December 2023 Summaries

Tailscale's Device Posture Management, now in beta, allows users to restrict access for non-compliant devices by managing device attributes and integrating third-party systems within a Tailscale network, or tailnet. This feature enables defining "postures," or sets of device attribute assertions, to enforce security policies, such as allowing access only from devices with specific operating systems or endpoint detection and response (EDR) scores. Posture attributes can be customized using the Posture Attributes API, accommodating additional conditions in access control lists (ACLs). Integrations with systems like Crowdstrike Falcon allow for policy configurations based on Zero Trust Assessment (ZTA) scores, ensuring that network access is granted only to devices meeting specific security criteria. This approach enhances tailnet security by providing a straightforward method to limit access to devices that comply with an organization’s defined requirements.

Tailscale has introduced "grants" as an evolution of Access Control Lists (ACLs), extending access management from the network layer to the application layer. This development allows for more granular access controls, enabling users to integrate Tailscale's robust access policies within their own applications. The new grants feature unifies network and application access rules, enhancing readability and usability while maintaining compatibility with existing ACLs. Examples of grants' applications include TailSQL, a web SQL playground that restricts access based on user roles; Setec, a secrets manager that provides fine-grained control over secret access; a Kubernetes auth proxy that simplifies RBAC rules through group impersonation; and Golink, a project for managing private short links with the ability to assign administrative roles. Tailscale plans to further integrate grants into its security toolkit, with future enhancements expected to streamline policy management and application security.

Tailscale has introduced Regional Routing, a feature designed to enhance scalability and reliability for businesses with global operations by routing and balancing traffic through the nearest available infrastructure. This new capability allows organizations to manage overlapping app connectors and subnet routers within regions mapped to Tailscale's DERP regions, ensuring high availability and improved performance. Regional Routing supports various scaling methods, including global geo-steering, in-region load balancing, and failover, offering flexibility to meet diverse business needs. Clients connect to the nearest DERP server and are directed to the closest available connector, with ongoing re-evaluation for optimal resource access. The feature includes in-region load balancing, which distributes traffic evenly among multiple connectors, and failover options for redundancy, enhancing global high availability without requiring Tailscale-owned infrastructure. Previously exclusive to higher-tier plans, failover is now accessible to users across all plan levels.

During the holiday season, many people travel and face challenges with accessing home networks, which Tailscale can help mitigate through strategic setups before and during trips. By configuring an exit node and enabling Tailscale SSH at home, users can securely route internet traffic through their regular networks and access geo-restricted content while traveling, even over unreliable public Wi-Fi. Additionally, setting up an off-site Tailscale node, such as a NAS box or a second exit node at a family member's home, can provide remote backup solutions and enhance connectivity. For those providing tech support during visits, installing a subnet router or a PiKVM can facilitate remote troubleshooting without compromising security, making Tailscale a valuable tool for maintaining connections during holiday travels.

Tailscale has introduced App connectors, a tool that enhances the security of SaaS applications by integrating them into its zero-trust network access platform, allowing organizations to enforce granular access controls and limit access to only authorized devices and users. These connectors route all egress traffic through a controlled gateway, enabling seamless management of SaaS application access without requiring end-user configuration. App connectors support multiple protocols and function as DNS proxies and traffic relays, providing flexibility and security by advertising subnet routes for configured domains. Organizations maintain full control over the availability and performance of these connectors, which can be deployed globally with high availability through cold failover and regional routing options. By implementing continuous verification in line with zero-trust principles, Tailscale ensures ongoing trustworthiness and security for SaaS applications, with device posture rules further enhancing security by continuously validating user identities and device conditions.

Tailscale has introduced a new feature that allows users to control the private IPv4 addresses assigned to their nodes, giving them the ability to choose specific subsets from the CGNAT range to prevent conflicts with other applications. This change marks a shift from globally unique IP addresses within Tailscale to locally unique ones, addressing the issue of running out of IPs by allowing the reuse of addresses in different tailnets. The update also includes a beta feature enabling users to define IP pools for node assignments as part of their tailnet policy, offering flexibility and compatibility with existing systems. Additionally, users can now modify the IP addresses of existing nodes, and a solution has been implemented to handle address reuse when nodes are shared between tailnets, employing 1-1 NAT for packet management. This ensures seamless integration and simplifies management while allowing each tailnet to host up to four million nodes.