把你的设备连成一张私有网络
随时随地远程办公

# 开启 Tailscale SSH(接管 SSH 认证)
tailscale up --ssh

# 直接用机器名连,无需公网 IP、无需端口
ssh user@myserver
# 或带 tailnet 全名
ssh user@myserver.your-tailnet.ts.net

# 用 MagicDNS 名字(在家走局域网直连,最快)
open vnc://mymac
# 出门时用它的 Tailscale IP
open vnc://100.x.x.x

# 在家走局域网,不在家自动回退 Tailscale
vnc-desk() {
  if ping -c1 -t1 mymac.local >/dev/null 2>&1; then
    open "vnc://mymac.local"
  else
    open "vnc://100.x.x.x"   # 目标机的 Tailscale IP
  fi
}

# 开启 IP 转发
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

# 广播你的局域网网段(按实际改)
tailscale up --advertise-routes=10.0.0.0/24

# 打开 https://login.tailscale.com/admin/machines
# 找到这台机 → ... → Edit route settings → 勾选批准该子网

tailscale up --accept-routes
# 之后就能直接访问内网里没装 Tailscale 的设备,比如 NAS 后台
open http://10.0.0.20

tailscale up --advertise-exit-node
# 然后到管理后台同样「批准」这个出口节点

# 全部流量走指定出口机
tailscale up --exit-node=100.x.x.x --exit-node-allow-lan-access
# 取消,恢复本地直连上网
tailscale up --exit-node=

# 把本机 3000 端口的服务,以 https 发布到 tailnet
tailscale serve --bg 3000
# 查看/关闭
tailscale serve status
tailscale serve --https=443 off

tailscale funnel 3000
# 会给你一个 https://机器名.your-tailnet.ts.net 的公网地址

{
  "tagOwners": {
    "tag:server": ["autogroup:admin"],
    "tag:laptop": ["autogroup:admin"]
  },
  "acls": [
    // 笔记本只能连服务器的 SSH/RDP/VNC 端口
    { "action":"accept", "src":["tag:laptop"],
      "dst":["tag:server:22,3389,5900"] },
    // 每个人都能访问「自己的」设备
    { "action":"accept", "src":["autogroup:member"],
      "dst":["autogroup:self:*"] }
  ],
  "ssh": [
    // SSH 到服务器,非 root 直接放行,root 需二次确认
    { "action":"check", "src":["autogroup:member"],
      "dst":["tag:server"], "users":["autogroup:nonroot","root"] }
  ]
}

tailscale lock init        # 初始化(会给出信任密钥)
tailscale lock status      # 看哪些节点待签名
tailscale lock sign <node-key>

# Docker 起 headscale,详见官方文档
docker run -d --name headscale -v ./config:/etc/headscale \
  -p 8080:8080 headscale/headscale:latest headscale serve
# 创建用户 + 生成注册密钥
headscale users create myuser
headscale preauthkeys create --user myuser --reusable

tailscale up --login-server=https://headscale.example.com \
  --authkey=<上一步的key>

tailscale ping myserver
# "via 10.x/直连IP ... direct" = 点对点直连(快)
# "via DERP(xxx)"            = 走中继(慢,通常是 NAT 打不穿)

tailscale netcheck
# 看 UDP 是否可用、NAT 类型;MappingVariesByDestIP: false = 打洞友好