Private networks

What a private network is

A private network is your own mesh network with its own coordination server and its own keys: only your devices are in it, and you decide everything — how many devices, which subnets are reachable through which routers, who reaches whom. It is the same WireGuard mesh as the public network, plus:

• no device limit;
• subnet routers and exit nodes — reach whole LANs, send traffic out through a chosen device;
• access rules — who reaches whom and on which ports;
• publishing services on the internet;
• export, import and backups, overlapping subnets, changing a device's address.

What you need

• A paid network. A private network is a paid service, each network on its own: 99 ₽ a month or 990 ₽ a year. Without a paid network, Create network on My networks shows the price and the payment buttons right there; after the payment you're back to create it. See A private network.
• A free reserved name for the network's address: a name of yours in our zones with no DNS records, without dots — like office, not lab.office. Reserve one on Domains with an empty value, see Reserve a name.

Create a network

1. On My networks press Create network at the top right. In Address of the new network pick the name that becomes the network's address: the list has only your free reserved names.
2. Press Create network in the form. In a few seconds the network is running and appears in the list.

With no free reserved name the button is inactive, and the page says You have no free reserved name. with a link to Domains.

Without a paid network that isn't created yet, the form shows the price instead, with Pay 99 ₽ for a month and Pay 990 ₽ for a year next to the address. Pick the address and pay: you're back in the form with that address selected — press Create network. Deleting a network keeps its paid period: until its end you can create another network in it.

The network's address is its coordination server: https://office.mesh-net.space. Devices join it with --login-server set to this address. mesh-net points the name's DNS record at the server itself.

A network can also be created from an export archive or from your own headscale — see Import a network.

The network page

The network's row in My networks opens its page. At the top — the status, Control server: https://office.mesh-net.space and Add device; below them, the tabs Devices, Access, Sites, Publishing (reverse-proxy), Backup, Notifications, People (see People of a network) and Settings. Access (the network's access rules) and Notifications are pages of their own, with the same header and tabs. The open tab is kept in the address, so a link or a reload brings you back to it.

The Settings tab shows until when the network is paid (Paid until), and there its owner renews it; a strip under the header appears when the paid period ends soon, has ended, or the network is stopped. A stopped network shows Stopped: its devices can't reach the control server, its published services don't answer, and its data is kept until the deletion date — see When a network's paid period ends.

If the network's server doesn't answer, the page says “Network unavailable” with the reason instead of the device list; try again in a minute, and if it lasts, write to support.

mesh-net may move a network to another of its servers — for maintenance or when a server fails: you get a notification, and you don't need to do anything, see If mesh-net moves your network to another server.

Add a device

1. Press Add device at the top right of the network page. In the form type a user name (see Users and join keys; the field suggests the existing ones) and press Add device.
2. The page shows a join key for this user and tabs with commands for Linux, Windows, macOS, iPhone and Android — the key is already in them. To make the device a subnet router, fill in the subnet field above the tabs first; see Advertise a subnet.
3. Run the command on the device. It appears under Devices within seconds.

The form only adds devices. A device that has joined becomes a gateway for its LAN on its own page, under LAN gateway — see LAN gateway.

The commands, with the network's address and the key from the page in place of KEY:

Linux

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --login-server https://office.mesh-net.space --authkey KEY --accept-routes
tailscale status

Can't open tailscale.com? Install from the mesh-net mirror (about the mirror) instead of the first line:

curl -fsSL https://mesh-net.space/ext/tailscale-install.sh | sudo sh

Windows

1. Install the client: tailscale.com/download/windows.
2. Open PowerShell as administrator: Start → type “PowerShell” → right-click → “Run as administrator”.
3. Join and check:

   tailscale up --login-server https://office.mesh-net.space --authkey KEY --accept-routes
   tailscale status

macOS

brew install tailscale && sudo tailscaled install-system-daemon
sudo tailscale up --login-server https://office.mesh-net.space --authkey KEY --accept-routes

In the GUI app from the App Store instead of the command: “⋯” → “Use a custom coordination server” = https://office.mesh-net.space, then log in as the user with the key.

iPhone and iPad

1. Install Tailscale from the App Store and open it.
2. On the login screen tap “⋯” at the top → “Use custom coordination server”.
3. Enter the network's address, https://office.mesh-net.space, and log in as the user. If the app asks for an auth key, paste the key from the page.

Android

1. Install Tailscale from Google Play and open it.
2. Account menu (three dots) → “Use an alternate server”.
3. Enter the network's address and log in as the user. If the app asks for an auth key, paste the key.

Users and join keys

• A user groups devices inside the network — say, one per person or one for servers. A new name in the field creates the user; the name is lowercase Latin letters, digits and . _ -, up to 63 characters. Devices of one user are listed under that name.
• A join key is single-use and short-lived: it works once and expires in 1 hour. Used and expired keys are removed automatically, so there is nothing to manage — just create a new key for every device.
• Every new key is announced by email and, while the Join keys events are on, in the network's notifications.

Devices

The Devices table shows every device of the network, grouped by user. A group starts with a line: the user's name, how many devices they have and how many of them are online right now — the count follows the statuses. Users go in alphabetical order; after them come Tagged devices (a tagged device is owned by its tags, not by a user — see Tags), No user (if the network reports a device without a user) and, last, System devices — the ones mesh-net adds by itself.

• Name — leads to the device's page.
• Addresses — the mesh IP (click to copy), and below it the external and local IPs the device reported.
• Status — online or offline, refreshed every 10 seconds without reloading; an HA tag means online/offline tracking is on.
• Routes — the subnets approved on the device; offers routes → means it advertises routes and none of them is approved yet (see Approve routes).

A device named rp-… is the network's reverse-proxy: mesh-net adds it when you publish the first service (see Publishing services). It can't be deleted from the table; when the last service is removed, the proxy stops, and its device stays in the list as offline.

When a device joins or leaves while the page is open, a line suggests refreshing it.

Device names (MagicDNS)

Besides the address, a device can be reached by its name from any device of the network: nas or the full form nas.office.mesh.mesh-net.space (device name, the network's name, mesh, the zone). The client must accept DNS settings from the network — that is the default.

A network imported from an archive keeps the full names its devices had on the old server: they end with that server's dns.base_domain, like nas.tailnet.example.com. Short names are the same everywhere.

The device page

A device's row in the Devices table opens its page: the name and the state at the top, then:

• Rename at the top right — a new name: lowercase Latin letters, digits and hyphens.
• Device details — user, Mesh address (Change next to it opens the form, see Changing a device's mesh address), IPv6, external and local IPs, Last seen, when it was added, Registration method, Key expiry and Tags (Edit next to them, see below).
• LAN gateway — whether the device shares its LAN with the network, and the steps to make it do so, see LAN gateway.
• Routes — approving the subnets and exit node the device advertises, see Subnet routers and exit nodes.
• Notifications — the switch Alert me when it goes online/offline (HA), see Online/offline tracking.
• Useful node commands — folded: ready commands for the device, see Useful node commands.
• Delete device — at the bottom, in Danger zone.

Tags

Edit next to Tags opens the field: enter tags separated by spaces or commas (server, db) and press Save tags. A tag has to be declared in tagOwners of the network's policy, otherwise the network rejects it — so tags are for a custom HuJSON policy. The visual access rules don't use tags: they work with devices and groups.

Delete a device

The bin icon in the device's row, or Delete in Danger zone at the bottom of its page, removes it after a confirmation. The device leaves its groups, and access rules where it is the source or the destination are removed; if it was the gateway of sites, they are removed too. To bring the device back, add it again with a new key; on the device itself you can then run sudo tailscale logout.

Change the network's address

The address of a network can be changed — to a nicer name, or to the name your devices already use, when you move a network from your own headscale (see Move without touching the devices). The new address can be:

• a free reserved name in mesh-net's zones — the same kind of name as for a new network;
• a name in your own domain whose DNS is served by mesh-net (Your own domain): a new one, or one that has only address records (A, AAAA or CNAME) — they are replaced;
• a name whose DNS stays at another provider — like vpn.example.com, while example.com and its other services stay where they are: it becomes the address with a CNAME record there (see below);
• one of the network's second addresses.

1. On the Settings tab of the network page, under Change the address, type the name into New address — the field suggests the names that fit — and press Continue.
2. The next page shows what happens: the record the name gets, what it replaces, the second addresses after the change. If the name leads to your old server now, it also shows how to move without touching the devices; then tick the box.
3. Press Change the address. It takes a few seconds: mesh-net points the name at the network's server, gets a certificate for it and restarts the server with the new address. The network's control pauses for a moment; connections between the devices keep working.

The new record has a short TTL (60 seconds). If the certificate can't be issued within a minute and a half, nothing changes: the record is put back as it was, and the network keeps its address. The name is refused right away — and nothing changes — if it has records of other types (the address becomes an alias, CNAME, of the network's server, and an alias can't stand next to other records), if it is the domain itself, if it is taken by another network or a published service, or if the full device names of the network end with that name or a name above it (headscale doesn't work like that).

Join keys and the commands of Add device use the new address at once; so do the notifications, emails and the network's reverse-proxy if it starts after the change.

If the change fails

The page of the change stays open and says why: the box The address wasn't changed above its buttons, with the time of the attempt; the box stays there when you reopen the page, until you try again or leave it. A failed change changes nothing: the network keeps its address, and its server isn't restarted.

• No certificate, while the name already leads to mesh-net — a name in mesh-net's zones, a name of your own domain whose DNS is here, or a name whose CNAME the check has just seen at your provider: this is a failure on mesh-net's side, and the page says so — mesh-net couldn't get a certificate for vpn.example.com, and this is a failure on mesh-net's side: we already know about it and are working on it. Nothing changed in your network: it works at office.mesh-net.space as before. Below it is the cause as the network's server sees it. mesh-net's administrators get an alert with that cause at once. There is nothing to check or change on your side: leave the records as they are and try again later.
• The cause is on your side — the page names it. The CAA records of the domain don't allow Let's Encrypt, where mesh-net gets its certificates (mesh-net looks them up before saying so): add the record 0 issue "letsencrypt.org" where you edit the domain's records, or delete the CAA records. The name servers of your own domain at the registrar aren't mesh-net's any more: put mesh-net's back.
• Other refusals — the name is taken, another change of the network is in progress, the records at your provider aren't visible yet — are said in the same box.

A name whose DNS is at another provider

The domain doesn't have to move to mesh-net for one of its names to become a network's address: an ordinary CNAME record at your DNS provider is enough. When you press Continue, the page shows two records to set there, with buttons to copy each field:

• The CNAME leads to the network's address in mesh-net's zones (if the address is elsewhere, to its second address there). mesh-net keeps that name pointing at the network's server, so the record at your provider never has to change — even if the network moves to another server. That name can't be removed from the second addresses while the CNAME leads to it. The external name itself, when it is a second address, is removed like any other; its CNAME stays at your provider — delete it there if you don't need the name.
• The TXT record proves that the name is yours: without it anybody could take a name that already leads to mesh-net. It can be deleted after the change.
• If the name has an A or AAAA record now — the address of your own server — replace it with the CNAME: a name with a CNAME can't have other records. The domain itself (example.com) can't be a CNAME. If your provider can proxy the name through its servers (Cloudflare's orange cloud, for example), turn that off for it: the world must see the CNAME itself.

What DNS shows now on the page is what public DNS resolvers see; Check asks them again. Change the address is available when most of them see both records — a replaced record shows up once the previous one's TTL runs out in their caches. Then the change goes as above: a certificate, a restart, the old address stays second. mesh-net writes nothing at your provider and undoes nothing there: if the certificate can't be issued, the network keeps its address; if you change your mind, put the previous record back at your provider.

Once a day mesh-net checks that the name is still a CNAME of the network's address. If it stops — the record was changed or deleted at the provider — you get a notification and an email, and the Settings tab marks the name; once more when it leads to the network again.

Second addresses

The previous address doesn't go away: it stays the network's second address, and Second addresses on the Settings tab lists it. Devices and the reverse-proxy that joined through it keep working. Its record is kept by mesh-net, like the address's.

Remove next to a second address takes it off the network's server; its DNS record stays, and the name is an ordinary name of yours again. Devices that still connect through it lose the connection to the network's server — move them to the address first:

sudo tailscale down
sudo tailscale up --login-server=https://office.mesh-net.space

(with the network's address; no new login). The network's reverse-proxy, if it joined through that name, joins again through the address by itself — published services pause for a few seconds. Deleting the network removes its second addresses too.

People of a network

A private network can be shared: its owner invites other people of mesh-net into it. Everyone in a network has one of three roles.

A shared network shows up in My networks of the people in it, in the list Shared with me — with its owner and the person's role. The people of a network pay nothing: the owner pays for the network and renews it. When it is stopped, deleted or works again, they get a note in the feed.

Invite people

1. On the People tab of the network page press Invite, type the email address of the person, pick the role and press Send the invitation. The owner invites administrators and members; an administrator invites members.
2. The person gets an email with a link. The invitation waits under Invitations in their My networks: Accept or Decline. Only the account with that email address can accept it. With no account yet, the person signs up with this address — and the invitation is there.
3. Once accepted, the person is in the network with this role. Until then the invitation is listed on the People tab, where it can be revoked.

A member adds devices with Add device like anyone else, but doesn't choose the user name: every device of theirs joins under their own user of the network — u and the number of their account, the same one every time. The Devices table lists them under the person's email. A member can delete their own devices, nobody else's.

On the People tab the owner changes anybody's role and removes anybody; an administrator raises a member to an administrator and removes members. Every change of the people appears in the owner's notifications — joining, a new role, removing and leaving come by email too; what people of the network do — add or delete devices, change rules — reaches the owner by the network's notification settings, with the email of the one who did it.

Remove a person, or leave

Remove from the network on the person's line asks what happens to their devices in the network:

• Delete them (the default): the devices leave the network right away, the same way as deleting a device; the access rules that mention them go too.
• Keep them: the devices stay connected to the network, and from then on the owner and the administrators manage them — for example, the office servers someone set up. Keep only devices the network itself needs: they keep working.

Either way the person loses access to the network in the dashboard at once, and their unused join keys stop working. A member or an administrator can leave by themselves: Leave the network at the bottom of the People tab, with the same choice. The owner can't leave: transfer the network or delete it.

Transfer the network

The owner can hand the network over to another account — everything goes with it: devices, access rules, sites, people, addresses with their names in mesh-net's zones, names at other DNS providers, published services, and its paid period: the network stays paid until the same date, and from then on the new owner pays for it and renews it.

1. On the Settings tab, under Transfer the network, type the email address of the new owner's account. Tick Stay an administrator of the network after the transfer if you want to keep managing it. Press Send the offer.
2. The new owner gets an email with a link. The offer waits for them for 7 days: in their My networks under Invitations. Its page shows what comes with the network and whether their account can take it.
3. Accept the network moves it in one step. Both of you get an email. Until then the offer can be cancelled on the Settings tab.

What has to be done before, on the owner's side — the offer is refused until then, and says what to do:

• an internet exit of the owner's subscription — remove it on the Internet exit tab;
• an address or a second address in the owner's own domain — the domain stays with the owner: give the network another address or remove that second address.

What the new owner's account needs — checked before the network moves; the offer's page says what is missing:

• nothing for the network itself: its paid period comes with it. Only a network without a paid period of its own (a network of a mesh-net administrator) needs a paid network that isn't created yet on the new owner's account — the network takes its place;
• room in the limit of names for the network's names in mesh-net's zones: its address, second addresses and the names of its published services move to the new owner's account;
• a free reverse-proxy slot, if the network publishes services — or the old owner removes the publications first.

Names at other DNS providers keep working as they are: their CNAME still leads to the network. Dynamic DNS of the old owner's own names that followed a device of this network is turned off.

Delete a network

Delete in Delete network on the Settings tab of the network page (or the bin icon in the network's row in My networks) removes the network after a confirmation: all its devices are disconnected, published services go down, and the network's data is gone. If you may need it again, first download a backup. Only the owner can delete a network; its people get a notification — also when the network goes away with its owner's account or is deleted after its paid period ended.

Deleting a network doesn't end its paid period: until that date you can create or import another network in it, see A private network.