Changelog on Tailscale

Updated Users page

Fri, 23 Feb 2024 00:00:00 +0000

Changed: Users page of the admin console updated to provide more context around user invitations, user approval, and your tailnet’s identity provider

Exit node visibility

Thu, 22 Feb 2024 00:00:00 +0000

Changed: Users can only see exit nodes they have permission to use, based on the ACL settings for a tailnet. This includes visibility in the Tailscale client and the output for Tailscale CLI commands such as tailscale status and tailscale exit-node list.

Preset Apps GA

Thu, 22 Feb 2024 00:00:00 +0000

New: Preset Apps GA (generally available)
- Use Preset Apps to configure common applications with only a few clicks or an ACL configuration. Routes and domains for Preset Apps are automatically updated and managed by Tailscale, based on each app’s source of truth. Routes for preset apps are automatically approved and pushed down to all selected App connectors.
New: Confluence, GitHub, Google Workspace, Jira, Okta, and Stripe are now available as preset apps

Updated pricing plans

Wed, 21 Feb 2024 00:00:00 +0000

Changed: The Free pricing plan is now called the Personal plan. All other aspects of the plan remain the same.
New: Customers who sign up with a custom domain will be auto-enrolled into a 14-day trial of the Enterprise plan with no provisioned user limits
New: Personal plan customers who use a custom or vanity domain for their tailnet can opt out of the trial and continue to use the Personal plan
Changed: Customers who use Tailscale for commercial purposes will be billed for all of their active users once they sign up for a plan

Note: Free trials are available for business customers. For details about billing, plan comparison, and support, see Pricing & Plans FAQ. For instructions on how to change your plan, see Modify billing.

Tailscale v1.60.0

Thu, 15 Feb 2024 00:00:00 +0000

All platforms

New: tailscale status command output now includes location-based exit nodes
New: tailscale web command flag --read-only is added to run the web UI in read-only mode
New: A warning is logged when unable to find SSH host keys
New: Support added for legacy “urn:dslforum-org” port mapping services
Changed: Build with Go 1.22
Changed: Detect when Tailscale is running on Digital Ocean and automatically use Digital Ocean’s DNS resolvers
Changed: Expose gVisor metrics in debug mode
Changed: Improve error message when running as non-root
Fixed: A valid login page is presented to users when attempting to log in even after leaving device unattended for several days
Fixed: An issue with noisy peer mtu discovery errors
Fixed: A potential crash when no supported port mapping services are found

Windows

Fixed:tailscaled could be slow or cause increased CPU usage with large routing tables

macOS

Note: Tailscale v1.60.0 is built with Go 1.22 and Go 1.22 is the last release that will run on macOS 10.15 Catalina (source). We are providing notice that around August 15, 2024, Tailscale will be built with Go 1.23 at which time macOS users that want to run the latest version of Tailscale will require macOS 11 Big Sur or later. Note that macOS 10.15 Catalina is no longer supported by Apple and is no longer receiving security updates.

New: New UI to add, remove, and switch between user accounts, including using custom control servers
New: New UI to change client preferences
New: New UI to manage updates for the Standalone variant of the client, including switching in-app between stable and unstable builds
New: VPN On-Demand is now supported on macOS, to automatically connect/disconnect Tailscale when specific conditions are triggered
New: Reset VPN Configuration menu item in the Debug menu is now available to reset the system VPN configuration if needed
New: An alert window is presented when the Tailscale network extension fails to start, providing suggested troubleshooting steps
Changed: Tailscale appears in the macOS Dock when an app window is presented
Changed: The Network Devices list now shows all devices known to the control server, not only those seen in the last 4 days
Changed: The onboarding flow automatically advances once the user is connected
Fixed: A potential crash and excessive logging upon client launch
Fixed: Start on Login is set correctly on macOS Ventura and earlier versions

iOS

Fixed: A potential crash and excessive logging upon client launch
Fixed: Stale devices are no longer presented in the devices list

tvOS

Fixed: A potential crash and excessive logging upon client launch
Fixed: Stale devices are no longer presented in the devices list

Android

Changed: Mullvad exit nodes now sorted to make it easier to find the best node for each location
Changed: Mullvad tunnels are no longer shown as regular nodes in UI
Fixed: Quick settings tile now works

Synology

Fixed: An issue with stalling of SMB transfers of large files

Kubernetes operator

New: A new ProxyClass custom resource that allows you to provide a custom configuration for cluster resources that the operator creates
New: ACL tags for the operator can now be configured via Helm chart values
Fixed: Routing to Ingress backends that require an exact path without a slash (/) suffix

App connectors

New: App connectors now flatten DNS CNAME chains down to a target A/AAAA routing record, for apps that are configured with a DNS record that is a CNAME
New: Apps can be preconfigured with known routes to have those routes auto-advertised by all selected app connectors, and immediately begin to route traffic

Auto-updates GA

Wed, 14 Feb 2024 00:00:00 +0000

Changed: Auto-updates GA (generally available)
New: Enable Tailscale client auto-updates in the Device management section of the admin console
New: Initiate Tailscale client updates to devices from the Machines page of the admin console. For details, see Auto-updates.

App connectors wildcard support change

Mon, 12 Feb 2024 00:00:00 +0000

Changed: New Apps and app connectors can no longer be selected via the * wildcard in a tailnet policy file or configuration flow. Instead, tag all app connectors and then use the tags as a selector. Existing * configurations will need to update to a tag-based selector upon the next tailnet policy file change. For details, see Wildcard connectors no longer supported.

System policies GA

Mon, 12 Feb 2024 00:00:00 +0000

Changed: System policies GA (generally available)
- Use system policies (also known as MDM policies) to control Tailscale client settings for your users, such as UI visibility, organization customization, auto-update functionality, and runtime configurations

Secret scanning with GitGuardian

Mon, 05 Feb 2024 00:00:00 +0000

New: Secret scanning integration with GitGuardian
- Use secret scanning to help mitigate accidental disclosure and prevent fraudulent use of Tailscale-generated keys

Support Device Posture in ACL tests

Mon, 29 Jan 2024 00:00:00 +0000

New: Device Posture is now supported in ACL Tests

Tailscale v1.58.2

Tue, 23 Jan 2024 00:00:00 +0000

Note: The 1.58.1 release needed to be re-done. Use 1.58.2 instead.

All platforms

Fixed: App connectors have improved scheduling and merging of route changes under some conditions
Fixed: Crash when performing UPnP portmapping on older routers with no supported portmapping services

macOS

Fixed: Opening the About window no longer displays a user interface when there is no newer version

Tailscale v1.58.0

Thu, 18 Jan 2024 00:00:00 +0000

Note: Rollout of 1.58.0 paused on 21-Jan-2024 while we investigate reports of a regression with portmapping.

All platforms

Changed: The number of 4via6 site IDs are increased from 256 to 65,536
Changed: Taildrop allows category Z unicode characters
Changed: DERP flapping (flipping back and forth between two regions rapidly) is reduced when there’s still an active connection for the home DERP server
Changed: Portmap checks the epoch from NAT-PMP & PCP, and establishes a new portmapping if it changes
Changed: Portmap better handles multiple interfaces
Changed: Portmap handles multiple UPnP discovery responses
Changed: Increased binary size with Tailscale 1.56 is resolved
Fixed: Web interface issue related to accessing shared devices
Fixed: Web interface login issue when accessed over HTTPS

Linux

Fixed: Shell shebang is added in postinstall script, which fixes some Debian installations

macOS

New: DNS Settings view is added and displays the DNS configuration used when Tailscale is running
New: Quit the app without terminating the VPN tunnel by holding down the Option button and selecting Quit (Leave VPN Active)
New: Toggle Tailscale shortcut action can be used to connect or disconnect the VPN tunnel, depending on its current state
New: The KeyExpirationNotice system policy is now supported to customize the time interval before a key expiration notice is displayed to the user
New: The web interface is now supported in the standalone variant of the client
Changed: Onboarding flow includes a step to ask the user to approve key expiry notifications
Changed: Onboarding flow asks the user to approve the system extension if necessary, when using the standalone variant of the client
Changed: Pre-Sonoma compatibility is improved
Fixed: VPN tunnel terminates upon closing the app
Fixed: Opening the About window triggers a check for updates
Fixed: The standalone variant of the client checks for updates every 72 hours

iOS

New: Toggle Tailscale shortcut action can be used to connect or disconnect the VPN tunnel, depending on its current state. Ideal for the Action Button on iPhone 15 Pro.
New: The KeyExpirationNotice system policy is now supported to customize the time interval before a key expiration notice is displayed to the user
Fixed: Sign button in the Tailnet lock device sign view is rendered correctly
Fixed: Connectivity is no longer lost when transitioning from Wi-Fi to Cellular while an exit node is in use

Windows

New: The web interface is now supported
Changed: The lookup for netsh.exe uses the absolute path instead of the relative path
Changed: ADMX system policy descriptions are now available
Changed: Vestigial wintun support is removed, which might have caused Chocolatey installs to break
Fixed: A goroutine leak in winMon no longer occurs if the monitor is never started
Fixed: “This package requires Windows 10 or newer” message no longer falsely displays during an uninstall or repair

Android

Fixed: Active network change detection is improved

tvOS

Fixed: Improvements to persistence of the client when running in the background

Kubernetes Operator

New: A Connector custom resource is added, allowing users to configure the operator to deploy an exit node, subnet router, or both
Changed: A warning displays if the unsupported ingress Exact path type is used
Changed: StatefulSet labels are synced to their Pods
Changed: A Tailscale IngressClass resource is added
Changed: Extra long Service names are properly truncated

Containers

Changed: Experimental support is added for configuring tailscaled using a mounted config file
Fixed: Tailscale images now contain layers of the same media type and can be parsed by Podman and Buildah

Support for Zoho

Fri, 12 Jan 2024 00:00:00 +0000

New: Zoho is now supported as a custom OIDC provider

Security update indicators and filter in the admin console

Wed, 10 Jan 2024 00:00:00 +0000

Changed: Available update icons on the Machines page of the admin console now differentiate between regular and security updates
Changed: The Version filter on the Machines page can now show nodes with pending security updates

Tailscale v1.44.3

Mon, 08 Jan 2024 00:00:00 +0000

Windows

Fixed: Added a security fix to address privilege escalation with tailscale serve and tailscale funnel that allowed low-privilege users to serve files they did not have access to (TS-2024-001). This release is intended for Windows 7 and 8 users. Those with later versions of Windows should run the latest stable version of Tailscale, which is 1.56.1. This issue was resolved in Tailscale 1.52.push

Invite any user to a GitHub tailnet

Tue, 02 Jan 2024 00:00:00 +0000

Changed: Invite any user to your tailnet when using a GitHub organization or GitHub personal account as the identity provider

HTTPS certificates GA

Wed, 20 Dec 2023 00:00:00 +0000

Changed: HTTPS certificates GA (generally available)
- Use HTTPS certificates to provision TLS certificates for devices in your tailnet

View machine certificate status

Wed, 20 Dec 2023 00:00:00 +0000

New: View the TLS certificate status of a machine in your tailnet by using the Machines page of the admin console

Tailscale v1.56.1

Fri, 15 Dec 2023 00:00:00 +0000

Linux

Fixed: Web interface redirects to the correct self-IP known by the source peer
Fixed: App connector domain list displays as expected

macOS

Fixed: Custom login server uses the provided URL instead of login.tailscale.com

iOS

Fixed: Custom login server uses the provided URL instead of login.tailscale.com

tvOS

Fixed: Custom login server uses the provided URL instead of login.tailscale.com

ACL Grants

Thu, 14 Dec 2023 00:00:00 +0000

New: Use ACL Grants in your tailnet policy file to provide capabilities at either the IP layer or the application layer (beta)