the specified domain and is a direct member of the tailnet\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003elocalpart:*@\u0026#x3C;domain\u003e\u003c/code\u003e ACL autogroup allows Tailscale SSH access to a user on the host whose name matches the local-part of the user's Tailscale login\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-03-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-29-client.mdx\",\"title\":\"Tailscale v1.60.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.60.1\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eExposing port \u003ccode\u003e8080\u003c/code\u003e to other devices in your tailnet works as expected\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-29\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-23-user-invites.mdx\",\"title\":\"Updated Users page\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003e\u003cstrong\u003eUsers\u003c/strong\u003e\u003c/a\u003e page of the admin console updated to provide more context around \u003ca href=\\\"/kb/1271/invite-any-user\\\"\u003euser invitations\u003c/a\u003e, \u003ca href=\\\"/kb/1239/user-approval\\\"\u003euser approval\u003c/a\u003e, and your tailnet's \u003ca href=\\\"/kb/1013/sso-providers\\\"\u003eidentity provider\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-22-exit-nodes.mdx\",\"title\":\"Exit node visibility\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUsers can only see \u003ca href=\\\"/kb/1103/exit-nodes\\\"\u003eexit nodes\u003c/a\u003e they have permission to use, based on the \u003ca href=\\\"/kb/1337/acl-syntax#subnet-routers-and-exit-nodes\\\"\u003eACL\u003c/a\u003e settings for a tailnet. This includes visibility in the Tailscale client and the output for \u003ca href=\\\"/kb/1080/cli\\\"\u003eTailscale CLI\u003c/a\u003e commands such as \u003ca href=\\\"/kb/1080/cli#status\\\"\u003e\u003ccode\u003etailscale status\u003c/code\u003e\u003c/a\u003e and \u003ca href=\\\"/kb/1080/cli#exit-node\\\"\u003e\u003ccode\u003etailscale exit-node list\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-22-preset-apps.mdx\",\"title\":\"Preset Apps GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePreset Apps GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1339/preset-apps\\\"\u003ePreset Apps\u003c/a\u003e to configure common applications with only a few clicks or an ACL configuration. Routes and domains for Preset Apps are automatically updated and managed by Tailscale, based on each app’s source of truth. Routes for preset apps are automatically approved and pushed down to all selected \u003ca href=\\\"/kb/1281/app-connectors\\\"\u003eApp connectors\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eConfluence, GitHub, Google Workspace, Jira, Okta, and Stripe are now available as preset apps\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-21-pricing-v3.5.mdx\",\"title\":\"Updated pricing plans\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$2c\",\"date\":\"2024-02-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-15-client.mdx\",\"title\":\"Tailscale v1.60.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.60.0\",\"content\":\"$2d\",\"date\":\"2024-02-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-14-auto-updates.mdx\",\"title\":\"Auto-updates GA\",\"kind\":\"service\",\"link\":\"/blog/auto-update-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1067/update#auto-updates\\\"\u003eAuto-updates\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eEnable Tailscale client auto-updates in the \u003ca href=\\\"https://login.tailscale.com/admin/settings/device-management\\\"\u003e\u003cstrong\u003eDevice management\u003c/strong\u003e\u003c/a\u003e section of the admin console\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eInitiate Tailscale client updates to devices from the \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page of the admin console. For details, see \u003ca href=\\\"/kb/1067/update#auto-updates\\\"\u003eAuto-updates\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-12-app-connectors-wildcard.mdx\",\"title\":\"App connectors wildcard support change\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eNew Apps and \u003ca href=\\\"/kb/1281/app-connectors/\\\"\u003eapp connectors\u003c/a\u003e can no longer be selected via the \u003ccode\u003e*\u003c/code\u003e wildcard in a tailnet policy file or configuration flow. Instead, \u003ca href=\\\"/kb/1068/acl-tags\\\"\u003etag\u003c/a\u003e all app connectors and then use the tags as a selector. Existing \u003ccode\u003e*\u003c/code\u003e configurations will need to update to a tag-based selector upon the next tailnet policy file change. For details, see \u003ca href=\\\"/kb/1281/app-connectors/#considerations\\\"\u003eWildcard connectors no longer supported\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-12-mdm.mdx\",\"title\":\"System policies GA\",\"kind\":\"service\",\"link\":\"/blog/mdm-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eSystem policies GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1315/mdm-keys\\\"\u003esystem policies\u003c/a\u003e (also known as MDM policies) to control Tailscale client settings for your users, such as UI visibility, organization customization, auto-update functionality, and runtime configurations\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-02-05-gitguardian.mdx\",\"title\":\"Secret scanning with GitGuardian\",\"kind\":\"service\",\"link\":\"/blog/gitguardian/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSecret scanning integration with \u003ca href=\\\"https://www.gitguardian.com/\\\"\u003eGitGuardian\u003c/a\u003e\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1301/secret-scanning\\\"\u003esecret scanning\u003c/a\u003e to help mitigate accidental disclosure and prevent fraudulent use of \u003ca href=\\\"/kb/1252/key-secret-management\\\"\u003eTailscale-generated keys\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-02-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-01-29-posture-acl-test.mdx\",\"title\":\"Support Device Posture in ACL tests\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eDevice Posture is now supported in \u003ca href=\\\"/kb/1337/acl-syntax#tests\\\"\u003eACL Tests\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-01-29\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-01-23-client.mdx\",\"title\":\"Tailscale v1.58.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.58.2\",\"content\":\"\u003cp\u003e\u003cem\u003eNote:\u003c/em\u003e The 1.58.1 release needed to be re-done. Use 1.58.2 instead.\u003c/p\u003e\\n\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1281/app-connectors\\\"\u003eApp connectors\u003c/a\u003e have improved scheduling and merging of route changes under some conditions\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCrash when performing UPnP portmapping on older routers with no supported portmapping services\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eOpening the \u003cstrong\u003eAbout\u003c/strong\u003e window no longer displays a user interface when there is no newer version\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-01-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-01-18-client.mdx\",\"title\":\"Tailscale v1.58.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.58.0\",\"content\":\"$2e\",\"date\":\"2024-01-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-01-12-zoho.mdx\",\"title\":\"Support for Zoho\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eZoho is now supported as a \u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003ecustom OIDC provider\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-01-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-01-10-admin-console-security-updates.mdx\",\"title\":\"Security update indicators and filter in the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAvailable update icons on the \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page of the admin console now differentiate between regular and security updates\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe Version filter on the \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page can now show nodes with pending security updates\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-01-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-01-08-client.mdx\",\"title\":\"Tailscale v1.44.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.44.3\",\"content\":\"\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAdded a security fix to address privilege escalation with \u003ca href=\\\"/kb/1242/tailscale-serve\\\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e and \u003ca href=\\\"/kb/1311/tailscale-funnel\\\"\u003e\u003ccode\u003etailscale funnel\u003c/code\u003e\u003c/a\u003e that allowed low-privilege users to serve files they did not have access to (\u003ca href=\\\"/security-bulletins/#ts-2024-001\\\"\u003eTS-2024-001\u003c/a\u003e). This release is intended for Windows 7 and 8 users. Those with later versions of Windows should run the latest stable version of Tailscale, which is 1.56.1. This issue was resolved in Tailscale 1.52.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-01-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2024/2024-01-02-github-idp.mdx\",\"title\":\"Invite any user to a GitHub tailnet\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1271/invite-any-user\\\"\u003eInvite any user\u003c/a\u003e to your tailnet when using a GitHub organization or GitHub personal account as the \u003ca href=\\\"/kb/1284/sso-github\\\"\u003eidentity provider\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2024-01-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-20-certificate-status.mdx\",\"title\":\"View machine certificate status\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1153/enabling-https/#view-certificate-status\\\"\u003eView the TLS certificate status\u003c/a\u003e of a machine in your tailnet by using the \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-20-https-ga.mdx\",\"title\":\"HTTPS certificates GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eHTTPS certificates GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1153/enabling-https\\\"\u003eHTTPS certificates\u003c/a\u003e to provision TLS certificates for devices in your tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-15-client.mdx\",\"title\":\"Tailscale v1.56.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.56.1\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1325/device-web-interface\\\"\u003eWeb interface\u003c/a\u003e redirects to the correct self-IP known by the source peer\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1281/app-connectors\\\"\u003eApp connector\u003c/a\u003e domain list displays as expected\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1315/mdm-keys#set-a-custom-control-server-url\\\"\u003eCustom login server\u003c/a\u003e uses the provided URL instead of \u003ccode\u003elogin.tailscale.com\u003c/code\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1315/mdm-keys#set-a-custom-control-server-url\\\"\u003eCustom login server\u003c/a\u003e uses the provided URL instead of \u003ccode\u003elogin.tailscale.com\u003c/code\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003etvOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1315/mdm-keys#set-a-custom-control-server-url\\\"\u003eCustom login server\u003c/a\u003e uses the provided URL instead of \u003ccode\u003elogin.tailscale.com\u003c/code\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-14-acl-grants.mdx\",\"title\":\"ACL Grants\",\"kind\":\"service\",\"link\":\"/blog/acl-grants/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1324/acl-grants\\\"\u003eACL Grants\u003c/a\u003e in your \u003ca href=\\\"/kb/1155/terminology-and-concepts/#tailnet-policy-file\\\"\u003etailnet policy file\u003c/a\u003e to provide capabilities at either the IP layer or the application layer (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-14-device-posture.mdx\",\"title\":\"Device posture\",\"kind\":\"service\",\"link\":\"/blog/device-posture/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1288/device-posture\\\"\u003eDevice posture management\u003c/a\u003e to collect device properties and set device connectivity rules within your Tailscale network (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Enable posture identity collection\\\" and \\\"Disable posture identity collection\\\" are logged as \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003econfiguration audit logging events\u003c/a\u003e when \u003ca href=\\\"/kb/1326/device-identity-collection\\\"\u003edevice posture identifiers\u003c/a\u003e are enabled or disabled, respectively\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Create posture integration\\\" is logged when a new \u003ca href=\\\"/kb/1289/crowdstrike-zta\\\"\u003edevice posture integration\u003c/a\u003e is added\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Update posture integration\\\" is logged when a device posture integration is updated\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Remove posture integration\\\" is logged when a device posture integration is removed\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-13-client.mdx\",\"title\":\"Tailscale v1.56.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.56.0\",\"content\":\"$2f\",\"date\":\"2023-12-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-12-app-connectors.mdx\",\"title\":\"App connectors\",\"kind\":\"service\",\"link\":\"/blog/saas/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1281/app-connectors\\\"\u003eApp connectors\u003c/a\u003e to connect software as a service (SaaS) applications to your Tailscale network (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-12-regional-routing.mdx\",\"title\":\"Regional routing GA\",\"kind\":\"service\",\"link\":\"/blog/regional-routing\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1115/high-availability/#regional-routing\\\"\u003eRegional routing\u003c/a\u003e to route your traffic across distributed \u003ca href=\\\"/kb/1115/high-availability\\\"\u003ehigh availability infrastructure\u003c/a\u003e based on region (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-12-05-acl-tests-proto.mdx\",\"title\":\"Specify protocol in ACL tests\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ccode\u003eproto\u003c/code\u003e field is now supported in \u003ca href=\\\"/kb/1337/acl-syntax/#tests\\\"\u003eACL tests\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-12-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-30-client.mdx\",\"title\":\"Tailscale v1.54.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.54.1\",\"content\":\"\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eChanging a pre-existing system policy value to nil no longer causes stability issues\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eChanging a pre-existing system policy value to nil no longer causes stability issues\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eWidget tracks the connection state more closely\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003etvOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eChanging a pre-existing system policy value to nil no longer causes stability issues\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-30-ip-pool.mdx\",\"title\":\"Configure CGNAT IP range subset\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1304/ip-pool\\\"\u003eIP pool\u003c/a\u003e to enable configuring a specific CGNAT IP range subset in your \u003ca href=\\\"/kb/1155/terminology-and-concepts/#tailnet-policy-file\\\"\u003etailnet policy file\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#alpha\\\"\u003ealpha\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-28-cgnat.mdx\",\"title\":\"Access to the full CGNAT address space\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eEach individual \u003ca href=\\\"/kb/1136/tailnet\\\"\u003etailnet\u003c/a\u003e can now use the full \u003ca href=\\\"/kb/1015/100.x-addresses\\\"\u003eCGNAT\u003c/a\u003e address range of 100.64.0.0/10\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-28\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-28-ipv6.mdx\",\"title\":\"Tailscale IPv6 address prefix change\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1033/ip-and-dns-addresses/#tailscale-ipv6-local-address-prefix\\\"\u003eTailscale IPv6 local addresses\u003c/a\u003e are assigned from the \u003ca href=\\\"https://en.wikipedia.org/wiki/Unique_local_address\\\"\u003eunique local address\u003c/a\u003e prefix of \u003ccode\u003efd7a:115c:a1e0::/48\u003c/code\u003e. Previously IPv6 addresses were assigned from \u003ccode\u003efd7a:115c:a1e0:ab12::/64\u003c/code\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-28\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-17-datadog.mdx\",\"title\":\"Log streaming with Datadog GA\",\"kind\":\"service\",\"link\":\"/blog/datadog\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eLog streaming integration with \u003ca href=\\\"https://www.datadoghq.com/\\\"\u003eDatadog\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse Datadog for \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003eLog streaming\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-16-checkperiod-always.mdx\",\"title\":\"Require check mode on every Tailscale SSH connection\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eRequire \u003ca href=\\\"/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode\\\"\u003echeck mode\u003c/a\u003e on every \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e connection by specifying \u003ccode\u003e\\\"checkPeriod\\\": \\\"always\\\"\u003c/code\u003e in your \u003ca href=\\\"/kb/1155/terminology-and-concepts/#tailnet-policy-file\\\"\u003etailnet policy file\u003c/a\u003e from the \u003ca href=\\\"https://login.tailscale.com/admin/acls/file\\\"\u003e\u003cstrong\u003eAccess controls\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-15-client.mdx\",\"title\":\"Tailscale v1.54.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.54.0\",\"content\":\"$30\",\"date\":\"2023-11-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-15-secret-scanning.mdx\",\"title\":\"Secret scanning and TruffleHog\",\"kind\":\"service\",\"link\":\"/blog/trufflehog/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eScanning for exposed Tailscale secrets\\n\u003cul\u003e\\n\u003cli\u003e\u003ca href=\\\"/kb/1301/secret-scanning\\\"\u003eScanning for exposed Tailscale secrets\u003c/a\u003e helps mitigate accidental\\ndisclosure and prevent fraudulent use of \u003ca href=\\\"/kb/1252/key-secret-management\\\"\u003eTailscale-generated keys\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSecret scanning integration with TruffleHog\\n\u003cul\u003e\\n\u003cli\u003e\u003ca href=\\\"https://trufflesecurity.com/trufflehog/\\\"\u003eTruffleHog\u003c/a\u003e scans for exposed Tailscale keys\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-09-acl-revert.mdx\",\"title\":\"Revert your tailnet policy file\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1203/audit-logging/#reverting-acls-from-audit-logs\\\"\u003eRevert\u003c/a\u003e your \u003ca href=\\\"/kb/1155/terminology-and-concepts/#tailnet-policy-file\\\"\u003etailnet policy file\u003c/a\u003e from the \u003ca href=\\\"https://login.tailscale.com/admin/logs\\\"\u003e\u003cstrong\u003eConfiguration logs\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-03-log-streaming.mdx\",\"title\":\"Log streaming updates\",\"kind\":\"service\",\"link\":\"/blog/log-streaming-endpoints-cribl-audit\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eLog streaming private endpoints GA\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1255/log-streaming/#private-endpoints\\\"\u003eprivate endpoints\u003c/a\u003e in your tailnet for \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003eLog streaming\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1255/log-streaming\\\"\u003eConfiguration audit log streaming\u003c/a\u003e is now available to the \u003ca href=\\\"/pricing\\\"\u003eFree plan\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eLog streaming integration with \u003ca href=\\\"https://cribl.io/\\\"\u003eCribl\u003c/a\u003e GA\\n\u003cul\u003e\\n\u003cli\u003eUse Cribl for Log streaming (generally available)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-02-client.mdx\",\"title\":\"Tailscale v1.52.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.52.1\",\"content\":\"\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eResolve an incompatibility with other software that uses wintun\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eNAS platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eClean up downloaded upgrades after applying them\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-11-02.mdx\",\"title\":\"Delete non-provisioned users\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1145/remove-team-members\\\"\u003eDelete\u003c/a\u003e non-provisioned users on a tailnet with \u003ca href=\\\"/kb/1290/user-group-provisioning\\\"\u003euser \u0026#x26; group provisioning\u003c/a\u003e enabled\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-11-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-10-31-auto-updates.mdx\",\"title\":\"Automatic client updates\",\"kind\":\"service\",\"link\":\"/blog/auto-update-beta/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1067/update/#auto-updates\\\"\u003eauto-updates\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e) to keep your Tailscale client on the latest version\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-10-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-10-31-k8s-operator.mdx\",\"title\":\"Kubernetes operator\",\"kind\":\"service\",\"link\":\"/blog/kubernetes-operator/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1236/kubernetes-operator/\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e is now in \u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e\\n\u003cul\u003e\\n\u003cli\u003eUse the Kubernetes operator to expose services in your Kubernetes cluster to your tailnet, connect to your tailnet from a Kubernetes cluster, and securely connect to the Kubernetes control plane\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1236/kubernetes-operator/#helm\\\"\u003eUse a Helm chart\u003c/a\u003e to deploy the Kubernetes operator\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-10-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-10-31-vscode.mdx\",\"title\":\"Tailscale extension for Visual Studio Code GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTailscale extension for Visual Studio Code GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse the \u003ca href=\\\"/kb/1265/vscode-extension\\\"\u003eTailscale extension for Visual Studio Code\u003c/a\u003e to interact with resources in your tailnet from within the VS Code IDE\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-10-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-10-30-client.mdx\",\"title\":\"Tailscale v1.52.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.52.0\",\"content\":\"$31\",\"date\":\"2023-10-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-10-30.mdx\",\"title\":\"OAuth clients GA and Search domains GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eOAuth clients GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1215/oauth-clients\\\"\u003eOAuth clients\u003c/a\u003e to provide delegated fine-grained access to the \u003ca href=\\\"/kb/1101/api\\\"\u003eTailscale API\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eSearch domains GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1054/dns/#search-domains\\\"\u003eSearch domains\u003c/a\u003e to set custom DNS domain suffixes that are automatically appended to any domain name that is not a fully qualified domain name (FQDN)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-10-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-10-18-add-devices.mdx\",\"title\":\"Add devices from the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse the \u003cstrong\u003eAdd device\u003c/strong\u003e button in the \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page of the admin console to download the Tailscale client. See \u003ca href=\\\"/kb/1316/device-add\\\"\u003eAdd a device\u003c/a\u003e for details.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-10-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-10-02-client.mdx\",\"title\":\"Tailscale v1.50.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.50.1\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli\u003eFixed:\u003ccode\u003etailscale serve\u003c/code\u003e configuration doesn't persist in container (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/9558\\\"\u003e#9558\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ccode\u003etailnet lock\u003c/code\u003e fails to sign node in container (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/9539\\\"\u003e#9539\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFunnel doesn't work for \u003ccode\u003etsnet\u003c/code\u003e apps (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/9566\\\"\u003e#9566\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eUPnP potentially crashes in specific circumstances\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-10-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-09-29-gchat.mdx\",\"title\":\"Google Chat supported as a webhook destination\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1213/webhooks\\\"\u003eWebhook\u003c/a\u003e events are available in a format for Google Chat\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-09-29\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-09-25-client.mdx\",\"title\":\"Tailscale v1.50.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.50.0\",\"content\":\"$32\",\"date\":\"2023-09-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-09-25-oauth.mdx\",\"title\":\"OAuth access tokens\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eRequests for \u003ca href=\\\"/kb/1215/oauth-clients\\\"\u003eOAuth access tokens\u003c/a\u003e may now specify a custom set of tags instead of always inheriting the tags from the OAuth client\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eRequesting \u003ca href=\\\"/kb/1215/oauth-clients\\\"\u003eOAuth access tokens\u003c/a\u003e with invalid scopes will now fail rather than returning a token with default scopes\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-09-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-09-22-k8s-operator.mdx\",\"title\":\"Kubernetes operator\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse the \u003ca href=\\\"/kb/1236/kubernetes-operator\\\"\u003eTailscale Kubernetes operator\u003c/a\u003e to expose a Kubernetes cluster to your tailnet and securely connect to the Kubernetes control plane (\u003ca href=\\\"/kb/1167/release-stages/#alpha\\\"\u003ealpha\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-09-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-09-18.mdx\",\"title\":\"Apple TV GA\",\"kind\":\"service\",\"link\":\"/blog/apple-tv\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eApple TV GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse an \u003ca href=\\\"/kb/1280/appletv\\\"\u003eApple TV\u003c/a\u003e to access your media server content remotely, route Apple TV traffic through an \u003ca href=\\\"/kb/1103/exit-nodes\\\"\u003eexit node\u003c/a\u003e, or advertise Apple TV as an exit node\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-09-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-09-11-client.mdx\",\"title\":\"Tailscale v1.48.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.48.2\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eStability improvements for \u003ca href=\\\"/kb/1258/mullvad-exit-nodes\\\"\u003eMullvad Exit Nodes\u003c/a\u003e, particularly for users on IPv4-only networks\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-09-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-09-07-mullvad.mdx\",\"title\":\"Mullvad Exit Nodes\",\"kind\":\"service\",\"link\":\"/blog/mullvad-integration/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1258/mullvad-exit-nodes\\\"\u003eMullvad Exit Nodes\u003c/a\u003e to have \u003ca href=\\\"https://mullvad.net/en/why-mullvad-vpn\\\"\u003eMullvad VPN\u003c/a\u003e endpoints as \u003ca href=\\\"/kb/1103/exit-nodes/\\\"\u003eexit nodes\u003c/a\u003e for your Tailscale network (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Enable Mullvad VPN for tailnet\\\" and \\\"Disable Mullvad VPN for tailnet\\\" are logged as \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003econfiguration audit logging events\u003c/a\u003e when Mullvad Exit Nodes are \u003ca href=\\\"/kb/1258/mullvad-exit-nodes/#enable-mullvad-exit-nodes\\\"\u003eenabled\u003c/a\u003e or \u003ca href=\\\"/kb/1258/mullvad-exit-nodes/#disable-mullvad-on-a-device\\\"\u003edisabled\u003c/a\u003e, respectively\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-09-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-31.mdx\",\"title\":\"User status changes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003cstrong\u003eActive\u003c/strong\u003e status filter option in the \u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003e\u003cstrong\u003eUsers\u003c/strong\u003e\u003c/a\u003e page of the admin console is removed. Use the \u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003e\u003cstrong\u003eBilling\u003c/strong\u003e\u003c/a\u003e page to track your \u003ca href=\\\"/kb/1251/pricing-faq/#how-are-monthly-active-users-defined\\\"\u003eactive users\u003c/a\u003e instead.\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003cstrong\u003eInactive\u003c/strong\u003e badge and status filter option in the \u003cstrong\u003eUsers\u003c/strong\u003e page of the admin console is renamed \u003cstrong\u003eIdle\u003c/strong\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-21-client.mdx\",\"title\":\"Tailscale v1.48.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.48.1\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix a security vulnerability in UPnP port mapping (\u003ca href=\\\"/security-bulletins/#ts-2023-006\\\"\u003eTS-2023-006\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli\u003eFixed: Resolve nftables interaction between Tailscale and UFW which\\nresulted in blocking subnet routed traffic\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDetermine correct CPU architecture in \u003ccode\u003etailscale update\u003c/code\u003e (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/8927\\\"\u003e#8927\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-18-azure-ad-scim.mdx\",\"title\":\"Sync Microsoft Entra ID groups to use in your Tailscale ACLs\",\"kind\":\"service\",\"link\":\"/blog/sync-azuread-groups\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1249/sso-entra-id-scim\\\"\u003eUser \u0026#x26; group provisioning for Microsoft Entra ID\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eSync Microsoft Entra ID groups to use in your \u003ca href=\\\"/kb/1337/acl-syntax/#provisioned-groups\\\"\u003eTailscale ACLs\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-16-client.mdx\",\"title\":\"Tailscale v1.48.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.48.0\",\"content\":\"$33\",\"date\":\"2023-08-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-16-funnel.mdx\",\"title\":\"Tailscale Funnel interactive web UI\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe Tailscale CLI now guides users through enabling \u003ca href=\\\"/kb/1242/tailscale-serve\\\"\u003e\u003ccode\u003eserve\u003c/code\u003e\u003c/a\u003e and \u003ca href=\\\"/kb/1080/cli/#funnel\\\"\u003e\u003ccode\u003efunnel\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-16-panther.mdx\",\"title\":\"Log streaming with Panther Labs GA\",\"kind\":\"service\",\"link\":\"/blog/panther-generally-available/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eLog streaming integration with \u003ca href=\\\"https://panther.com/\\\"\u003ePanther Labs\u003c/a\u003e GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse Panther Labs for \u003ca href=\\\"/kb/1255/log-streaming/\\\"\u003eLog streaming\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-16-tailnet-lock.mdx\",\"title\":\"Tailnet lock beta\",\"kind\":\"service\",\"link\":\"/blog/tailnet-lock-beta/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003eTailnet lock\u003c/a\u003e is now in \u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e\\n\u003cul\u003e\\n\u003cli\u003eUse tailnet lock to require your nodes to verify node keys distributed by the\\n\u003ca href=\\\"/kb/1155/terminology-and-concepts/#coordination-server\\\"\u003ecoordination server\u003c/a\u003e before trusting them\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-15.mdx\",\"title\":\"GitLab CI/CD support for GitLab Runner\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse the \u003ca href=\\\"/kb/1287/tailscale-gitlab-runner\\\"\u003eTailscale GitLab CI/CD configuration\u003c/a\u003e to access devices in your tailnet directly from your GitLab Runner\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-11-vscode-machine-explorer.mdx\",\"title\":\"Machine explorer in the Tailscale VS Code extension\",\"kind\":\"service\",\"link\":\"/blog/machine-explorer-vscode-extension/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eView and interact with machines on your tailnet within the \u003ca href=\\\"/kb/1265/vscode-extension\\\"\u003eTailscale extension for Visual Studio Code\u003c/a\u003e. Powered by \u003ca href=\\\"/tailscale-ssh/\\\"\u003eTailscale SSH\u003c/a\u003e, you can remotely manage files, open terminal sessions, or attach remote VS Code sessions.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-08-09-logstreaming.mdx\",\"title\":\"Log streaming private endpoints\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1255/log-streaming/#private-endpoints\\\"\u003eprivate endpoints\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e) in your tailnet for \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003elog streaming\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-08-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-31.mdx\",\"title\":\"Additional autogroup value\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003eautogroup:tagged\u003c/a\u003e to refer to all \u003ca href=\\\"/kb/1068/acl-tags\\\"\u003etagged\u003c/a\u003e nodes in a tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-26-client.mdx\",\"title\":\"Tailscale v1.46.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.46.1\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIssue with \u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003etailnet lock\u003c/a\u003e signature verification\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCrash issue on ARM64\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDNS and subnet routes issue\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-25.mdx\",\"title\":\"Autogroup now supports autogroup:member syntax\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSyntax for \u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003eautogroups\u003c/a\u003e now supports \u003ccode\u003eautogroup:member\u003c/code\u003e in addition to \u003ccode\u003eautogroup:members\u003c/code\u003e when referring to all users in a tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-24.mdx\",\"title\":\"OAuth scopes for logs API endpoints\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ccode\u003elogs:read\u003c/code\u003e OAuth scope can be used to grant API access to \u003ca href=\\\"/kb/1203/audit-logging\\\"\u003econfiguration audit logs\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ccode\u003enetwork-logs:read\u003c/code\u003e OAuth scope can be used to grant API access to \u003ca href=\\\"/kb/1219/network-flow-logs\\\"\u003enetwork flow logs\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-20-acl-validate-warning.mdx\",\"title\":\"SCIM ACL validation warnings in API\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe tailnet policy file validation endpoint will now return warnings about SCIM synced groups in addition to errors in the response object. These will be the same warnings you would have seen visually in the admin console if you had tried to save that policy file. See the \u003ca href=\\\"/kb/1180/sso-okta-scim/#updating-okta-group-names\\\"\u003euser and group provisioning documentation\u003c/a\u003e for more detail.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-19-client.mdx\",\"title\":\"Tailscale v1.46.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.46.0\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eInitial support for nftables-based configuration. This option is currently behind a temporary flag for testing and feedback. See \u003ca href=\\\"https://github.com/tailscale/tailscale/issues/391\\\"\u003eissue #391\u003c/a\u003e for details.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003eTailnet lock\u003c/a\u003e is now supported\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eTailnet lock is now supported\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eTailnet lock is now supported\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eOnboarding flow is added for easier initial setup of the app\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePing devices on your tailnet from the app\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe app \u003cstrong\u003eMachines\u003c/strong\u003e page is improved\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe app \u003cstrong\u003eExit Node\u003c/strong\u003e section is improved\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe app \u003cstrong\u003eSettings\u003c/strong\u003e page is improved\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-19.mdx\",\"title\":\"iOS app redesign\",\"kind\":\"service\",\"link\":\"/blog/reimagining-tailscale-for-ios\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe Tailscale iOS client is updated with significant design and engineering improvements\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-18-client.mdx\",\"title\":\"Tailscale v1.44.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.44.2\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eHandling of custom HTTP ports in \u003ca href=\\\"/kb/1242/tailscale-serve\\\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eRestore support for Microsoft Windows 7 and Microsoft Windows 8.x.\u003cbr/\u003eTailscale v1.44.2 will be the last release to support the following operating systems: Microsoft Windows 7, Microsoft Windows 8, Microsoft Windows Server 2008, and Microsoft Windows Server 2012.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-11.mdx\",\"title\":\"Log streaming integration with Panther Labs\",\"kind\":\"service\",\"link\":\"/blog/log-streaming-integration-panther-labs/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse Panther Labs (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e) for \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003eLog streaming\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-10.mdx\",\"title\":\"Tailscale v1.44.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.44.1\",\"content\":\"\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eVarious bugs and improvements\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-07-05-terms.mdx\",\"title\":\"Terms of service and privacy policy\",\"kind\":\"service\",\"link\":\"/blog/subscribe-terms\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUpdated \u003ca href=\\\"/terms\\\"\u003eTerms of Service\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUpdated \u003ca href=\\\"/privacy-policy\\\"\u003ePrivacy Policy\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-07-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-29-github-action.mdx\",\"title\":\"Tailscale GitHub Action changes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ca href=\\\"https://github.com/tailscale/github-action\\\"\u003eTailscale GitHub Action\u003c/a\u003e now supports use of an \u003ca href=\\\"/kb/1215/oauth-clients\\\"\u003eOAuth client\u003c/a\u003e for its node authorization. The action also supports running on ARM64 nodes.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-29\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-29-logging.mdx\",\"title\":\"Network flow logs GA and Log streaming GA\",\"kind\":\"service\",\"link\":\"/blog/network-flow-logs-is-generally-available/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eNetwork flow logs GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1219/network-flow-logs\\\"\u003eNetwork flow logs\u003c/a\u003e to understand which nodes connected to which other nodes, and when, in your tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eLog streaming GA (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003eLog streaming\u003c/a\u003e to stream \u003ca href=\\\"/kb/1203/audit-logging\\\"\u003eConfiguration audit logs\u003c/a\u003e and Network flow logs to a security information and event management (\u003ca href=\\\"/learn/security-information-and-event-management\\\"\u003eSIEM\u003c/a\u003e) system\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-29\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-26.mdx\",\"title\":\"Nairobi DERP region\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eNairobi added as a \u003ca href=\\\"/blog/how-tailscale-works/#encrypted-tcp-relays-derp\\\"\u003eDERP region\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-23.mdx\",\"title\":\"Add a description to new keys and OAuth clients\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003cstrong\u003eDescription\u003c/strong\u003e field is added to the \u003cstrong\u003eGenerate auth key\u003c/strong\u003e dialog in the \u003ca href=\\\"https://login.tailscale.com/admin/settings/keys\\\"\u003e\u003cstrong\u003eKeys\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003cstrong\u003eDescription\u003c/strong\u003e field is added to the \u003cstrong\u003eGenerate access token\u003c/strong\u003e dialog in the \u003cstrong\u003eKeys\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003cstrong\u003eDescription\u003c/strong\u003e field is added to the \u003cstrong\u003eGenerate OAuth client\u003c/strong\u003e dialog in the \u003ca href=\\\"https://login.tailscale.com/admin/settings/oauth\\\"\u003e\u003cstrong\u003eOAuth clients\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-21-client.mdx\",\"title\":\"Tailscale v1.44.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.44.0\",\"content\":\"$34\",\"date\":\"2023-06-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-15.mdx\",\"title\":\"Support for QNAP\",\"kind\":\"service\",\"link\":\"/blog/qnap-app-center\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe Tailscale app for \u003ca href=\\\"/kb/1273/qnap\\\"\u003eQNAP\u003c/a\u003e is now available in the QNAP App Center\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-14.mdx\",\"title\":\"Support for IPv6 in tailnet policy file\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIPv6 addresses can now be directly specified in \u003ca href=\\\"/kb/1337/acl-syntax\\\"\u003eACL\u003c/a\u003e rules and tests.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-13.mdx\",\"title\":\"Support for Codeberg and Gitea\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eCodeberg and Gitea supported as \u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003ecustom OIDC providers\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-09-acl-dialog.mdx\",\"title\":\"Edit policy groups dialog in admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1337/acl-syntax/#edit-a-users-group-membership-from-the-users-page\\\"\u003eEdit group membership\u003c/a\u003e\\nin the \u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003e\u003cstrong\u003eUsers\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-09-custom-oidc.mdx\",\"title\":\"Custom OIDC setup option for user auth page prompt\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eSetup for \u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003ecustom OIDC providers\u003c/a\u003e provides the option for specifying a prompt\\n(\u003ccode\u003enone\u003c/code\u003e, \u003ccode\u003econsent\u003c/code\u003e, \u003ccode\u003elogin\u003c/code\u003e, \u003ccode\u003eselect_account\u003c/code\u003e) for the user authentication page. \u003cem\u003eIf your\\ntailnet was already using a custom OIDC provider, we updated your setup automatically to use\\n\u003ccode\u003econsent\u003c/code\u003e, which prior to today was the only supported value.\u003c/em\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-09-ping.mdx\",\"title\":\"Support for Ping Identity\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePing Identity is now available as a \u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003ecustom OIDC provider\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-06-06-tailnet-lock.mdx\",\"title\":\"Tailnet lock login change for expired nodes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli\u003eChanged: When logging in to a node that has an expired key in a tailnet that has enabled\\n\u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003eTailnet lock\u003c/a\u003e, an error message is returned, directing you to\\n\u003ca href=\\\"/kb/1272/reauth-under-tailnet-lock\\\"\u003ereauthenticate\u003c/a\u003e instead of logging in, or to delete the\\nmachine from within the admin console before logging in again\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-06-06\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-31-invites.mdx\",\"title\":\"Invite any user to a tailnet\",\"kind\":\"service\",\"link\":\"/blog/invite-any-user\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1271/invite-any-user\\\"\u003eInvite any user\u003c/a\u003e to your tailnet with a URL invitation (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"User joined external tailnet\\\" is logged as a \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003econfiguration audit logging event\u003c/a\u003e when a user in your tailnet joins \u003ca href=\\\"/kb/1271/invite-any-user\\\"\u003eanother tailnet\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-31-leave-tailnet.mdx\",\"title\":\"Leave an external tailnet\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003cstrong\u003eLeave tailnet\u003c/strong\u003e option has been added to the Tailscale login page (\u003ca href=\\\"https://login.tailscale.com\\\"\u003ehttps://login.tailscale.com\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003cstrong\u003eLeave tailnet\u003c/strong\u003e menu option has been added to the \u003ca href=\\\"https://login.tailscale.com/admin/users/\\\"\u003e\u003cstrong\u003eUsers\u003c/strong\u003e\u003c/a\u003e page of the admin console for the selected user\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"User left external tailnet\\\" is logged as a \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003econfiguration audit logging event\u003c/a\u003e when a user in your tailnet leaves \u003ca href=\\\"/kb/1271/invite-any-user/\\\"\u003eanother tailnet\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-31-passkeys.mdx\",\"title\":\"Support for passkeys\",\"kind\":\"service\",\"link\":\"/blog/passkeys\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse a \u003ca href=\\\"/kb/1269/passkeys\\\"\u003epasskey\u003c/a\u003e to authenticate to a tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003cstrong\u003eSign in with passkey\u003c/strong\u003e option is added to the Tailscale login page (https://login.tailscale.com)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-31-vscode.mdx\",\"title\":\"Tailscale extension for Visual Studio Code\",\"kind\":\"service\",\"link\":\"/blog/tailscale-vscode\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse the \u003ca href=\\\"/kb/1265/vscode-extension\\\"\u003eTailscale extension for Visual Studio Code\u003c/a\u003e to interact with resources in your tailnet from within the VS Code IDE (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-25-tailnet-lock.mdx\",\"title\":\"Tailnet lock UI changes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eManage \u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003etailnet lock\u003c/a\u003e from the \u003ca href=\\\"https://login.tailscale.com/admin/settings/device-management\\\"\u003e\u003cstrong\u003eDevice management\u003c/strong\u003e\u003c/a\u003e page of the admin console, when enabled\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eImproved UI for tailnet lock settings in the \u003ca href=\\\"https://login.tailscale.com/admin/machines/\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-24-client.mdx\",\"title\":\"Tailscale v1.42.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.42.0\",\"content\":\"$35\",\"date\":\"2023-05-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-22-tag.mdx\",\"title\":\"ACL tags are lowercased\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1068/acl-tags\\\"\u003eACL tags\u003c/a\u003e for auth keys created via API are lowercased\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-22.mdx\",\"title\":\"Custom OIDC GA\",\"kind\":\"service\",\"link\":\"/blog/custom-oidc-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003eCustom OIDC providers\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse a custom OIDC provider for authentication to your tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-16.mdx\",\"title\":\"Discord and Mattermost supported as webhook destinations\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1213/webhooks\\\"\u003eWebhook\u003c/a\u003e events are available in formats for Discord and Mattermost\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-11.mdx\",\"title\":\"SSH session recording\",\"kind\":\"service\",\"link\":\"/blog/session-recording-beta\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1246/tailscale-ssh-session-recording\\\"\u003eTailscale SSH session recording\u003c/a\u003e to stream Tailscale SSH session logs to a designated node in your tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-10.mdx\",\"title\":\"Tailscale v1.40.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.40.1\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e is now supported for LDAP users\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eSupport for Tailscale SSH session recording to a local file is restored\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDebian and RPM packages for MIPS architecture generate as expected\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eNotification icons are updated\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eThe 32-bit \u003ca href=\\\"/kb/1022/install-windows\\\"\u003eWindows installer\u003c/a\u003e for the Tailscale client works as expected\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1080/cli/#cert\\\"\u003e\u003ccode\u003etailscale cert\u003c/code\u003e\u003c/a\u003e command no longer causes timeout failures\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eKubernetes\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eThe Tailscale version displays in the startup logs\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-05-authelia.mdx\",\"title\":\"Support for Authelia\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAuthelia is now available as a \u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003ecustom OIDC provider\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-05-04-apple-idp.mdx\",\"title\":\"Sign in with Apple\",\"kind\":\"service\",\"link\":\"/blog/sign-in-with-apple\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eApple is now available as a \u003ca href=\\\"/kb/1013/sso-providers\\\"\u003esupported SSO identity provider\u003c/a\u003e, for\\n\u003ca href=\\\"/pricing\\\"\u003eall plans\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-05-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-28.mdx\",\"title\":\"Search Domains\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1054/dns/#search-domains\\\"\u003eSearch Domains\u003c/a\u003e to configure DNS for accessing network resources without having to specify the full domain path (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-28\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-27-log-events.mdx\",\"title\":\"Audit log events for Log streaming\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Create logstream endpoint for tailnet\\\", \\\"Update logstream endpoint for tailnet\\\", and \\\"Delete logstream endpoint for tailnet\\\" are logged as \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003econfiguration audit logging events\u003c/a\u003e for \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003eLog streaming\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-27-streaming.mdx\",\"title\":\"Log streaming\",\"kind\":\"service\",\"link\":\"/blog/network-flow-logs\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1255/log-streaming\\\"\u003eLog streaming\u003c/a\u003e to stream \u003ca href=\\\"/kb/1203/audit-logging\\\"\u003econfiguration audit logs\u003c/a\u003e\\nand \u003ca href=\\\"/kb/1219/network-flow-logs\\\"\u003enetwork flow logs\u003c/a\u003e to a security information and event\\nmanagement (\u003ca href=\\\"/learn/security-information-and-event-management/\\\"\u003eSIEM\u003c/a\u003e) system (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-26-client.mdx\",\"title\":\"Tailscale v1.40.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.40.0\",\"content\":\"$36\",\"date\":\"2023-04-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-24-version.mdx\",\"title\":\"Machines page updates\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page of the\\nadmin console has been updated to use \u003cstrong\u003eVersion\u003c/strong\u003e as a column heading instead of\\n\u003cstrong\u003eOS\u003c/strong\u003e, and to show the Tailscale \u003ca href=\\\"/kb/1168/versions\\\"\u003eclient version\u003c/a\u003e prior to the operating system name\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-21-audit-log.mdx\",\"title\":\"Audit log events for approved node routes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Update auto approved routes for node\\\" is logged as a \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003econfiguration audit logging event\u003c/a\u003e for \u003ca href=\\\"/kb/1019/subnets\\\"\u003eroutes\u003c/a\u003e advertised by the node that are updated using \u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003eautogroups\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\\\"Update approved routes for node\\\" replaces \\\"Update advertised routes for node\\\" in Configuration audit logging events\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-21-webhook.mdx\",\"title\":\"Webhook event when a node is deleted\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003enodeDeleted\u003c/code\u003e \u003ca href=\\\"/kb/1213/webhooks\\\"\u003ewebhook\u003c/a\u003e event is now generated when a node is removed from the tailnet, including automatic removal of \u003ca href=\\\"/kb/1111/ephemeral-nodes\\\"\u003eephemeral nodes\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-20.mdx\",\"title\":\"GitOps for Tailscale ACLs with GitLab CI\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://gitlab.com/tailscale-dev/gitops-acl-ci\\\"\u003eSync Tailscale ACLs\u003c/a\u003e GitLab CI Template to \u003ca href=\\\"/kb/1254/gitops-acls-gitlab\\\"\u003ekeep your tailnet policy file in GitLab\u003c/a\u003e, and automatically run tests and push changes to Tailscale\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-19.mdx\",\"title\":\"Additional autogroup values\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003eautogroup:billing-admin\u003c/code\u003e and \u003ccode\u003eautogroup:auditor\u003c/code\u003e added as \u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003eautogroups\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-18-audit-logs.mdx\",\"title\":\"Audit log events for Network flow logs\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Enable network flow logging for tailnet\\\" and \\\"Disable network flow logging for tailnet\\\" are logged as \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003eConfiguration audit logging events\u003c/a\u003e for \u003ca href=\\\"/kb/1219/network-flow-logs\\\"\u003eNetwork flow logs\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-18-billing.mdx\",\"title\":\"Billing page updates\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003e\u003cstrong\u003eBilling\u003c/strong\u003e\u003c/a\u003e page of the admin console is updated to show new Tailscale \u003ca href=\\\"/pricing\\\"\u003epricing\u003c/a\u003e plans and a tailnet's monthly active users\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-18-netlogs.mdx\",\"title\":\"Network flow logs\",\"kind\":\"service\",\"link\":\"/blog/network-flow-logs\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1219/network-flow-logs\\\"\u003eNetwork flow logs\u003c/a\u003e to understand which nodes connected to which other nodes, and when, in your tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-18-oidc.mdx\",\"title\":\"Additional custom OIDC providers\",\"kind\":\"service\",\"link\":\"/blog/custom-oidc-enterprise/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAuth0, Authentik, Dex, Duo, GitLab, JumpCloud, Keycloak, Ory, and ZITADEL are now available as \u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003ecustom OIDC providers\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-18-pricing.mdx\",\"title\":\"Updated pricing plans\",\"kind\":\"service\",\"link\":\"/blog/pricing-v3\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe available \u003ca href=\\\"/pricing\\\"\u003epricing plans\u003c/a\u003e are Free, Starter, Premium, and Enterprise. \u003ca href=\\\"/kb/1154/free-plans-discounts/#community-on-github\\\"\u003eCommunity on GitHub\u003c/a\u003e projects remain free, and discounts remain available for \u003ca href=\\\"/kb/1154/free-plans-discounts#charities-not-for-profit-organizations-and-educational-institutions\\\"\u003echarities, not-for-profit organizations, and educational institutions\u003c/a\u003e. If you want, you can keep your old plan until \u003cem\u003eat least\u003c/em\u003e April 30, 2024.\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe Free plan has three free users\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAll plans only pay for incremental usage above three users\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-07.mdx\",\"title\":\"New autogroup values\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003eautogroup:admin\u003c/code\u003e, \u003ccode\u003eautogroup:it-admin\u003c/code\u003e, \u003ccode\u003eautogroup:network-admin\u003c/code\u003e, and \u003ccode\u003eautogroup:owner\u003c/code\u003e\\nadded as \u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003eautogroups\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-06-address-card.mdx\",\"title\":\"Machine address copy card\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eClick on a machine's IP address in the \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e\\npage of the admin console to display a machine address copy card. Within the machine address card, click to copy the MagicDNS name, IPV4 address, or IPV6 address of the machine to your clipboard.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-06\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-05.mdx\",\"title\":\"Tailscale v1.38.4\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.38.4\",\"content\":\"$37\",\"date\":\"2023-04-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-04-04.mdx\",\"title\":\"Audit log events for Member users\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Log in using the web interface\\\" and \\\"Log out using the web interface\\\" are logged as \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003eConfiguration audit logging events\u003c/a\u003e for the \u003ca href=\\\"/kb/1138/user-roles/#member\\\"\u003eMember\u003c/a\u003e user role. These events differentiate logins from users with access to the admin console.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-04-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-31.mdx\",\"title\":\"Tailnet lock works for additional scenarios\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003eTailnet lock\u003c/a\u003e works with \u003ca href=\\\"/kb/1084/sharing\\\"\u003eshared nodes\u003c/a\u003e and \u003ca href=\\\"/kb/1216/tailscale-ssh-console\\\"\u003eTailscale SSH console\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-30-funnel.mdx\",\"title\":\"Tailscale Funnel Beta\",\"kind\":\"service\",\"link\":\"/blog/tailscale-funnel-beta\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1223/tailscale-funnel\\\"\u003eTailscale Funnel\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eRoute traffic from the wider internet to one or more of your Tailscale nodes.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-29-client.mdx\",\"title\":\"Tailscale v1.38.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.38.3\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSupport for stripping HTTP request paths from Funnel proxy routes (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/6571\\\"\u003e#6571\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1223/tailscale-funnel\\\"\u003eTailscale Funnel\u003c/a\u003e is now \u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1242/tailscale-serve\\\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e issue that did not use actual \u003ccode\u003eSrcAddr\u003c/code\u003e as \u003ccode\u003eX-Forwarded-For\u003c/code\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCertificate storage issue that did not actually use Kubernetes secrets\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUpgraded the Walk framework for the GUI client to improve menu responsiveness\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-29\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-28.mdx\",\"title\":\"Invite teams\",\"kind\":\"service\",\"link\":\"/blog/invite-users\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1064/invite-team-members\\\"\u003eInvite multiple users at once and administer invites\u003c/a\u003e from the \u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003e\u003cstrong\u003eUsers\u003c/strong\u003e\u003c/a\u003e page of the admin console\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\\\"Invite user to join tailnet\\\" is logged as a \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003eConfiguration audit logging event\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-28\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-27-sales-tax.mdx\",\"title\":\"Sales tax collected where required\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1182/billing-information/#sales-tax\\\"\u003eTailscale collects sales tax\u003c/a\u003e for jurisdictions\\nthat require it, except for organizations with tax exempt status\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-27.mdx\",\"title\":\"Custom OIDC providers\",\"kind\":\"service\",\"link\":\"/blog/custom-oidc\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse a \u003ca href=\\\"/kb/1240/sso-custom-oidc\\\"\u003ecustom OIDC provider\u003c/a\u003e for authentication to your tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-22-client.mdx\",\"title\":\"Tailscale v1.38.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.38.2\",\"content\":\"\u003ch6\u003eAll platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ccode\u003etailscale lock tskey-wrap\u003c/code\u003e has been replaced by \u003ca href=\\\"/kb/1243/tailscale-lock/#lock-sign\\\"\u003e\u003ccode\u003etailscale lock sign\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ccode\u003etailscale lock sign\u003c/code\u003e now supports signing auth keys\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ccode\u003e--tun=userspace-networking\u003c/code\u003e issue running in \u003ca href=\\\"/kb/1126/azure-app-service\\\"\u003eAzure App Services\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSparkle automatically checks \u003ca href=\\\"https://pkgs.tailscale.com/stable/#macos\\\"\u003eupdates for the standalone package\u003c/a\u003e. This does not impact the App Store package.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eFreeBSD\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli\u003eFixed: Issue setting the effective group ID on some non-interactive Tailscale SSH\\nsessions. This issue is specific to FreeBSD's implementation of \u003ccode\u003esetgroups\u003c/code\u003e and does not\\nimpact other platforms.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-17.mdx\",\"title\":\"Multi-use invite links\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eCreate multi-use invite links in the \u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003e\u003cstrong\u003eMachines\u003c/strong\u003e\u003c/a\u003e page of the admin console, for \u003ca href=\\\"/kb/1084/sharing\\\"\u003esharing nodes\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-14-client.mdx\",\"title\":\"Tailscale v1.38.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.38.1\",\"content\":\"$38\",\"date\":\"2023-03-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-10.mdx\",\"title\":\"User approval\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1239/user-approval\\\"\u003euser approval\u003c/a\u003e to require an admin to approve a user before\\nthey can join a tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli\u003eNew: Enable user approval for tailnet, Disable user approval for tailnet, and Approve user\\nactions are logged as \u003ca href=\\\"/kb/1203/audit-logging/#events\\\"\u003eConfiguration audit logging events\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003euserNeedsApproval\u003c/code\u003e and \u003ccode\u003euserApproved\u003c/code\u003e events are available as \u003ca href=\\\"/kb/1213/webhooks/#events\\\"\u003ewebhook events\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-09.mdx\",\"title\":\"Settings page is reorganized\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$39\",\"date\":\"2023-03-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-03-08.mdx\",\"title\":\"Tailscale extension for Docker Desktop GA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1184/docker-desktop\\\"\u003eDocker Desktop extension\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eUse the Tailscale extension for Docker Desktop to securely connect to the resources you need for development\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-03-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-27.mdx\",\"title\":\"Webhook event when a user role is updated\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003euserRoleUpdated\u003c/code\u003e \u003ca href=\\\"/kb/1213/webhooks\\\"\u003ewebhook\u003c/a\u003e event is now generated when a user role is \u003ca href=\\\"/kb/1171/changing-user-roles\\\"\u003echanged\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-02-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-22-client.mdx\",\"title\":\"Tailscale v1.36.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.36.2\",\"content\":\"\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003ePrevent using an exit node while being an exit node\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eImprove detection of default interface\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eImprove detection of default interface\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eImprove clean out of registry entries during upgrade\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-02-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-22.mdx\",\"title\":\"Billing admin\",\"kind\":\"service\",\"link\":\"/blog/billing-admin/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1138/user-roles/#billing-admin\\\"\u003eBilling admin\u003c/a\u003e role to manage pricing plan and billing information, but not modify other tailnet settings\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAll users with the \u003ca href=\\\"/kb/1138/user-roles/#admin\\\"\u003eAdmin\u003c/a\u003e role can manage pricing plan and billing information\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1203/audit-logging\\\"\u003eConfiguration audit logging\u003c/a\u003e no longer includes \\\"Update billing owner for tailnet\\\" events. Changes to Billing admin roles are included in \\\"Update role for user\\\" events\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-02-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-21.mdx\",\"title\":\"Webhook events when a webhook is updated or deleted\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003ewebhookUpdated\u003c/code\u003e and \u003ccode\u003ewebhookDeleted\u003c/code\u003e events are now generated when a\\n\u003ca href=\\\"/kb/1213/webhooks\\\"\u003ewebhook\u003c/a\u003e is updated or deleted. These events are\\nsubscribed by default and cannot be disabled.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-02-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-13.mdx\",\"title\":\"Device authorization is now called Device approval\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"$3a\",\"date\":\"2023-02-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-10.mdx\",\"title\":\"Webhook event when a user is created\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1213/webhooks/#events\\\"\u003euserCreated event\u003c/a\u003e in the Tailnet management category when a user is created\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-02-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-08-get-authkey.mdx\",\"title\":\"get-authkey utility\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eGenerate auth keys to \u003ccode\u003estdout\u003c/code\u003e for scripting with \u003ca href=\\\"/kb/1215/oauth-clients/#get-authkey-utility\\\"\u003e\u003ccode\u003eget-authkey\u003c/code\u003e utility\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-02-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-02-08.mdx\",\"title\":\"Tailscale v1.36.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.36.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003ePotential infinite loop when node key expires\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eHandle starting the app before network interfaces are ready\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eHandle starting the app before network interfaces are ready\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eGet Status intent will not connect the VPN\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003ePotential crash in netstat handling\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eWindows 7 checks for KB2533623\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-02-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-30.mdx\",\"title\":\"Configuration audit logging GA\",\"kind\":\"service\",\"link\":\"/blog/config-audit-logging-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1203/audit-logging\\\"\u003eConfiguration audit logging\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eIdentify who did what, and when, in your tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-27.mdx\",\"title\":\"Feature invite logs no longer include acceptor\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAccept invite for feature events in \u003ca href=\\\"/kb/1203/audit-logging\\\"\u003econfiguration audit logs\u003c/a\u003e no longer include the acceptor in the sharer's logs\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-26.mdx\",\"title\":\"OAuth clients\",\"kind\":\"service\",\"link\":\"/blog/oauth\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1215/oauth-clients\\\"\u003eOAuth clients\u003c/a\u003e to provide delegated fine-grained access to the \u003ca href=\\\"/kb/1101/api\\\"\u003eTailscale API\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-25-shortcuts.mdx\",\"title\":\"Tailscale actions for iOS and macOS Shortcuts\",\"kind\":\"service\",\"link\":\"/blog/ios-macos-shortcuts/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1233/mac-ios-shortcuts\\\"\u003eAutomate tasks\u003c/a\u003e with Tailscale actions for iOS and\\nmacOS Shortcuts\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-24.mdx\",\"title\":\"Tailscale v1.36\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":1.36,\"content\":\"$3b\",\"date\":\"2023-01-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-20-authentication.mdx\",\"title\":\"Login page interstitial to confirm node authentication\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe Tailscale login page (\u003ca href=\\\"https://login.tailscale.com\\\"\u003e\u003ccode\u003ehttps://login.tailscale.com\u003c/code\u003e\u003c/a\u003e) describes the action taking\\nplace, such as adding a new device or authorizing SSH access. For some actions, like adding a\\nnew node, a second redirection page will be used as a confirmation step.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-20.mdx\",\"title\":\"Self-request access to Tailscale Funnel\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUI functionality to \u003ca href=\\\"/kb/1222/invite-only-feature/#joining-a-feature-invitation-waitlist\\\"\u003erequest access\u003c/a\u003e to \u003ca href=\\\"/kb/1223/tailscale-funnel\\\"\u003eTailscale Funnel\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-18.mdx\",\"title\":\"Functionality to delete the beta.tailscale.net nameserver\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUI functionality to \u003ca href=\\\"/kb/1081/magicdns/#removing-the-betatailscalenet-nameserver\\\"\u003edelete the legacy \u003ccode\u003ebeta.tailscale.net\u003c/code\u003e nameserver\u003c/a\u003e if you are no longer using it\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-17.mdx\",\"title\":\"Scoop\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAvailable as an application in \u003ca href=\\\"https://scoop.sh\\\"\u003eScoop\u003c/a\u003e in \u003ca href=\\\"https://github.com/ScoopInstaller/Extras/blob/master/bucket/tailscale.json\\\"\u003eExtras bucket\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-12.mdx\",\"title\":\"Terms of service, privacy policy, and DPA\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUpdated \u003ca href=\\\"/terms\\\"\u003eTerms of service\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUpdated \u003ca href=\\\"/privacy-policy\\\"\u003ePrivacy policy\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/dpa\\\"\u003eData Privacy Addendum\u003c/a\u003e and \u003ca href=\\\"/dpa-subprocessors\\\"\u003elist of subprocessors\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-04.mdx\",\"title\":\"Tailscale v1.34.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.34.2\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eHandling of a very large number of SplitDNS domains with an exit node\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eUI glitch with macOS 10.14 and 10.13\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCustom server URL from registry key support\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCrashes manifesting on ARM-based platforms and models with very old kernels\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2023/2023-01-03.mdx\",\"title\":\"Dev container feature\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eAccess your tailnet from GitHub Codespaces \u003ca href=\\\"/kb/1160/github-codespaces/#integration\\\"\u003eusing Tailscale as a feature in a dev container\u003c/a\u003e (Thanks \u003ca href=\\\"https://github.com/zombiezen\\\"\u003eRoss Light\u003c/a\u003e!)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2023-01-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-12-16.mdx\",\"title\":\"User \u0026 group provisioning for Okta GA\",\"kind\":\"service\",\"link\":\"/blog/sync-okta-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1180/sso-okta-scim\\\"\u003eUser \u0026#x26; group provisioning for Okta\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eSync Okta groups to use in your Tailscale ACLs\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003enodeID\u003c/code\u003e included in all node-related \u003ca href=\\\"/kb/1213/webhooks\\\"\u003ewebhook\u003c/a\u003e event payloads\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-12-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-12-14.mdx\",\"title\":\"Tailnet lock\",\"kind\":\"service\",\"link\":\"/blog/tailnet-lock/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1226/tailnet-lock\\\"\u003etailnet lock\u003c/a\u003e to require your nodes to verify node keys distributed by the\\n\u003ca href=\\\"/kb/1155/terminology-and-concepts/#coordination-server\\\"\u003ecoordination server\u003c/a\u003e before trusting them (\u003ca href=\\\"/kb/1167/release-stages/#alpha\\\"\u003ealpha\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-12-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-12-13.mdx\",\"title\":\"Tailscale v1.34.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.34.1\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eUnit tests on systems using \u003ccode\u003ebusybox ip\u003c/code\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eRegression handling \u003ccode\u003eTS_STATE_DIR\u003c/code\u003e in containerboot\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIssue which could fail to save the key for \u003ca href=\\\"/kb/1080/cli/#serve\\\"\u003e\u003ccode\u003etailscale serve\u003c/code\u003e\u003c/a\u003e (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/6409\\\"\u003e#6409\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIssue which could cause crash when interfaces change (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/6641\\\"\u003e#6641\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCommon cause of an issue with \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/6639\\\"\u003e#6639\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-12-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-12-07.mdx\",\"title\":\"Export list of devices and users in your tailnet\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse the admin console to \u003ca href=\\\"/kb/1228/export-device-list\\\"\u003eexport a list of devices\u003c/a\u003e and\\n\u003ca href=\\\"/kb/1229/export-user-list\\\"\u003eexport a list of users\u003c/a\u003e in your tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-12-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-12-05.mdx\",\"title\":\"Tailscale v1.34\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":1.34,\"content\":\"$3c\",\"date\":\"2022-12-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-12-02.mdx\",\"title\":\"Set contact preferences for email notifications\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1224/contact-preferences\\\"\u003eSet contact preferences\u003c/a\u003e in the\\n\u003ca href=\\\"https://login.tailscale.com/admin/settings/contact-preferences\\\"\u003e\u003cstrong\u003eContact Preferences\u003c/strong\u003e\u003c/a\u003e page of\\nthe admin console for notifications about account changes, configuration issues, security issues,\\nand billing\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eContact preference updates and verifications are included in \u003ca href=\\\"/kb/1203/audit-logging\\\"\u003econfiguration audit logs\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-12-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-11-23.mdx\",\"title\":\"Create feature preview invitations\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1222/invite-only-feature/#creating-a-feature-invitation\\\"\u003eCreate invitations for feature previews\u003c/a\u003e in the \u003ca href=\\\"https://login.tailscale.com/admin/settings/general\\\"\u003e\u003cstrong\u003eGeneral\u003c/strong\u003e\u003c/a\u003e settings page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-11-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-11-22.mdx\",\"title\":\"Name change for unstable Docker images\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTailscale unstable images on \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e and in\\n\u003ca href=\\\"https://github.com/tailscale/tailscale/pkgs/container/tailscale\\\"\u003eGitHub Packages\u003c/a\u003e now contain\\nthe prefix \\\"unstable-\\\", for example \\\"unstable-v1.33\\\" instead of \\\"v1.33\\\"\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-11-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-11-21.mdx\",\"title\":\"Tailscale v1.32.3\",\"kind\":\"client\",\"link\":\"/blog/2022-11-21-windows-security-vulnerabilities\",\"clientVersion\":\"1.32.3\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eSecurity vulnerability in the Windows client that allows a malicious website to reconfigure the Tailscale daemon \u003ccode\u003etailscaled\u003c/code\u003e,\\nwhich can then be used to remotely execute code (\u003ca href=\\\"https://www.cve.org/CVERecord?id=CVE-2022-41924\\\"\u003eCVE-2022-41924\u003c/a\u003e, \u003ca href=\\\"/security-bulletins/#ts-2022-004\\\"\u003eTS-2022-004\u003c/a\u003e)\u003c/li\u003e\\n\u003cli\u003eFixed: Security vulnerability in the client that allows a malicious website to access the peer API, which can then be used to access\\nTailscale environment variables (\u003ca href=\\\"https://www.cve.org/CVERecord?id=CVE-2022-41925\\\"\u003eCVE-2022-41925\u003c/a\u003e, \u003ca href=\\\"/security-bulletins/#ts-2022-005\\\"\u003eTS-2022-005\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eSet \u003ccode\u003eZone.Identifier\u003c/code\u003e alternate data stream for Taildrop files\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eSet \u003ccode\u003ecom.apple.quarantine\u003c/code\u003e flag for Taildrop files\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-11-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-11-17.mdx\",\"title\":\"Tailscale Funnel\",\"kind\":\"service\",\"link\":\"/blog/introducing-tailscale-funnel/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1223/tailscale-funnel\\\"\u003eTailscale Funnel\u003c/a\u003e to route traffic from the wider Internet to your Tailscale nodes (alpha)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-11-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-11-10.mdx\",\"title\":\"Filter machines in admin console with UI filters\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1176/filter-devices\\\"\u003eUse UI filters\u003c/a\u003e to easily filter devices in the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003eMachines\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-11-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-11-08.mdx\",\"title\":\"Webhook event payload additions\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ca href=\\\"/kb/1203/audit-logging/#log-structure\\\"\u003eactor\u003c/a\u003e is included in all \u003ca href=\\\"/kb/1213/webhooks\\\"\u003ewebhook\u003c/a\u003e event payloads\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ca href=\\\"/kb/1028/key-expiry\\\"\u003ekey expiration time\u003c/a\u003e is included in payloads for expiration-related events\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eSlack messages generated for webhook events now have timestamps formatted in the local timezone of the user viewing the message\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-11-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-11-03.mdx\",\"title\":\"Tailscale in Azure Marketplace\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSet up billing in Azure with a \u003ca href=\\\"/kb/1220/azure-marketplace\\\"\u003eTailscale in Azure Marketplace\u003c/a\u003e subscription\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-11-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-27.mdx\",\"title\":\"Tailscale SSH Console\",\"kind\":\"service\",\"link\":\"/blog/ssh-console/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eCreate a \u003ca href=\\\"/kb/1216/tailscale-ssh-console\\\"\u003ebrowser-based SSH session\u003c/a\u003e from the admin console to a node on your tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-26-client.mdx\",\"title\":\"Tailscale v1.32.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.32.2\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eSubstantially improve userspace-networking handling of packet loss\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix a crash impacting some macOS systems (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/6065\\\"\u003e#6065\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix a 4-in-6 DNS problem mainly impacting Android (fixed by Peter Cai) (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/5698\\\"\u003e#5698\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-26-service.mdx\",\"title\":\"Ability to change tailnet fun name\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1217/tailnet-name/#re-roll-the-fun-name\\\"\u003eRe-roll tailnet fun name\u003c/a\u003e if you want a different fun name \u003cem\u003eand\u003c/em\u003e you haven't already used it for HTTPS certificates\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-26.mdx\",\"title\":\"Webhooks\",\"kind\":\"service\",\"link\":\"/blog/webhooks\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1213/webhooks\\\"\u003ewebhooks\u003c/a\u003e to subscribe to certain events on your tailnet and process the event notifications through an integration or app\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-21-client.mdx\",\"title\":\"Tailscale v1.32.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.32.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAvoid crash in \u003ccode\u003etailscale netcheck\u003c/code\u003e (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/5919\\\"\u003e#5919\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAvoid a condition which can result in high CPU consumption (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/5879\\\"\u003e#5879\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix Taildrop failures when sending many files (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/5873\\\"\u003e#5873\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix Taildrop failures when sending many files (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/5873\\\"\u003e#5873\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCorrect IPv6 MTU setting (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/5914\\\"\u003e#5914\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-21-expiry.mdx\",\"title\":\"Customizable expiry for keys\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eChoose an expiry between 1 and 90 days for new \u003ca href=\\\"/kb/1085/auth-keys\\\"\u003eauth keys\u003c/a\u003e and \u003ca href=\\\"/kb/1101/api\\\"\u003eAPI keys\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-21.mdx\",\"title\":\"Fully qualified domain name in API responses\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli\u003eChanged: In output of Tailscale API calls, a machine's name uses the fully qualified\\ndomain name based on the \u003ca href=\\\"/kb/1217/tailnet-name\\\"\u003etailnet name\u003c/a\u003e, instead of the previous\\nformat based on the \u003ca href=\\\"/kb/1217/tailnet-name/#organization-name\\\"\u003eorganization name\u003c/a\u003e. For\\nexample, a machine name in API output is now \u003ccode\u003emy-server.yak-bebop.ts.net\u003c/code\u003e instead of\\n\u003ccode\u003emy-server.example.com\u003c/code\u003e. This is a display-only change and doesn't modify the name of any\\nmachines.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-20.mdx\",\"title\":\"MagicDNS General Availability\",\"kind\":\"service\",\"link\":\"/blog/magicdns\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1081/magicdns\\\"\u003eMagicDNS\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eAccess devices using short hostnames, like \u003ccode\u003emy-server\u003c/code\u003e or \u003ccode\u003edashboard\u003c/code\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-18.mdx\",\"title\":\"Tailnet name changed\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTailnets use \u003ccode\u003e.ts.net\u003c/code\u003e instead of \u003ccode\u003e.beta.tailscale.net\u003c/code\u003e for the \u003ca href=\\\"/kb/1217/tailnet-name\\\"\u003etailnet name\u003c/a\u003e\\n\u003cul\u003e\\n\u003cli\u003eTo avoid publicizing your organization name, Tailscale provides you with a tailnet name, which is used by features like MagicDNS, HTTPS, and sharing. The tailnet name is visible in the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/dns\\\"\u003eDNS\u003c/a\u003e\u003c/strong\u003e page of the admin console.\u003c/li\u003e\\n\u003cli\u003ePreviously, you might have used a name ending in \u003ccode\u003e.beta.tailscale.net\u003c/code\u003e. If so, migrate to the new tailnet name. The existing \u003ccode\u003ebeta.tailscale.net\u003c/code\u003e name remains supported until at least November 1, 2023.\u003c/li\u003e\\n\u003cli\u003eWhat we previously called the tailnet name is now called the organization name. The\\norganization name is used by the Tailscale API, and is visible in the\\n\u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings\\\"\u003eSettings\u003c/a\u003e\u003c/strong\u003e page of the admin console.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-13.mdx\",\"title\":\"Configuration audit logging\",\"kind\":\"service\",\"link\":\"/blog/config-audit-logging\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1203/audit-logging\\\"\u003econfiguration audit logging\u003c/a\u003e to identify who did what, and when,\\nin your tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-12-service.mdx\",\"title\":\"NextDNS\",\"kind\":\"service\",\"link\":\"/blog/nextdns\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1218/nextdns\\\"\u003eNextDNS as a global nameserver\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eConfigure different NextDNS profiles for different devices using \u003ca href=\\\"/kb/1337/acl-syntax/#nodeattrs\\\"\u003e\u003ccode\u003enodeAttrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-12.mdx\",\"title\":\"Tailscale v1.32.0\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.32.0\",\"content\":\"$3d\",\"date\":\"2022-10-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-10-05.mdx\",\"title\":\"DNS entries for DERP regions for firewalls\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePer-DERP-region DNS entries, such as \u003ccode\u003ederp1-all.tailscale.com\u003c/code\u003e, available for \u003ca href=\\\"/kb/1082/firewall-ports#what-if-i-really-really-want-to-specify-the-hostnames-that-tailscale-uses-to-operate-its-service\\\"\u003efirewall allowlists\u003c/a\u003e or other compliance requirements\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-10-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-30.mdx\",\"title\":\"Key type embedded in keys\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eKey type is embedded in new keys, for example, \u003ccode\u003etskey-auth-012345abcdef\u003c/code\u003e instead of \u003ccode\u003etskey-012345abcdef\u003c/code\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-26.mdx\",\"title\":\"Honolulu DERP region\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eHonolulu added as a \u003ca href=\\\"/blog/how-tailscale-works/#encrypted-tcp-relays-derp\\\"\u003eDERP region\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-22.mdx\",\"title\":\"Dubai and Warsaw DERP regions\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eDubai and Warsaw added as \u003ca href=\\\"/blog/how-tailscale-works/#encrypted-tcp-relays-derp\\\"\u003eDERP regions\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-16-service.mdx\",\"title\":\"Check mode supported for nodes provisioned with an auth key\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eNodes provisioned with an auth key can use \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e with \u003ca href=\\\"/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode\\\"\u003echeck mode\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-16.mdx\",\"title\":\"Tailscale v1.30.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.30.2\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIPv6-mapped-IPv4 addresses in STUN responses\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eBetter detect when running in a container\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-15.mdx\",\"title\":\"Hong Kong, Madrid, and Toronto DERP regions\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eHong Kong, Madrid, and Toronto added as \u003ca href=\\\"/blog/how-tailscale-works/#encrypted-tcp-relays-derp\\\"\u003eDERP regions\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-14.mdx\",\"title\":\"Los Angeles and Paris DERP regions\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eLos Angeles and Paris added as \u003ca href=\\\"/blog/how-tailscale-works/#encrypted-tcp-relays-derp\\\"\u003eDERP regions\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-13.mdx\",\"title\":\"Johannesburg and Miami DERP regions\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eJohannesburg and Miami added as \u003ca href=\\\"/blog/how-tailscale-works/#encrypted-tcp-relays-derp\\\"\u003eDERP regions\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-12.mdx\",\"title\":\"Amsterdam and Denver DERP regions\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAmsterdam and Denver added as \u003ca href=\\\"/blog/how-tailscale-works/#encrypted-tcp-relays-derp\\\"\u003eDERP regions\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-08.mdx\",\"title\":\"Tailscale v1.30.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.30.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eExit nodes in userspace-networking mode break Chrome v.104 or later IPv6 connectivity\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eSIGINT when running in a container without job control\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-02.mdx\",\"title\":\"GitOps for Tailscale ACLs\",\"kind\":\"service\",\"link\":\"/blog/gitops-acls\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://github.com/marketplace/actions/sync-tailscale-acls\\\"\u003eSync Tailscale ACLs\u003c/a\u003e GitHub Action in GitHub Marketplace to \u003ca href=\\\"/kb/1204/gitops-acls\\\"\u003ekeep your tailnet policy file in Git\u003c/a\u003e, and automatically run tests and push changes to Tailscale\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-02\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-09-01.mdx\",\"title\":\"See recently expired and revoked auth and API keys\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eRecently expired and revoked \u003ca href=\\\"/kb/1085/auth-keys/\\\"\u003eauth keys\u003c/a\u003e and \u003ca href=\\\"/kb/1101/api\\\"\u003eAPI keys\u003c/a\u003e are now shown on the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings/keys\\\"\u003eKeys\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-09-01\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-31.mdx\",\"title\":\"Tailscale v1.30\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.30.0\",\"content\":\"$3e\",\"date\":\"2022-08-31\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-30.mdx\",\"title\":\"Terraform provider\",\"kind\":\"service\",\"link\":\"/blog/terraform\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1210/terraform-provider\\\"\u003eTailscale Terraform provider\u003c/a\u003e for managing your Tailscale resources, managed by Tailscale\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-08-30\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-26.mdx\",\"title\":\"Share invite links without a label\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eInvite links for \u003ca href=\\\"/kb/1084/sharing\\\"\u003esharing a device\u003c/a\u003e are automatically generated and copied, and no longer requires a label to be generated\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-08-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-25.mdx\",\"title\":\"Remove ephemeral nodes immediately\",\"kind\":\"service\",\"link\":\"/blog/ephemeral-logout/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eRun \u003ca href=\\\"/kb/1080/cli/#logout\\\"\u003e\u003ccode\u003etailscale logout\u003c/code\u003e\u003c/a\u003e to remove an \u003ca href=\\\"/kb/1111/ephemeral-nodes\\\"\u003eephemeral node\u003c/a\u003e from your tailnet immediately\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-08-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-24.mdx\",\"title\":\"TrueCharts\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eTrueCharts has added community support for a \u003ca href=\\\"https://truecharts.org/docs/charts/stable/tailscale/\\\"\u003eTrueNAS SCALE app and Helm chart for Tailscale\u003c/a\u003e (Thanks!)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-08-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-15.mdx\",\"title\":\"On-demand access integration\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eOn-demand access integration with \u003ca href=\\\"/kb/1208/ondemand-conductorone\\\"\u003eConductorOne\u003c/a\u003e,\\n\u003ca href=\\\"/kb/1205/ondemand-indent\\\"\u003eIndent\u003c/a\u003e, \u003ca href=\\\"/kb/1209/ondemand-opal\\\"\u003eOpal\u003c/a\u003e, and \u003ca href=\\\"/kb/1206/ondemand-sym\\\"\u003eSym\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-08-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-11.mdx\",\"title\":\"OneCGNATRoute setting, custom derp server upgrade\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eThe \u003ca href=\\\"/kb/1337/acl-syntax/#network-policy-options\\\"\u003enetwork policy options section\u003c/a\u003e in ACLs now\\ncontains the \u003ccode\u003eOneCGNATRoute\u003c/code\u003e setting which controls the routes that Tailscale clients will generate\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eBug that can cause slow connects and a crash in a \u003ca href=\\\"/kb/1118/custom-derp-servers\\\"\u003ecustom DERP server\u003c/a\u003e\\nin manual cert mode (not using Let's Encrypt). We encourage you to upgrade your \u003ccode\u003ederper\u003c/code\u003e binary.\\nIf you use the default Let's Encrypt mode, no action is required\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-08-11\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-08-09.mdx\",\"title\":\"Tailscale SSH supported for shared tagged nodes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eConnect with \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e to \u003ca href=\\\"/kb/1068/acl-tags\\\"\u003etagged\u003c/a\u003e nodes that are \u003ca href=\\\"/kb/1084/sharing\\\"\u003eshared\u003c/a\u003e with you\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-08-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-07-19.mdx\",\"title\":\"Tailscale status page\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eView the status of Tailscale services at \u003ca href=\\\"https://status.tailscale.com/\\\"\u003ehttps://status.tailscale.com/\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-07-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-07-18-pfsense.mdx\",\"title\":\"pfSense\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eNetgate has added Tailscale support to the \u003ca href=\\\"https://www.netgate.com/blog/tailscale-on-pfsense-software\\\"\u003epfSense package repository\u003c/a\u003e (Thanks!)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-07-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-07-18.mdx\",\"title\":\"Tailscale v1.28\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.28.0\",\"content\":\"$3f\",\"date\":\"2022-07-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-07-05.mdx\",\"title\":\"Tailscale v1.26.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.26.2\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ccode\u003etailscaled\u003c/code\u003e being able to restart while mosh-server is running from an SSH session\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eMake \u003ccode\u003etailscale up --operator=\\\"\\\"\u003c/code\u003e clear a previously set operator\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e support with Arch Linux\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eLimit SSH login to 16 groups\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eMake SSH command prefer Windows \u003ccode\u003essh.exe\u003c/code\u003e over \u003ccode\u003ePATH\u003c/code\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTry harder to notify for \u003ca href=\\\"/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode\\\"\u003eSSH check mode\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-07-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-06-23-4via6.mdx\",\"title\":\"4via6 subnet routers\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1201/4via6-subnets\\\"\u003e4via6 subnet routers\u003c/a\u003e to route traffic when you have existing\\nsubnets with overlapping IPv4 addresses (\u003ca href=\\\"/kb/1167/release-stages/#alpha\\\"\u003ealpha\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-06-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-06-23.mdx\",\"title\":\"DNS records for shared devices\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1084/sharing\\\"\u003eSharing a device\u003c/a\u003e with a tailnet domain alias now lets the share recipient also use the shared device's \u003ccode\u003e*.ts.net\u003c/code\u003e DNS name\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-06-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-06-22.mdx\",\"title\":\"Tailscale SSH\",\"kind\":\"\",\"link\":\"/blog/tailscale-ssh/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e to allow Tailscale to manage the authentication and authorization of SSH connections in your tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1192/acl-samples/#allow-all-default-acl\\\"\u003eDefault ACL\u003c/a\u003e now allows users to access their own devices using \u003ca href=\\\"/kb/1193/tailscale-ssh\\\"\u003eTailscale SSH\u003c/a\u003e with \u003ca href=\\\"/kb/1193/tailscale-ssh#configure-tailscale-ssh-with-check-mode\\\"\u003echeck mode\u003c/a\u003e. \u003cem\u003eThis only affects tailnets with default ACLs, including new tailnets and tailnets which have never modified their ACLs\u003c/em\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-06-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-06-18.mdx\",\"title\":\"Tailscale v1.26.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.26.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eVarious bugs\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-06-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-06-06.mdx\",\"title\":\"Tailscale v1.26\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.26.0\",\"content\":\"$40\",\"date\":\"2022-06-06\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-06-03.mdx\",\"title\":\"Search, role filtering, and pagination now supported in the Users page\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSearch for users and filter based on user role in the \u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003eUsers page\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePagination when user list is large in the Users page\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-06-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-20.mdx\",\"title\":\"Standalone macOS build available for testing\",\"kind\":\"\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://pkgs.tailscale.com/unstable/#macos\\\"\u003eInitial release of a standalone macOS client\u003c/a\u003e, which is independent of the App Store, in the \u003ca href=\\\"/kb/1083/install-unstable\\\"\u003eunstable track\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-19.mdx\",\"title\":\"Update billing email details in the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1182/billing-information\\\"\u003eUpdate billing email address\u003c/a\u003e in the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003eBilling\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-18-service.mdx\",\"title\":\"Autogroup:members as a tag owner\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ccode\u003eautogroup:members\u003c/code\u003e as a \u003ca href=\\\"/kb/1337/acl-syntax/#tag-owners\\\"\u003etag owner\u003c/a\u003e, to enable device tagging by any\\nuser who is a direct member (not a shared user) of the tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-18.mdx\",\"title\":\"Format ACLs when saving\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eACLs are automatically formatted when saved from the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/acls\\\"\u003eAccess controls\u003c/a\u003e\u003c/strong\u003e page of the admin console or the API\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-17.mdx\",\"title\":\"Key expiry range changed\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003ca href=\\\"/kb/1028/key-expiry\\\"\u003eallowed expiration range for keys\u003c/a\u003e is 1 to 180 days, instead of 3 to 180 days\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-16.mdx\",\"title\":\"Update invoice details in the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1182/billing-information\\\"\u003eUpdate invoice name and address\u003c/a\u003e in the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003eBilling\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-10.mdx\",\"title\":\"Tailscale extension for Docker Desktop\",\"kind\":\"\",\"link\":\"/blog/docker/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse the \u003ca href=\\\"/kb/1184/docker-desktop\\\"\u003eTailscale extension for Docker Desktop\u003c/a\u003e to securely connect to the\\nresources you need for development (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-09.mdx\",\"title\":\"Add all addresses for global DNS nameservers\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eWhen \u003ca href=\\\"/kb/1054/dns/#global-nameservers\\\"\u003eadding common global DNS nameservers\u003c/a\u003e, Tailscale will automatically include all IPv4 and IPv6 addresses for that nameserver and treat them as one entity\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-05-05.mdx\",\"title\":\"Validate ACLs in API\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/api.md#tailnet-acl-validate-post\\\"\u003etailnet ACL validate API call\u003c/a\u003e also allows verifying ACL format and running \u003ca href=\\\"/kb/1337/acl-syntax/#tests\\\"\u003eACL tests\u003c/a\u003e, without posting a new ACL\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eThe \u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/api.md#tailnet-keys-key-get\\\"\u003etailnet key detail API call\u003c/a\u003e includes whether an auth key is \u003ca href=\\\"/kb/1099/device-authorization/#pre-approve-devices-with-an-auth-key\\\"\u003epre-authorized\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-05-05\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-04-28.mdx\",\"title\":\"Tailscale v1.24.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.24.2\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eHandling of HTTP proxies in certain circumstances\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAn issue where the new control plane protocol could fail to make a connection to our servers (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/4557\\\"\u003e#4557\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAdditional fix in handling of HTTP proxies\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-04-28\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-04-27.mdx\",\"title\":\"Tailscale v1.24.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.24.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eTwo issues where the new control plane protocol could fail to make a connection to our servers (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/4544\\\"\u003e#4544\u003c/a\u003e, \u003ca href=\\\"https://github.com/tailscale/tailscale/issues/4538\\\"\u003e#4538\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eSet TCP keep-alives in userspace-networking subnet router to avoid connection leaks (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/4522\\\"\u003e#4522\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAvoid using the LTE radio after transition to Wi-Fi\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-04-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-04-25-android-tv.mdx\",\"title\":\"Android TV support\",\"kind\":\"\",\"link\":\"/blog/android-tv/\",\"clientVersion\":\"No Version\",\"content\":\"\u003ch6\u003eAndroid\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1079/install-android\\\"\u003eRun Tailscale on Android TV\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-04-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-04-22.mdx\",\"title\":\"Tailscale v1.24\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.24.0\",\"content\":\"$41\",\"date\":\"2022-04-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-04-19-okta-provisioning.mdx\",\"title\":\"Sync Okta groups to use in your Tailscale ACLs\",\"kind\":\"service\",\"link\":\"/blog/sync-okta-groups/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1180/sso-okta-scim\\\"\u003eUser \u0026#x26; group provisioning for Okta\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-04-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-04-19.mdx\",\"title\":\"Filter on user state, and view Last seen date, in the Users page\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eFilter based on user state (\u003cstrong\u003eActive\u003c/strong\u003e, \u003cstrong\u003eInactive\u003c/strong\u003e, and \u003cstrong\u003eSuspended\u003c/strong\u003e) in the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003eUsers\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003cstrong\u003eLast seen\u003c/strong\u003e column in the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003eUsers\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-04-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-04-14.mdx\",\"title\":\"Update tax identification number in the admin console\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1182/billing-information\\\"\u003eAdd or modify your tax identification number\u003c/a\u003e in the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings/billing\\\"\u003eBilling\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-04-14\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-25.mdx\",\"title\":\"ACL tests now support group in syntax\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1337/acl-syntax/#tests\\\"\u003eACL tests\u003c/a\u003e now support \u003ccode\u003egroup\u003c/code\u003e as an option for the \u003ccode\u003esrc\u003c/code\u003e field, and\\nas the \u003ccode\u003ehost\u003c/code\u003e portion of the \u003ccode\u003eaccept\u003c/code\u003e and \u003ccode\u003edeny\u003c/code\u003e fields.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-21.mdx\",\"title\":\"ACL tests now support accept/deny syntax\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePolicy syntax for \u003ca href=\\\"/kb/1337/acl-syntax/#tests\\\"\u003eACL tests\u003c/a\u003e now supports \u003ccode\u003eaccept\u003c/code\u003e/\u003ccode\u003edeny\u003c/code\u003e in\\naddition to \u003ccode\u003eallow\u003c/code\u003e/\u003ccode\u003edeny\u003c/code\u003e when specifying destinations that the ACL rules should accept or deny.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-17.mdx\",\"title\":\"Tailscale v1.22.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.22.2\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003ePotential crash at startup when using BGP\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eMSI not restarting GUI after MSI-to-MSI upgrade\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-15.mdx\",\"title\":\"Caddy\",\"kind\":\"service\",\"link\":\"/blog/caddy\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUse \u003ca href=\\\"/kb/1190/caddy-certificates\\\"\u003eCaddy to manage Tailscale HTTPS certificates\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-10-server.mdx\",\"title\":\"Tagged nodes no longer need key renewal\",\"kind\":\"service\",\"link\":\"/blog/tagged-key-expiry\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1068/acl-tags\\\"\u003eTagged devices\u003c/a\u003e have \u003ca href=\\\"/kb/1028/key-expiry\\\"\u003ekey expiry\u003c/a\u003e disabled by default\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-10.mdx\",\"title\":\"Autogroup:members\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eACL rules can use \u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003e\u003ccode\u003eautogroup:members\u003c/code\u003e\u003c/a\u003e to write rules to allow access for users who are direct members (not shared users) of the tailnet\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-10\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-09.mdx\",\"title\":\"Tailscale v1.22.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.22.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIn \u003ccode\u003euserspace-networking\u003c/code\u003e mode, always close SOCKS proxied connections\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eBetter operation with \u003ca href=\\\"https://gokrazy.org/\\\"\u003egokrazy\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003emacOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix macOS GUI \\\"Must restart\\\" dialog in some cases\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix a Windows NSIS installer bug when upgrading\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eFreeBSD\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix portmapping\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-03-04.mdx\",\"title\":\"Exit node sharing\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1084/sharing/#sharing--exit-nodes\\\"\u003eShare an exit node\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-03-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-23-autoapprovers.mdx\",\"title\":\"Auto Approvers for routes and exit nodes\",\"kind\":\"service\",\"link\":\"/blog/auto-approvers/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1337/acl-syntax/#autoapprovers\\\"\u003eAuto Approvers for routes and exit nodes\u003c/a\u003e to auto-approve advertised routes and exit nodes (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-02-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-23.mdx\",\"title\":\"Tailscale v1.22\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.22.0\",\"content\":\"$42\",\"date\":\"2022-02-23\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-22.mdx\",\"title\":\"ACL rules now support src/dst syntax\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePolicy syntax for \u003ca href=\\\"/kb/1337/acl-syntax/#acls\\\"\u003eACL rules\u003c/a\u003e now supports \u003ccode\u003esrc\u003c/code\u003e/\u003ccode\u003edst\u003c/code\u003e in\\naddition to \u003ccode\u003eusers\u003c/code\u003e/\u003ccode\u003eports\u003c/code\u003e when referring to sources and destinations\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-02-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-17-preview-rules.mdx\",\"title\":\"Preview rules bug fixes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1338/acl-edit/#preview-changes\\\"\u003ePreview rules\u003c/a\u003e in the admin console does not confuse access for tagged nodes with other tagged nodes (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/3957\\\"\u003e#3957\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003ePreview rules no longer shows \u003ccode\u003eautogroup:self\u003c/code\u003e for all tagged nodes\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003ePreview rules no longer shows an error if there is an \u003ccode\u003eautogroup:self\u003c/code\u003e rule\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-02-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-17.mdx\",\"title\":\"Pre-authorized auth keys\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eGenerate \u003ca href=\\\"/kb/1085/auth-keys/\\\"\u003eauth keys\u003c/a\u003e that are \u003ca href=\\\"/kb/1099/device-authorization/#pre-approve-devices-with-an-auth-key\\\"\u003epre-authorized for device authorization\u003c/a\u003e (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/2120\\\"\u003e#2120\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1085/auth-keys/#types-of-auth-keys\\\"\u003eOne-off ephemeral auth keys\u003c/a\u003e actually create ephemeral nodes\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003e\u003ccode\u003eautogroup:self\u003c/code\u003e\u003c/a\u003e for users with mixed case accounts (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/3954\\\"\u003e#3954\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-02-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-09.mdx\",\"title\":\"Tailscale v1.20.4\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.20.4\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDNS lookups via an exit node in many cases\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eBetter handling of extremely large \u003ccode\u003e/proc/net/route\u003c/code\u003e files for\\nvery large routers\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eBGP advertisement with subnet router failover\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eOpenBSD\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eopenresolv \u003ccode\u003e/etc/resolv.conf\u003c/code\u003e handling\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-02-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-04.mdx\",\"title\":\"Disable node key expiry via API\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/api.md#device-key-post\\\"\u003eDisable node key expiry via API\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1338/acl-edit/#preview-changes\\\"\u003ePreview rules\u003c/a\u003e in the admin console for tagged nodes\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-02-04\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-02-01.mdx\",\"title\":\"ACL tags General Availability\",\"kind\":\"service\",\"link\":\"/blog/acl-tags-ga\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ca href=\\\"/kb/1068/acl-tags/\\\"\u003eACL tags\u003c/a\u003e (\u003ca href=\\\"/kb/1167/release-stages/#general-availability-ga\\\"\u003egenerally available\u003c/a\u003e)\\n\u003cul\u003e\\n\u003cli\u003eYou can include tags as part of an authentication key, you can tag devices from the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/machines\\\"\u003eMachines\u003c/a\u003e\u003c/strong\u003e page of the admin console, and tags can be owners of other tags. You must authenticate when re-tagging a device.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003e\u003ca href=\\\"/kb/1338/acl-edit/#preview-changes\\\"\u003ePreview rules\u003c/a\u003e in the admin console for a user without any nodes\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-02-01\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-01-28.mdx\",\"title\":\"Tagged devices are managed by a tag, not a user\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eA device tagged with an \u003ca href=\\\"/kb/1068/acl-tags\\\"\u003eACL tag\u003c/a\u003e is associated with the tag applied to it, not with the user who authenticated the device\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eTagged devices are listed under \\\"Tagged Devices\\\" in the list of Network devices in Tailscale clients\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eUsers cannot use Taildrop to send files to and from nodes they have tagged\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eA user without any nodes can be specified as part of \u003ca href=\\\"/kb/1337/acl-syntax/#tests\\\"\u003ean ACL test\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-01-28\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-01-26.mdx\",\"title\":\"Tailscale v1.20.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.20.3\",\"content\":\"\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eUI issues in Synology (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/3811\\\"\u003eSynology 1.20.2 doesn’t have working options page\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003cp\u003eOnly the Synology client released v1.20.3. All other platforms remain with v1.20.2.\u003c/p\u003e\\n\",\"date\":\"2022-01-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-01-21-admin.mdx\",\"title\":\"Self-serve Synology packages\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSelf-serve \u003ca href=\\\"/kb/1131/synology\\\"\u003eSynology packages\u003c/a\u003e are now available on \u003ca href=\\\"https://pkgs.tailscale.com\\\"\u003epkgs.tailscale.com\u003c/a\u003e.\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-01-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-01-21-client.mdx\",\"title\":\"Tailscale v1.20.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.20.2\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eMemory footprint growth in userspace-networking mode (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/3762\\\"\u003enetstack: leaking packet buffers tailscale #3762\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eUserspace-networking will accept a TCP SYN with ECN bits set (\u003ca href=\\\"https://github.com/tailscale/tailscale/issues/2642\\\"\u003ext-userspace-networking incoming TCP doesn't always work right away tailscale #2642\u003c/a\u003e)\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eSaving resolver list for OpenBSD\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-01-21\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-01-20.mdx\",\"title\":\"Delete single user tailnets\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1237/delete-tailnet\\\"\u003eDelete your tailnet\u003c/a\u003e from the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings/general\\\"\u003eSettings\u003c/a\u003e\u003c/strong\u003e page of admin console if it only has one user. \u003ca href=\\\"/contact/support\\\"\u003eContact support\u003c/a\u003e for other requests\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-01-20\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-01-13.mdx\",\"title\":\"Tailscale v1.20.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.20.1\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDeadlock in handling the DERP map\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2022-01-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2022/2022-01-12.mdx\",\"title\":\"Tailscale v1.20\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.20.0\",\"content\":\"$43\",\"date\":\"2022-01-12\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-12-17.mdx\",\"title\":\"Auth keys with ACL tags\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1068/tags#best-practices\\\"\u003eAuth keys can include an ACL tag binding\u003c/a\u003e, so that when a device is authenticated, the tags are applied\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1068/tags\\\"\u003eACL tags can be applied by an Owner, Admin, or Network admin from the admin console\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1068/tags#apply-a-tag-from-another-tag\\\"\u003eA tag can be the owner of another tag\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAuth keys can be generated via \u003ca href=\\\"https://github.com/tailscale/tailscale/blob/main/api.md#tailnet-keys-post\\\"\u003eAPI\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-12-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-12-15.mdx\",\"title\":\"Tailscale v1.18.2\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.18.2\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePermit protocols other than TCP, UDP, or SCTP if an \u003ca href=\\\"/kb/1337/acl-syntax/#acls\\\"\u003eACL rule\u003c/a\u003e has a \u003ccode\u003eproto\u003c/code\u003e specified and allows \u003ccode\u003e*\u003c/code\u003e port range\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eExit node selection takes effect (almost) immediately\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eIn DNS DirectManager, allow comments at the end of a line\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDon't get stuck waiting for systemd-resolved to restart in one particular DNS configuration\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1418/taildrop-nas#set-up-taildrop-on-synology\\\"\u003eReceive Taildrop files\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-12-15\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-12-09.mdx\",\"title\":\"Autogroup:self\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eACLs can now use \u003ca href=\\\"/kb/1337/acl-syntax/#autogroups\\\"\u003e\u003ccode\u003eautogroup:self\u003c/code\u003e\u003c/a\u003e to write access rules to allow access to devices authenticated as the same user as the source IP address\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-12-09\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-11-25.mdx\",\"title\":\"Tailscale v1.18.1\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.18.1\",\"content\":\"\u003ch6\u003eLinux\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eRegressions on some kernel configs related to our direct use of netlink rather than using the \u003ccode\u003eip\u003c/code\u003e command to program routes and policy routing\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-11-25\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-11-22.mdx\",\"title\":\"Additional admin roles\",\"kind\":\"service\",\"link\":\"/blog/admin-roles/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1138/user-roles\\\"\u003eUser roles\u003c/a\u003e for Network admin, IT admin, and Auditor\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-11-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-11-19.mdx\",\"title\":\"ARM and ARM64 container images\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003earm and arm64 container images on \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e and in \u003ca href=\\\"https://github.com/orgs/tailscale/packages/container/package/tailscale\\\"\u003eGitHub Packages\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-11-19\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-11-18.mdx\",\"title\":\"Tailscale v1.18\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":1.18,\"content\":\"$44\",\"date\":\"2021-11-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-11-08.mdx\",\"title\":\"Homebrew\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAvailable as a formula in \u003ca href=\\\"https://formulae.brew.sh/formula/tailscale\\\"\u003eHomebrew\u003c/a\u003e (Thanks!)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-11-08\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-11-03.mdx\",\"title\":\"Okta Integration Network\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eAvailable in the \u003ca href=\\\"https://www.okta.com/integrations/tailscale/\\\"\u003eOkta Integration Network\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-11-03\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-27.mdx\",\"title\":\"Suspended and inactive users\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUsers can be \u003ca href=\\\"/kb/1145/remove-team-members/#suspending-users\\\"\u003esuspended and restored\u003c/a\u003e from the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003eUsers\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eUsers who are \u003ca href=\\\"/kb/1145/remove-team-members/#managing-idle-users\\\"\u003einactive\u003c/a\u003e are shown in \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/users\\\"\u003eUsers\u003c/a\u003e\u003c/strong\u003e page of the admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-10-27\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-26.mdx\",\"title\":\"IPv4 addresses for ephemeral nodes\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eEphemeral nodes now have both IPv6 and IPv4 addresses\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-10-26\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-18.mdx\",\"title\":\"Synology Package Center\",\"kind\":\"service\",\"link\":\"/blog/tailscale-synology-package/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eOfficially supported in the \u003ca href=\\\"https://www.synology.com/en-global/dsm/packages/Tailscale\\\"\u003eSynology package center\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-10-18\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-13.mdx\",\"title\":\"Published container image\",\"kind\":\"service\",\"link\":\"/blog/kubecon-21/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003ePublished Tailscale container image available on \u003ca href=\\\"https://hub.docker.com/r/tailscale/tailscale\\\"\u003eDocker Hub\u003c/a\u003e and in \u003ca href=\\\"https://github.com/orgs/tailscale/packages/container/package/tailscale\\\"\u003eGitHub Packages\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-10-13\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-07-admin.mdx\",\"title\":\"Authentication settings\",\"kind\":\"service\",\"link\":\"/blog/authentication-settings/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eEnable \u003ca href=\\\"/kb/1099/device-authorization\\\"\u003edevice authorization\u003c/a\u003e from the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings/general\\\"\u003eSettings\u003c/a\u003e\u003c/strong\u003e page of admin console\u003c/li\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSet \u003ca href=\\\"/kb/1028/key-expiry\\\"\u003ekey expiry\u003c/a\u003e from the \u003cstrong\u003e\u003ca href=\\\"https://login.tailscale.com/admin/settings/general\\\"\u003eSettings\u003c/a\u003e\u003c/strong\u003e page of admin console\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-10-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-07-client.mdx\",\"title\":\"Tailscale v1.16\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":1.16,\"content\":\"$45\",\"date\":\"2021-10-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-06.mdx\",\"title\":\"QR code for login link\",\"kind\":\"service\",\"link\":\"\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eSpecify \u003ccode\u003e--qr\u003c/code\u003e as part of \u003ca href=\\\"/kb/1241/tailscale-up\\\"\u003e\u003ccode\u003etailscale up\u003c/code\u003e\u003c/a\u003e to generate a QR code for the login URL\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-10-06\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-10-01.mdx\",\"title\":\"Service Updates\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.14.6\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eInclude Let's Encrypt's ISRG Root X1 root as an alternate to try if the platform roots fail\u003c/li\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eIf tailscale cert fails because it needs to be run as root, say so.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAvoid looping packets in tstun, believed to fix \u003ca href=\\\"https://github.com/tailscale/tailscale/issues/1526\\\"\u003e#1526\u003c/a\u003e\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eAllow SOCKS5 proxy for \u003ccode\u003e--tun=userspace-networking\u003c/code\u003e to dial the HTTPS domain name of the Tailnet\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eEnsure state directory is set to perm 0700.\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eiOS\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eIgnore ipsec link monitor events for iOS to avoid waking the system\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-10-01\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-09-24.mdx\",\"title\":\"Service Updates\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.14.4\",\"content\":\"\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003eMove state files from C:\\\\Windows to C:\\\\ProgramData, to better handle Windows\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eSynology\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eFix segfaults shortly after starting, resolves \u003ca href=\\\"https://github.com/tailscale/tailscale/issues/2733\\\"\u003e#2733\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-09-24\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-09-22.mdx\",\"title\":\"HTTPS certificates\",\"kind\":\"service\",\"link\":\"/blog/tls-certs/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eProvision \u003ca href=\\\"/kb/1153/enabling-https\\\"\u003eTLS certificates\u003c/a\u003e for devices in your tailnet (\u003ca href=\\\"/kb/1167/release-stages/#beta\\\"\u003ebeta\u003c/a\u003e)\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-09-22\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-09-17.mdx\",\"title\":\"Community on GitHub plan\",\"kind\":\"service\",\"link\":\"/blog/community-github-pricing/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003eFree \u003ca href=\\\"/kb/1154/free-plans-discounts/#community-on-github\\\"\u003eCommunity on GitHub pricing plan\u003c/a\u003e for GitHub organizations using Tailscale for open source projects, families, and friends\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-09-17\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-09-16.mdx\",\"title\":\"Tailscale v1.14.3\",\"kind\":\"client\",\"link\":\"\",\"clientVersion\":\"1.14.3\",\"content\":\"\u003ch6\u003eAll Platforms\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"changed\\\"\u003e\u003ccode\u003etailscale up\u003c/code\u003e will wait for the socket to tailscaled to be created, not exit with an error. It should no longer be necessary to run it in a loop.\u003c/li\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eCrash in TCP forwarding with userspace-networking; resolves \u003ca href=\\\"https://github.com/tailscale/tailscale/issues/2658\\\"\u003e#2658\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003ch6\u003eWindows\u003c/h6\u003e\\n\u003cul\u003e\\n\u003cli data-change=\\\"fixed\\\"\u003eDefault route lookup on Windows; resolves \u003ca href=\\\"https://github.com/tailscale/tailscale/issues/2707\\\"\u003e#2707\u003c/a\u003e\u003c/li\u003e\\n\u003c/ul\u003e\\n\u003cp\u003e\u003cem\u003eNote: v1.14.1 and v1.14.2 were never released.\u003c/em\u003e\u003c/p\u003e\\n\",\"date\":\"2021-09-16\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-09-07-device-auth.mdx\",\"title\":\"Device authorization by API\",\"kind\":\"service\",\"link\":\"https://github.com/tailscale/tailscale/blob/main/api.md#device-authorized-post\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"/kb/1099/device-authorization\\\"\u003eDevice authorization\u003c/a\u003e is available in the API\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-09-07\"},{\"filename\":\"/vercel/path0/nextjs/src/data/changelog/2021/2021-09-07.mdx\",\"title\":\"GitHub Actions marketplace\",\"kind\":\"service\",\"link\":\"/blog/2021-09-github-actions-marketplace/\",\"clientVersion\":\"No Version\",\"content\":\"\u003cul\u003e\\n\u003cli data-change=\\\"new\\\"\u003e\u003ca href=\\\"https://github.com/marketplace/actions/connect-tailscale\\\"\u003eConnect Tailscale action\u003c/a\u003e available in GitHub Marketplace\u003c/li\u003e\\n\u003c/ul\u003e\\n\",\"date\":\"2021-09-07\"}]}]}]]}]]\n"])</script><script>self.__next_f.push([1,"46:I[72424,[\"2972\",\"static/chunks/2972-04611c7b37409cb4.js\",\"4302\",\"static/chunks/4302-c45bec305c844d62.js\",\"8003\",\"static/chunks/8003-0833c71e6161cb44.js\",\"8650\",\"static/chunks/8650-0409a4c5d9e604e6.js\",\"919\",\"static/chunks/919-dccbcd839ca206cc.js\",\"3041\",\"static/chunks/app/(marketing)/layout-9b4adc9075c01155.js\"],\"CurrentUserProvider\"]\n47:I[60908,[\"2972\",\"static/chunks/2972-04611c7b37409cb4.js\",\"4302\",\"static/chunks/4302-c45bec305c844d62.js\",\"8003\",\"static/chunks/8003-0833c71e6161cb44.js\",\"8650\",\"static/chunks/8650-0409a4c5d9e604e6.js\",\"919\",\"static/chunks/919-dccbcd839ca206cc.js\",\"3041\",\"static/chunks/app/(marketing)/layout-9b4adc9075c01155.js\"],\"default\"]\n4c:I[72972,[\"2972\",\"static/chunks/2972-04611c7b37409cb4.js\",\"4302\",\"static/chunks/4302-c45bec305c844d62.js\",\"8003\",\"static/chunks/8003-0833c71e6161cb44.js\",\"8650\",\"static/chunks/8650-0409a4c5d9e604e6.js\",\"919\",\"static/chunks/919-dccbcd839ca206cc.js\",\"3041\",\"static/chunks/app/(marketing)/layout-9b4adc9075c01155.js\"],\"\"]\n48:{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"}\n49:{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"padding\":\"0 23px 0 0\",\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\",\"lineHeight\":\"49px\"}\n4a:{\"display\":\"inline-block\"}\n4b:{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"49px\",\"margin\":0}\n4d:T820,"])</script><script>self.__next_f.push([1,"M19.9516 10.8781C19.7667 9.48128 18.5693 8.38051 17.1498 8.16721C16.9104 8.13117 16.003 8 13.9011 8H13.8854C11.7829 8 11.3319 8.13117 11.0924 8.16721C9.71243 8.3746 8.45223 9.3637 8.14648 10.777C7.99942 11.4731 7.98373 12.2447 8.01105 12.9526C8.04999 13.9677 8.05755 14.981 8.14823 15.992C8.21091 16.6635 8.32027 17.3297 8.47548 17.9855C8.76612 19.1968 9.94262 20.2048 11.0953 20.616C12.3294 21.0449 13.6566 21.1161 14.9282 20.8216C15.0681 20.7886 15.2065 20.7502 15.3432 20.7064C15.6519 20.6066 16.014 20.4949 16.2803 20.2987C16.2839 20.296 16.2869 20.2924 16.289 20.2883C16.2911 20.2842 16.2923 20.2797 16.2925 20.2751V19.2955C16.2924 19.2911 16.2914 19.2869 16.2895 19.283C16.2876 19.2791 16.2849 19.2758 16.2815 19.2731C16.2782 19.2704 16.2743 19.2686 16.2702 19.2676C16.266 19.2667 16.2617 19.2667 16.2576 19.2677C15.4429 19.4655 14.608 19.5647 13.7703 19.5631C12.3288 19.5631 11.941 18.8677 11.83 18.5782C11.7408 18.3279 11.6841 18.0669 11.6614 17.8018C11.6612 17.7973 11.662 17.7929 11.6638 17.7888C11.6656 17.7847 11.6683 17.7811 11.6717 17.7783C11.6751 17.7755 11.6791 17.7735 11.6834 17.7726C11.6876 17.7716 11.6921 17.7717 11.6963 17.7728C12.4975 17.9693 13.3188 18.0685 14.1429 18.0682C14.3411 18.0682 14.5387 18.0682 14.737 18.0629C15.5659 18.0393 16.4395 17.9962 17.255 17.8343C17.2754 17.8301 17.2957 17.8266 17.3132 17.8213C18.5995 17.5701 19.8237 16.7819 19.9481 14.786C19.9527 14.7074 19.9644 13.963 19.9644 13.8814C19.965 13.6043 20.0521 11.9156 19.9516 10.8781ZM17.9718 15.8584H16.6191V12.4905C16.6191 11.7815 16.3285 11.4199 15.7373 11.4199C15.0875 11.4199 14.762 11.8477 14.762 12.6926V14.5361H13.4175V12.6926C13.4175 11.8477 13.0914 11.4199 12.4415 11.4199C11.8538 11.4199 11.5603 11.7815 11.5597 12.4905V15.8584H10.2083V12.3883C10.2083 11.6793 10.3863 11.116 10.7425 10.6985C11.1098 10.2819 11.5917 10.068 12.1898 10.068C12.8821 10.068 13.4053 10.3386 13.754 10.8793L14.0906 11.4536L14.4277 10.8793C14.7765 10.3386 15.2996 10.068 15.9908 10.068C16.5883 10.068 17.0702 10.2819 17.4387 10.6985C17.7949 11.1156 17.9729 11.6789 17.9729 12.3883L17.9718 15.8584Z"])</script><script>self.__next_f.push([1,"e:[[\"$\",\"$L46\",null,{\"children\":[\"$\",\"$L47\",null,{\"menu\":[{\"_key\":\"95381f81d527\",\"title\":\"Product\",\"submenu\":{\"product\":{\"rightCol\":{\"nav\":{\"heading\":\"Explore\",\"links\":[{\"link\":\"/integrations\",\"_key\":\"c653da519dfb\",\"title\":\"Integrations\"},{\"link\":\"/features\",\"_key\":\"a878da5fa54c\",\"title\":\"Features\"},{\"link\":\"/compare\",\"_key\":\"adda698ed879\",\"title\":\"Compare Tailscale\"},{\"link\":\"/community/community-projects\",\"_key\":\"3341bd9805df\",\"title\":\"Community Projects\"},{\"link\":\"/partnerships\",\"_key\":\"b57369965809\",\"title\":\"Partnerships\"}]}},\"leftCol\":{\"topNav\":{\"heading\":\"Meet Tailscale\",\"links\":[{\"icon\":{\"_type\":\"sanityImage\",\"alt\":\"icon\"},\"link\":\"/blog/how-tailscale-works/\",\"_key\":\"5495d201056a\",\"title\":\"How it works\"},{\"title\":\"Why Tailscale\",\"icon\":{\"_type\":\"sanityImage\",\"alt\":\"icon\"},\"link\":\"/why-tailscale\",\"_key\":\"dc9cde7ff83cb94cfc98ff29bdcd0997\"},{\"_key\":\"5d88e3ffcc6b\",\"title\":\"WireGuard® for Enterprises\",\"icon\":{\"_type\":\"sanityImage\",\"alt\":\"WireGuard®\"},\"link\":\"/wireguard-vpn\"},{\"_key\":\"435de37ddd5f\",\"title\":\"Bring Tailscale to Work\",\"icon\":{\"_type\":\"sanityImage\",\"alt\":\"Bring Tailscale to Work\"},\"link\":\"/bring-tailscale-to-work\"}]}}},\"submenuType\":\"product\"},\"hasSubmenu\":true},{\"hasSubmenu\":true,\"_key\":\"a7062f1924df\",\"title\":\"Solutions\",\"submenu\":{\"product\":{\"rightCol\":{\"nav\":{\"heading\":\"By role\",\"links\":[{\"link\":\"/solutions/devops\",\"_key\":\"502a00f49baf\",\"title\":\"DevOps\"},{\"_key\":\"0fe4c0d6fa83\",\"title\":\"IT\",\"link\":\"/solutions/it\"},{\"link\":\"/solutions/security\",\"_key\":\"026f30b876a7\",\"title\":\"Security\"}]}},\"leftCol\":{\"topNav\":{\"heading\":\"By use-case\",\"links\":[{\"link\":\"/use-cases/remote-access\",\"_key\":\"193eaaa0cef8\",\"title\":\"Remote Access\"},{\"link\":\"/use-cases/site-to-site-networking\",\"_key\":\"05cadfcf3e65b04708a9d88060f68f9e\",\"title\":\"Site-to-site Networking\"},{\"link\":\"/use-cases/multi-cloud-networking\",\"_key\":\"fbd28dffeac0\",\"title\":\"Multi-Cloud Networking\"},{\"_key\":\"da202f1d966a\",\"title\":\"Kubernetes Networking\",\"link\":\"/use-cases/kubernetes\"},{\"link\":\"/use-cases/iot\",\"_key\":\"8c78e633c6b1\",\"title\":\"Edge \u0026 IoT Deployments\"},{\"link\":\"/use-cases/zero-trust-networking\",\"_key\":\"6a363d694952\",\"title\":\"Zero Trust Networking\"},{\"link\":\"/use-cases/ai\",\"_key\":\"9c49b97d6b06\",\"title\":\"AI Workloads\"},{\"link\":\"/use-cases/secure-saas\",\"_key\":\"2602b548bd52\",\"title\":\"Secure SaaS\"},{\"_key\":\"6fc65e9fe1c6\",\"title\":\"Business VPN\",\"link\":\"/use-cases/business-vpn\"},{\"title\":\"Homelab\",\"link\":\"/use-cases/homelab\",\"_key\":\"d99d14013ab3\"}]}}},\"submenuType\":\"product\"}},{\"hasSubmenu\":false,\"_key\":\"fd055b16290df04c6012d0d33c2fad13\",\"title\":\"Enterprise\",\"submenu\":{\"submenuType\":\"product\"},\"link\":\"/enterprise\"},{\"hasSubmenu\":false,\"_key\":\"b595975539c7407a7ed4510edd549223\",\"title\":\"Customers\",\"submenu\":{\"submenuType\":\"product\",\"product\":{\"leftCol\":{\"topNav\":{\"heading\":\"Nav heading here\",\"links\":[{\"description\":\"How Cribl Enables Secure Work From Anywhere with Tailscale\",\"_key\":\"2d22491d8262\",\"title\":\"Title here\",\"icon\":{\"_type\":\"sanityImage\",\"alt\":\"Alt text \",\"asset\":{\"_ref\":\"image-a06dc612b1e3e4f4df53a72030002600639a8738-300x120-png\",\"_type\":\"reference\"}},\"link\":\"https://tailscale.com/customers\"}]}}},\"resources\":{\"topNav\":[{\"heading\":\"Cribl\",\"description\":\"How Cribl Enables Secure Work From Anywhere with Tailscale\",\"_key\":\"61d0f0cb130e\"},{\"heading\":\"Cribl\",\"description\":\"How Cribl Enables Secure Work From Anywhere with Tailscale\",\"_key\":\"712684d509a6a6ea07ab9401bdb23f8f\"},{\"heading\":\"Cribl\",\"description\":\"How Cribl Enables Secure Work From Anywhere with Tailscale\",\"_key\":\"ceac3f234a3a6923a671af91772b7e8b\"}]}},\"link\":\"/customers\"},{\"_key\":\"f06fabeb084c\",\"title\":\"Docs\",\"submenu\":{\"submenuType\":\"product\"},\"link\":\"/kb/1017/install/\",\"hasSubmenu\":false},{\"title\":\"Blog\",\"submenu\":{\"submenuType\":\"product\"},\"link\":\"/blog\",\"hasSubmenu\":false,\"_key\":\"f2537b6fa068\"},{\"title\":\"Pricing\",\"submenu\":{\"submenuType\":\"product\"},\"link\":\"/pricing\",\"hasSubmenu\":false,\"_key\":\"e1b7b44dc091\"}],\"footerData\":\"$undefined\",\"headerStyle\":\"dark\",\"button\":{\"buttonOptions\":{\"color\":\"black\"},\"_type\":\"button\",\"link\":{\"title\":\"Get started - it's free!\",\"url\":\"https://login.tailscale.com/start\"}}}]}],[\"$\",\"main\",null,{\"className\":\"container\",\"children\":[\"$\",\"$Lc\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\",\"(marketing)\",\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$Ld\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":\"$48\",\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":\"$49\",\"children\":\"404\"}],[\"$\",\"div\",null,{\"style\":\"$4a\",\"children\":[\"$\",\"h2\",null,{\"style\":\"$4b\",\"children\":\"This page could not be found.\"}]}]]}]}]],\"notFoundStyles\":[]}]}],[\"$\",\"footer\",null,{\"className\":\"pb-16 pt-5 md:pb-28 md:pt-20 \",\"children\":[[\"$\",\"div\",null,{\"className\":\"container grid gap-x-4 gap-y-8 pb-8 xxs:grid-cols-2 sm:grid-cols-3 sm:gap-5 md:pb-[110px] lg:grid-cols-6\",\"children\":[[\"$\",\"div\",null,{\"children\":[[\"$\",\"p\",null,{\"className\":\"t-16 !leading-[1.05] text-heading-black\",\"children\":\"Product\"}],[\"$\",\"div\",null,{\"className\":\"mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4\",\"children\":[[\"$\",\"$L4c\",\"Product/blog/how-tailscale-works/\",{\"href\":\"/blog/how-tailscale-works/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"How it works\"}}],[\"$\",\"$L4c\",\"Product/pricing\",{\"href\":\"/pricing\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Pricing\"}}],[\"$\",\"$L4c\",\"Product/integrations\",{\"href\":\"/integrations\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Integrations\"}}],[\"$\",\"$L4c\",\"Product/features\",{\"href\":\"/features\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Features\"}}],[\"$\",\"$L4c\",\"Product/compare\",{\"href\":\"/compare\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Compare Tailscale\"}}]]}]]}],[\"$\",\"div\",null,{\"children\":[[\"$\",\"p\",null,{\"className\":\"t-16 !leading-[1.05] text-heading-black\",\"children\":\"Use Cases\"}],[\"$\",\"div\",null,{\"className\":\"mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4\",\"children\":[[\"$\",\"$L4c\",\"Use Cases/use-cases/business-vpn\",{\"href\":\"/use-cases/business-vpn\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Business VPN\"}}],[\"$\",\"$L4c\",\"Use Cases/use-cases/remote-access\",{\"href\":\"/use-cases/remote-access\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Remote Access\"}}],[\"$\",\"$L4c\",\"Use Cases/use-cases/site-to-site-networking\",{\"href\":\"/use-cases/site-to-site-networking\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Site-to-Site Networking\"}}],[\"$\",\"$L4c\",\"Use Cases/use-cases/homelab\",{\"href\":\"/use-cases/homelab\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Homelab\"}}],[\"$\",\"$L4c\",\"Use Cases/enterprise\",{\"href\":\"/enterprise\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Enterprise\"}}]]}]]}],[\"$\",\"div\",null,{\"children\":[[\"$\",\"p\",null,{\"className\":\"t-16 !leading-[1.05] text-heading-black\",\"children\":\"Resources\"}],[\"$\",\"div\",null,{\"className\":\"mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4\",\"children\":[[\"$\",\"$L4c\",\"Resources/blog\",{\"href\":\"/blog\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Blog\"}}],[\"$\",\"$L4c\",\"Resources/events-webinars\",{\"href\":\"/events-webinars\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Events \u0026 Webinars\"}}],[\"$\",\"$L4c\",\"Resources/partnerships\",{\"href\":\"/partnerships\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Partnerships\"}}]]}]]}],[\"$\",\"div\",null,{\"children\":[[\"$\",\"p\",null,{\"className\":\"t-16 !leading-[1.05] text-heading-black\",\"children\":\"Company\"}],[\"$\",\"div\",null,{\"className\":\"mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4\",\"children\":[[\"$\",\"$L4c\",\"Company/company\",{\"href\":\"/company\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Company\"}}],[\"$\",\"$L4c\",\"Company/careers\",{\"href\":\"/careers\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Careers\"}}],[\"$\",\"$L4c\",\"Company/press\",{\"href\":\"/press\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Press\"}}]]}]]}],[\"$\",\"div\",null,{\"children\":[[\"$\",\"p\",null,{\"className\":\"t-16 !leading-[1.05] text-heading-black\",\"children\":\"Help \u0026 Support\"}],[\"$\",\"div\",null,{\"className\":\"mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4\",\"children\":[[\"$\",\"$L4c\",\"Help \u0026 Support/contact/support\",{\"href\":\"/contact/support\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Support\"}}],[\"$\",\"$L4c\",\"Help \u0026 Support/contact/sales\",{\"href\":\"/contact/sales\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Sales\"}}],[\"$\",\"$L4c\",\"Help \u0026 Support/security\",{\"href\":\"/security\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Security\"}}],[\"$\",\"$L4c\",\"Help \u0026 Support/legal\",{\"href\":\"/legal\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Legal\"}}],[\"$\",\"$L4c\",\"Help \u0026 Support/opensource\",{\"href\":\"/opensource\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Open Source\"}}],[\"$\",\"$L4c\",\"Help \u0026 Support/changelog\",{\"href\":\"/changelog\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Changelog\"}}]]}]]}],[\"$\",\"div\",null,{\"children\":[[\"$\",\"p\",null,{\"className\":\"t-16 !leading-[1.05] text-heading-black\",\"children\":\"Learn\"}],[\"$\",\"div\",null,{\"className\":\"mt-4 flex flex-col gap-3 lg:mt-8 lg:gap-4\",\"children\":[[\"$\",\"$L4c\",\"Learn/learn/generate-ssh-keys/\",{\"href\":\"/learn/generate-ssh-keys/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"SSH keys\"}}],[\"$\",\"$L4c\",\"Learn/learn/ssh-into-docker-container/\",{\"href\":\"/learn/ssh-into-docker-container/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Docker SSH\"}}],[\"$\",\"$L4c\",\"Learn/learn/devsecops/\",{\"href\":\"/learn/devsecops/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"DevSecOps\"}}],[\"$\",\"$L4c\",\"Learn/learn/multicloud/\",{\"href\":\"/learn/multicloud/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Multicloud\"}}],[\"$\",\"$L4c\",\"Learn/blog/how-nat-traversal-works/\",{\"href\":\"/blog/how-nat-traversal-works/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"NAT Traversal\"}}],[\"$\",\"$L4c\",\"Learn/blog/2021-09-private-dns-with-magicdns/\",{\"href\":\"/blog/2021-09-private-dns-with-magicdns/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"MagicDNS\"}}],[\"$\",\"$L4c\",\"Learn/learn/privileged-access-management/\",{\"href\":\"/learn/privileged-access-management/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"PAM\"}}],[\"$\",\"$L4c\",\"Learn/learn/principle-of-least-privilege/\",{\"href\":\"/learn/principle-of-least-privilege/\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"PoLP\"}}],[\"$\",\"$L4c\",\"Learn/learn\",{\"href\":\"/learn\",\"className\":\"text-[14px] !leading-[1.05] !tracking-[0.08px] transition-colors duration-300 md:text-[16px] text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"All articles\"}}]]}]]}]]}],[\"$\",\"div\",null,{\"className\":\"container\",\"children\":[\"$\",\"div\",null,{\"className\":\"border-stroke-gray-100 grid grid-cols-1 gap-x-5 gap-y-8 border-t pt-8 xxs:grid-cols-2 md:grid-cols-12 md:pt-[70px] lg:gap-y-[60px]\",\"children\":[[\"$\",\"div\",null,{\"className\":\"xxs:col-span-2 md:col-span-4\",\"children\":[\"$\",\"$L4c\",null,{\"href\":\"/\",\"className\":\"block w-[160px]\",\"title\":\"Homepage\",\"data-track\":\"Link Clicked\",\"data-track-properties\":\"{\\\"label\\\": \\\"Footer logo\\\"}\",\"children\":[\"$\",\"svg\",null,{\"className\":\"transition-colors duration-200 \",\"width\":\"100%\",\"height\":\"100%\",\"viewBox\":\"0 0 110 20\",\"fill\":\"none\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"children\":[[\"$\",\"ellipse\",null,{\"cx\":\"2.44719\",\"cy\":\"10.1796\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"cx\":\"9.79094\",\"cy\":\"10.1796\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"opacity\":\"0.2\",\"cx\":\"2.44719\",\"cy\":\"17.5077\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"opacity\":\"0.2\",\"cx\":\"17.1269\",\"cy\":\"17.5077\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"cx\":\"9.79094\",\"cy\":\"17.5077\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"cx\":\"17.1269\",\"cy\":\"10.1796\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"opacity\":\"0.2\",\"cx\":\"2.44719\",\"cy\":\"2.85924\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"opacity\":\"0.2\",\"cx\":\"9.79094\",\"cy\":\"2.85924\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"ellipse\",null,{\"opacity\":\"0.2\",\"cx\":\"17.1269\",\"cy\":\"2.85924\",\"rx\":\"2.44719\",\"ry\":\"2.44128\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M34.3979 18.458C35.0907 18.458 35.6536 18.3933 36.3248 18.2637V15.7584C35.9134 15.9096 35.4588 15.9528 35.0258 15.9528C33.965 15.9528 33.5753 15.4344 33.5753 14.441V9.34402H36.3248V6.83875H33.5753V3.12403H30.5443V6.83875H28.5742V9.34402H30.5443V14.7217C30.5443 17.0974 31.8 18.458 34.3979 18.458Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M41.2747 18.458C42.8984 18.458 43.9809 17.9181 44.5222 17.0758C44.5655 17.443 44.6954 17.9397 44.8686 18.2421H47.5964C47.4449 17.7237 47.3366 16.903 47.3366 16.3631V10.4455C47.3366 8.005 45.583 6.62277 42.617 6.62277C40.3654 6.62277 38.6118 7.46507 37.6376 8.69611L39.3696 10.4023C40.149 9.5384 41.1448 9.08486 42.3572 9.08486C43.8294 9.08486 44.4789 9.58159 44.4789 10.3159C44.4789 10.9422 44.0459 11.3742 41.7077 11.3742C39.4562 11.3742 37.183 12.3028 37.183 14.8945C37.183 17.2918 38.9149 18.458 41.2747 18.458ZM41.8809 16.1687C40.7118 16.1687 40.1706 15.672 40.1706 14.7865C40.1706 14.009 40.8201 13.4907 41.9026 13.4907C43.6345 13.4907 44.1108 13.3827 44.4789 13.0155V13.9442C44.4789 15.1753 43.4397 16.1687 41.8809 16.1687Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M49.3069 5.39173H52.4677V2.5625H49.3069V5.39173ZM49.3718 18.2421H52.4028V6.83875H49.3718V18.2421Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M54.6109 18.2421H57.6418V2.90805H54.6109V18.2421Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M63.9416 18.458C67.2757 18.458 68.986 16.7087 68.986 14.8729C68.986 13.2099 68.1417 11.9789 65.3705 11.4821C63.4221 11.1366 62.2097 10.7046 62.2097 10.0351C62.2097 9.45201 62.9025 9.04166 64.0715 9.04166C65.1107 9.04166 65.9767 9.38722 66.6262 10.1431L68.553 8.52333C67.5788 7.31389 65.9767 6.62277 64.0715 6.62277C61.1489 6.62277 59.3303 8.17777 59.3303 10.0783C59.3303 12.1517 61.2354 13.0803 63.2922 13.4475C65.0025 13.7499 65.9551 14.0738 65.9551 14.8081C65.9551 15.4344 65.2839 15.9528 64.0066 15.9528C62.7509 15.9528 61.7767 15.3696 61.322 14.5058L58.7674 15.7152C59.3952 17.2702 61.5385 18.458 63.9416 18.458Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M75.7621 18.458C77.9271 18.458 79.4859 17.5942 80.6549 15.6504L78.2302 14.4194C77.7755 15.3265 77.0395 15.9528 75.7621 15.9528C73.8353 15.9528 72.7961 14.3978 72.7961 12.5188C72.7961 10.6399 73.9003 9.12805 75.7621 9.12805C76.9312 9.12805 77.7106 9.75437 78.1652 10.7046L80.6116 9.40882C79.7889 7.61625 78.1652 6.62277 75.7621 6.62277C71.8003 6.62277 69.7652 9.5168 69.7652 12.5188C69.7652 15.78 72.2333 18.458 75.7621 18.458Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M85.4829 18.458C87.1067 18.458 88.1891 17.9181 88.7304 17.0758C88.7737 17.443 88.9036 17.9397 89.0768 18.2421H91.8046C91.6531 17.7237 91.5448 16.903 91.5448 16.3631V10.4455C91.5448 8.005 89.7912 6.62277 86.8252 6.62277C84.5737 6.62277 82.8201 7.46507 81.8458 8.69611L83.5778 10.4023C84.3572 9.5384 85.353 9.08486 86.5654 9.08486C88.0376 9.08486 88.6871 9.58159 88.6871 10.3159C88.6871 10.9422 88.2541 11.3742 85.9159 11.3742C83.6644 11.3742 81.3912 12.3028 81.3912 14.8945C81.3912 17.2918 83.1231 18.458 85.4829 18.458ZM86.0891 16.1687C84.9201 16.1687 84.3788 15.672 84.3788 14.7865C84.3788 14.009 85.0283 13.4907 86.1108 13.4907C87.8427 13.4907 88.319 13.3827 88.6871 13.0155V13.9442C88.6871 15.1753 87.6479 16.1687 86.0891 16.1687Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M93.3263 18.2421H96.3573V2.90805H93.3263V18.2421Z\",\"fill\":\"#1F1E1E\"}],[\"$\",\"path\",null,{\"d\":\"M103.631 18.458C105.861 18.458 107.658 17.5726 108.654 15.996L106.359 14.5274C105.753 15.4776 104.952 15.996 103.631 15.996C102.138 15.996 101.055 15.1753 100.774 13.5771H109.39V12.5188C109.39 9.5168 107.55 6.62277 103.61 6.62277C99.8643 6.62277 97.8293 9.5384 97.8293 12.5404C97.8293 16.8167 101.055 18.458 103.631 18.458ZM100.882 11.2014C101.358 9.75437 102.354 9.08486 103.675 9.08486C105.168 9.08486 106.078 9.97034 106.381 11.2014H100.882Z\",\"fill\":\"#1F1E1E\"}]]}]}]}],[\"$\",\"div\",null,{\"className\":\"flex flex-col gap-[14px] md:col-span-2\",\"children\":[[\"$\",\"$L4c\",\"/terms\",{\"href\":\"/terms\",\"className\":\"t-14 !leading-[1.05] underline transition-colors duration-300 text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Terms of Service\"}}],[\"$\",\"$L4c\",\"/privacy-policy\",{\"href\":\"/privacy-policy\",\"className\":\"t-14 !leading-[1.05] underline transition-colors duration-300 text-heading-black/60 hover:text-gray-1000/100\",\"dangerouslySetInnerHTML\":{\"__html\":\"Privacy Policy\"}}]]}],[\"$\",\"div\",null,{\"className\":\"md:col-span-3\",\"children\":[\"$\",\"div\",null,{\"className\":\"t-14 max-w-[250px] !leading-[1.35] text-heading-black/60 \",\"dangerouslySetInnerHTML\":{\"__html\":\"WireGuard is a registered trademark of Jason A. Donenfeld.\"}}]}],[\"$\",\"div\",null,{\"className\":\"flex gap-[6px] xxs:col-span-2 md:col-span-3 md:flex md:justify-end\",\"children\":[[\"$\",\"$L4c\",null,{\"target\":\"_blank\",\"href\":\"https://twitter.com/tailscale\",\"className\":\"group transition-colors duration-300 text-heading-black hover:text-gray-200\",\"data-track\":\"Link Clicked\",\"data-track-properties\":\"{\\\"label\\\": \\\"Footer Twitter logo\\\"}\",\"children\":[\"$\",\"svg\",null,{\"width\":\"28\",\"height\":\"29\",\"viewBox\":\"0 0 28 29\",\"fill\":\"none\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"children\":[[\"$\",\"rect\",null,{\"y\":\"0.988281\",\"width\":\"28\",\"height\":\"28\",\"rx\":\"14\",\"fill\":\"currentColor\"}],[\"$\",\"path\",null,{\"className\":\" transition-colors duration-300 group-hover:fill-heading-black\",\"d\":\"M8.03169 9L13.0509 15.0672L8 20H9.13675L13.5587 15.6812L17.1317 20H21L15.6985 13.5916L20.3997 9H19.263L15.1906 12.9775L11.9001 9H8.03169ZM9.70337 9.75698H11.4805L19.3281 19.2429H17.551L9.70337 9.75698Z\",\"fill\":\"white\"}]]}]}],[\"$\",\"$L4c\",null,{\"target\":\"_blank\",\"href\":\"https://www.facebook.com/tailscale/\",\"className\":\"group transition-colors duration-300 text-heading-black hover:text-gray-200\",\"data-track\":\"Link Clicked\",\"data-track-properties\":\"{\\\"label\\\": \\\"Footer Facebook logo\\\"}\",\"children\":[\"$\",\"svg\",null,{\"width\":\"28\",\"height\":\"28\",\"viewBox\":\"0 0 28 28\",\"fill\":\"none\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"children\":[[\"$\",\"rect\",null,{\"x\":\"0.21875\",\"width\":\"27.2195\",\"height\":\"27.2195\",\"rx\":\"13.6098\",\"fill\":\"currentColor\"}],[\"$\",\"path\",null,{\"className\":\"transition-colors duration-300 group-hover:fill-heading-black\",\"d\":\"M12.434 19.6598L12.4179 14.8081H10.3008V12.7289H12.4179V11.3427C12.4179 9.47188 13.5974 8.57031 15.2966 8.57031C16.1106 8.57031 16.8101 8.62983 17.014 8.65643V10.6115L15.8355 10.612C14.9114 10.612 14.7324 11.0433 14.7324 11.6762V12.7289H17.3577L16.652 14.8081H14.7324V19.6598H12.434Z\",\"fill\":\"#fff\"}]]}]}],[\"$\",\"$L4c\",null,{\"target\":\"_blank\",\"href\":\"https://www.linkedin.com/company/tailscale\",\"className\":\"group transition-colors duration-300 text-heading-black hover:text-gray-200\",\"data-track\":\"Link Clicked\",\"data-track-properties\":\"{\\\"label\\\": \\\"Footer LinkedIn logo\\\"}\",\"children\":[\"$\",\"svg\",null,{\"width\":\"28\",\"height\":\"28\",\"viewBox\":\"0 0 28 28\",\"fill\":\"none\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"children\":[[\"$\",\"rect\",null,{\"x\":\"0.439453\",\"width\":\"27.2195\",\"height\":\"27.2195\",\"rx\":\"13.6098\",\"fill\":\"currentColor\"}],[\"$\",\"path\",null,{\"className\":\" transition-colors duration-300 group-hover:fill-heading-black\",\"d\":\"M8.68685 18.6518H10.8825V11.5871H8.68685V18.6518Z\",\"fill\":\"white\"}],[\"$\",\"path\",null,{\"className\":\" transition-colors duration-300 group-hover:fill-heading-black\",\"d\":\"M8.50195 9.34036C8.50195 10.0352 9.07976 10.6143 9.77312 10.6143C10.4896 10.6143 11.0443 10.0584 11.0443 9.34036C11.0443 8.64547 10.4665 8.06641 9.77312 8.06641C9.07976 8.06641 8.50195 8.64547 8.50195 9.34036Z\",\"fill\":\"white\"}],[\"$\",\"path\",null,{\"className\":\" transition-colors duration-300 group-hover:fill-heading-black\",\"d\":\"M16.8917 18.6518H19.0873V14.7836C19.0873 12.8843 18.6713 11.425 16.4525 11.425C15.3894 11.425 14.6729 12.0041 14.3724 12.56H14.3493V11.5871H12.2461V18.6518H14.4418V15.1542C14.4418 14.2509 14.6267 13.3475 15.7592 13.3475C16.8686 13.3475 16.8917 14.413 16.8917 15.2237V18.6518Z\",\"fill\":\"white\"}]]}]}],[\"$\",\"$L4c\",null,{\"target\":\"_blank\",\"href\":\"https://hachyderm.io/@tailscale\",\"rel\":\"me\",\"className\":\"group transition-colors duration-300 text-heading-black hover:text-gray-200\",\"data-track\":\"Link Clicked\",\"data-track-properties\":\"{\\\"label\\\": \\\"Footer Mastodon logo\\\"}\",\"children\":[\"$\",\"svg\",null,{\"width\":\"28\",\"height\":\"29\",\"viewBox\":\"0 0 28 29\",\"fill\":\"none\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"children\":[[\"$\",\"rect\",null,{\"y\":\"0.988281\",\"width\":\"28\",\"height\":\"28\",\"rx\":\"14\",\"fill\":\"currentColor\"}],[\"$\",\"path\",null,{\"className\":\"transition-colors duration-300 group-hover:fill-heading-black\",\"fill\":\"white\",\"d\":\"$4d\"}]]}]}],[\"$\",\"$L4c\",null,{\"target\":\"_blank\",\"href\":\"https://www.youtube.com/@Tailscale\",\"className\":\"group transition-colors duration-300 text-heading-black hover:text-gray-200\",\"data-track\":\"Link Clicked\",\"data-track-properties\":\"{\\\"label\\\": \\\"Footer Youtube logo\\\"}\",\"children\":[\"$\",\"svg\",null,{\"width\":\"28\",\"height\":\"28\",\"viewBox\":\"0 0 28 28\",\"fill\":\"none\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"children\":[[\"$\",\"rect\",null,{\"x\":\"0.658203\",\"width\":\"27.2195\",\"height\":\"27.2195\",\"rx\":\"13.6098\",\"fill\":\"currentColor\"}],[\"$\",\"path\",null,{\"className\":\" transition-colors duration-300 group-hover:fill-heading-black\",\"d\":\"M19.6754 11.46C19.5368 10.5863 19.121 9.98138 18.1506 9.84696C16.6258 9.57813 14.2693 9.57812 14.2693 9.57812C14.2693 9.57812 11.9128 9.57813 10.388 9.84696C9.4177 9.98138 8.93254 10.5863 8.86323 11.46C8.72461 12.3337 8.72461 13.6106 8.72461 13.6106C8.72461 13.6106 8.72461 14.8876 8.86323 15.7613C9.00185 16.635 9.4177 17.2399 10.388 17.3743C11.9128 17.6432 14.2693 17.6432 14.2693 17.6432C14.2693 17.6432 16.6258 17.6432 18.1506 17.3743C19.121 17.1727 19.5368 16.635 19.6754 15.7613C19.814 14.8876 19.814 13.6106 19.814 13.6106C19.814 13.6106 19.814 12.3337 19.6754 11.46ZM12.8831 15.6269V11.5944L16.3486 13.6106L12.8831 15.6269Z\",\"fill\":\"white\"}]]}]}]]}],[\"$\",\"div\",null,{\"className\":\"t-14 flex flex-wrap tracking-[0.07px] xxs:col-span-2 md:col-span-12 text-heading-black/60 \",\"children\":[\"© \",2025,\" \",\"Tailscale Inc. All rights reserved. Tailscale is a registered trademark of Tailscale Inc.\"]}]]}]}]]}]]\n"])</script></body></html>