6 ms·

Isn’t there separation of the control and data planes? I don’t think Tailscale get to see any of your network traffic.

• nickburns 7mo ago
  They need to know how/where to route your outbound traffic. That inherently includes plaintext DNS, TLS handshakes, and otherwise plaintext traffic (like HTTP for example). Anybody wanting to see what Tailscale is able to see can simply sniff any router interface passing outbound traffic before it enters the WireGuard tunnel interface.
  • db48x 7mo ago
    No, that’s not quite true. The wireguard tunnels that the Tailscale daemon creates only go to your own machines. Nothing going through those tunnels goes to or is seen by Tailscale the company. Sometimes those tunnels go through a proxy (especially when you’re afflicted by CGNAT), but the proxy sees only encrypted traffic.
    • nickburns 7mo ago
      So how does the proxy know where to proxy packets to?
      • db48x 7mo ago
        The tailscale client on one of your computers tells it the address of your other computer.