Tailscale’s public stance that “Zero Trust is broken” isn’t a rejection of security. It’s a critique of how Zero Trust is often implemented: lots of vendor jargon, unclear boundaries, and access policies that don’t actually map cleanly to identity, devices, and intent.
In practice, Tailscale argues for a different outcome. You don’t need to “check a Zero Trust box” to be safe—you need correct authentication, tight authorization, and reliable network segmentation that behaves predictably under pressure.
As an Amazon Associate I earn from qualifying purchases.
What Tailscale means when it says Zero Trust is broken
Tailscale’s point is that “Zero Trust” has become an umbrella term. Many deployments claim they’re doing Zero Trust, but the control plane and policy model don’t match reality: users, devices, services, and trust assumptions change faster than the policies and documentation.
In other words, the label survives even when the enforcement doesn’t. Tailscale’s model pushes you toward enforcement that’s closer to what you actually want—least privilege access between identifiable endpoints—rather than vague “never trust the network” slogans.
#1 Best Overall
Why the traditional Zero Trust story often fails
Classic Zero Trust programs are frequently architecture-heavy and operationally fragile. Here are the most common gaps that make “Zero Trust” look broken to security teams.
1) Policies don’t match identity, they match paperwork
If a user’s access is based on group membership in a tool that can drift from reality, you end up with policy that’s hard to reason about. The result is either over-permission (“just in case”) or frequent breakage that users work around.
2) “Assume breach” becomes “assume exception”
Once you assume breach, you’re supposed to reduce blast radius. Many organizations handle this with broad allow rules for convenience. The policy complexity grows until exceptions outnumber protections.
3) Segmentation is inconsistent across layers
It’s common to secure the network edge while leaving internal paths loosely controlled—especially in SaaS integrations, VPN-to-LAN bridges, DNS shortcuts, and service-to-service access. Attackers don’t care which layer you “meant” to secure.
4) Too many tools, not enough one coherent enforcement point
When access is decided by multiple systems (VPN, SSO, firewall rules, endpoint posture, proxy rules), failures happen at boundaries. Troubleshooting becomes slow, which leads to permanent loosening of controls.
Why this might be a good thing
Calling Zero Trust “broken” can be a forcing function. It discourages teams from treating security as marketing and encourages them to ask one blunt question: “Can we precisely explain who can reach what, from which devices, and why?”
Tailscale’s approach tends to improve outcomes because it makes the policy model concrete. You can often verify access decisions quickly, audit changes, and reason about connections by identity and endpoint attributes.
What to use instead: identity-first networking and least privilege
Even if you keep the Zero Trust label, the practical target is clear: enforce authentication and least privilege at the network layer between named entities. That means policies based on identities (people and services), device posture where relevant, and explicit authorization for destinations.
With Tailscale, the enforcement unit is typically “who can reach which service on which device,” expressed through access control rules (ACLs) that map to groups, users, tags, and device attributes.
Prerequisites before you change access
Before you tighten policies, you need the basics aligned. Otherwise, you’ll break connectivity and end up with permissive fallbacks.
Inventory what needs to talk to what
- List critical services (e.g., PostgreSQL, internal web apps, build servers).
- Identify which users and which devices should access each service.
- Record ports and protocols (TCP/UDP and port numbers).
Plan your identity model
- Choose how people authenticate (e.g., Google Workspace, Microsoft Entra ID, GitHub, SAML).
- Decide how you map service identities (if you use service accounts) and automation.
Decide on your device policy stance
- Do you allow unmanaged devices?
- Do you require OS versions or endpoint posture?
- Will you distinguish laptops vs servers using tags or groups?
Core Tailscale concepts you need to get right
To build real least-privilege networking with Tailscale, you need to understand the primitives that ACLs use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Concept | What it means | Why it matters |
|---|---|---|
| Tailnet | Your private Tailscale network | Everything you secure lives inside a tailnet boundary |
| Users and identities | People (or accounts) who authenticate | ACLs usually reference identity, not “shared secrets” |
| Devices | Endpoints that run the Tailscale client | You authorize access per device capabilities and attributes |
| Tags | Labels applied to devices for policy targeting | Tags let you group servers vs workstations without brittle IP logic |
| ACLs | Rules that allow or deny connections | This is where least privilege becomes enforceable |
| Subnet routes | Access to resources on routed networks | It expands your blast radius if you don’t constrain it |
| MagicDNS / DNS | Name resolution within the tailnet | Correct naming reduces the temptation to use unsafe broad access |
Build a safer access model with Tailscale (step-by-step)
The goal is simple: explicit allow rules for exactly the services you intend, tied to identity and device attributes. Start permissive only long enough to get visibility, then ratchet down.
Step 1: Make identity the source of truth
Use an SSO provider for admin access and for user authentication to your tailnet. Keep identity and membership authoritative; avoid manual, ad-hoc “shareable link” patterns for production access.
- Sign in to the Tailscale admin console.
- Connect your organization’s identity provider (e.g., Google Workspace or Microsoft Entra ID).
- Require sign-in for all users you want on the tailnet.
- Verify that offboarding removes access quickly (group removal should propagate).
Step 2: Lock down access with ACLs
ACLs are where “Zero Trust” turns into enforceable behavior. You want a default-deny stance and explicit allow rules for destination tags and ports.
- In the admin console, open Access controls (ACLs).
- Create groups for users that correspond to real job roles (e.g., devs, SRE, finance-ops).
- Create tags for servers and services (e.g.,
postgres-prod,web-admin). - Write allow rules that specify: source group, destination tag/device, and allowed ports.
- Test rules in a staging tailnet or with a small pilot cohort.
Step 3: Control what devices can join
If any endpoint can join and request access, you’ve only moved the problem. Use device approvals and limits so you can confidently assign policy to real endpoints.
Recommended Free Tools
- Enable device approval workflows in the admin console.
- Apply constraints to new devices (e.g., require owners to approve first-time joins).
- Use separate tags for managed servers vs unmanaged laptops.
- Remove devices from the tailnet immediately during incident response.
Step 4: Use tags and groups consistently
Tags help you avoid fragile policies tied to IP addresses. Group your devices by what they host or what they do—not by how they currently connect.
Rank #3
- Zero Trust Security: An Enterprise Guide
- Apress
- ABIS BOOK
- Tag database servers with
dbplus environment (e.g.,db-prod,db-staging). - Tag admin surfaces with a dedicated tag like
admin-console. - Tag build runners separately from developer workstations to prevent lateral movement.
Step 5: Handle DNS and naming correctly
DNS misconfiguration creates shortcuts: people revert to IP-based access or disable safeguards. Use Tailscale’s built-in naming options so services resolve predictably.
- Enable MagicDNS or configure your preferred DNS approach for the tailnet.
- Create stable names for key services (e.g.,
postgres-prod.tailnet-namestyle patterns). - Verify that name resolution works from the client OS you care about (Windows, macOS, Linux).
Step 6: Decide on subnet routing and apply guardrails
Subnet routes let Tailscale clients reach internal networks beyond the tailnet. That’s powerful—and risky if you treat it like a convenience feature.
- Only enable subnet routes for networks you must reach.
- Restrict routing access using ACLs that allow only specific ports to specific destination ranges.
- Prefer one or two controlled subnet entry points over wide routing spans.
- Document which router devices provide access and protect those devices tightly.
Step 7: Enable admin auditing and incident response habits
Security controls without visibility are just guesses. Your policies should be auditable, and your operational playbook should be rehearsed.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Review ACL changes and tailnet membership changes as part of change management.
- Use Tailscale logs to confirm connection attempts and denials during troubleshooting.
- Define an incident play: revoke access, remove a device, tighten ACLs, validate recovery.
- Keep a rollback path for ACL changes (export current policy before edits).
Common “Zero Trust is broken” failure modes—and how to fix them with Tailscale
This section maps common failure patterns to concrete remediation steps.
Failure: “Everyone needs access to everything, just temporarily”
Temporary access often becomes permanent. Fix it by replacing broad rules with time-bound process (review cadence) and tag-scoped permissions for the exact service and port.
Failure: “We can’t troubleshoot why a connection fails”
Fix the policy model so denials are explainable. In Tailscale, prefer destination tags and explicit ports over broad IP ranges. Use logs to confirm which rule set blocked the attempt.
Failure: “SSO is on, but the tailnet is still porous”
SSO only answers “who are you.” You still need device gating and ACL authorization. Require device approvals, and ensure ACL rules reference device/service tags—not just user identity.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Failure: “We enabled subnet routing and forgot about it”
Subnet routes can quietly expand reachability. Re-audit routing regularly, and constrain by ports and entry-point devices. If you don’t need it every day, consider disabling it.
Tailscale vs classic Zero Trust tooling (practical comparison)
Zero Trust tooling often targets perimeter and application access (VPN, CASB, secure web gateways, identity-aware proxies). Tailscale’s strong suit is endpoint-to-endpoint connectivity with an identity-aware policy model.
| Goal | Classic Zero Trust approach | Tailscale approach |
|---|---|---|
| Authenticate users | SSO + gateway sessions | Tailnet membership + identity integration |
| Authorize access to internal services | Proxy rules, firewall rules, IAM-to-network mapping | ACLs tied to groups/tags/ports |
| Reduce lateral movement | Network segmentation plus endpoint controls | Identity and device-scoped network reachability |
| Operational simplicity | Multiple components with boundary failures | Central policy model with connection-level visibility |
| Extending to on-prem networks | VPN + routes + host firewall complexity | Subnet routes with explicit guardrails |
Important nuance: you can and should still use other security controls. Tailscale isn’t a replacement for patching, vulnerability management, endpoint hardening, or service-level auth. It’s a strong “policy and connectivity” layer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting when access doesn’t work
When connectivity fails, don’t guess. Use the same disciplined approach every time: determine whether the problem is authentication, device eligibility, ACL authorization, DNS/name resolution, or routing.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute1) Confirm the user is authenticated to the tailnet
If the client can’t authenticate, you’ll see failures before ACLs even matter. Verify login status and ensure the account is still active in your identity provider.
2) Check device status and approval
A common gotcha is a device that joined but isn’t approved for policy targeting. Confirm the device is present in the admin console and assigned to the right owner/tags.
3) Identify the exact destination and port
ACLs are often port-specific. If your rule allows 443 but the client is actually reaching 8443 (or vice versa), it’ll fail. Confirm the real port with the client config or by checking the service endpoint.
4) Validate DNS resolution
If you use names instead of IPs, make sure the name resolves to the expected tailnet IP. DNS drift can make you test the wrong endpoint—and then you’ll misdiagnose the ACL.
5) Use logs to pinpoint the rule decision
Tailscale logs typically show connection attempts and denials. Look for patterns like “no matching ACL allow rule” vs “device not eligible” vs “subnet route not permitted.”
6) Common fixes that shouldn’t be your first move
- Don’t broaden ACLs to an entire group “temporarily” without scoping by port and destination tag.
- Don’t disable device approvals to get unstuck. Fix tagging and device eligibility first.
- Don’t rely on IP allow rules for long-term policy; tags and groups keep policy durable.
FAQs
Does saying Zero Trust is broken mean Tailscale is less secure?
No. It means the label can be misused. What matters is enforcement: identity, authorization, least privilege, and visibility. Tailscale focuses on making those concrete with ACLs and device/account mapping.
Is Tailscale only for small teams?
Not anymore. While many early deployments were small, the policy primitives (groups, tags, ACLs, and centralized management) scale with careful structure. The biggest scaling constraint is usually operational discipline, not Tailscale itself.
Can I use Tailscale for server-to-server access?
Yes. In fact, it’s one of the cleanest use cases. Tag servers by role, restrict client groups to specific ports, and avoid broad “flat” access patterns that turn internal networks into shared trust zones.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Will Tailscale replace VPN?
For many organizations, it reduces the need for VPN-based lateral connectivity. But there are environments where VPN still makes sense (legacy tooling, specific network constraints). Treat Tailscale as a policy-driven overlay; decide per application and per network boundary.
What’s the fastest safe path to improve security?
Start by connecting identity, enabling device approval, and adding ACLs that are port- and tag-specific. Then ratchet permissions by removing broad rules after you verify logs and connection behavior.
Bottom Line
Tailscale’s “Zero Trust is broken” framing is a challenge to security theater. If you can’t clearly explain and enforce who can reach which services from which devices, then the concept doesn’t help—regardless of the name.
When you implement identity-first authorization with least-privilege ACLs, device controls, and disciplined routing/DNS, you get security that’s easier to verify and harder to accidentally weaken. That’s the good part.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
