deploying-tailscale-for-zero-trust-vpn

为 Zero Trust VPN 部署 Tailscale

概述

Tailscale 是一个基于 WireGuard 构建的零信任网状 VPN，可在设备之间创建加密的点对点连接，无需传统 VPN 服务或复杂的网络配置。Tailscale 网络（tailnet）中的每个连接都使用 WireGuard 的 Noise 协议框架以及 Curve25519 密钥交换进行端到端加密。Tailscale 通过身份提供商对每个连接请求进行身份验证、强制执行细粒度的访问控制列表（ACL），并支持出口节点、子网路由器、MagicDNS 和 Tailscale SSH 等功能，从而实现零信任网络。对于偏好可自托管基础设施的组织，Headscale 提供了 Tailscale 控制服务的开源实现。

使用场景

• 在您的环境中部署或配置 deploying tailscale for zero trust vpn 功能时
• 建立符合合规要求的安全控制措施时
• 为该领域构建或改进安全架构时
• 执行需要此实现的安全评估时

先决条件

• 身份提供商（Okta、Azure AD、Google Workspace、GitHub 或兼容 OIDC）
• 运行受支持操作系统（Linux、Windows、macOS、iOS、Android、FreeBSD）的设备
• 配置 DNS 和防火墙规则的管理权限
• 了解 WireGuard 协议基础知识
• 用于子网路由需求的网络规划文档

架构

                    Tailscale Coordination Server
                    (or self-hosted Headscale)
                           |
                    Key Distribution
                    & NAT Traversal
                           |
         +-----------------+-----------------+
         |                 |                 |
    +----+----+      +----+----+      +----+----+
    | Node A  |<---->| Node B  |<---->| Node C  |
    | (Linux) |      | (macOS) |      |(Windows)|
    +---------+      +---------+      +---------+
    WireGuard         WireGuard        WireGuard
    Encrypted         Encrypted        Encrypted
    P2P Tunnel        P2P Tunnel       P2P Tunnel

    Each node connects directly to every other node.
    DERP relay servers used only when direct P2P fails.

安装与设置

Linux 安装

# Add Tailscale repository and install
curl -fsSL https://tailscale.com/install.sh | sh

# Start Tailscale and authenticate
sudo tailscale up

# Check connection status
tailscale status

# View assigned IP address
tailscale ip -4
tailscale ip -6

Windows / macOS 安装

# Windows: Download from https://tailscale.com/download/windows
# macOS: Install via Homebrew
brew install --cask tailscale

# Or download from https://tailscale.com/download/mac

Docker 部署

# docker-compose.yml for Tailscale sidecar
version: '3.8'
services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    hostname: my-service
    environment:
      - TS_AUTHKEY=tskey-auth-xxxxx  # Pre-auth key
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
    volumes:
      - tailscale-state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
      - sys_module
    restart: unless-stopped

volumes:
  tailscale-state:

Kubernetes 部署

# Tailscale operator for Kubernetes
apiVersion: v1
kind: Secret
metadata:
  name: tailscale-auth
  namespace: tailscale
type: Opaque
stringData:
  TS_AUTHKEY: "tskey-auth-xxxxx"
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: tailscale
  namespace: tailscale
spec:
  selector:
    matchLabels:
      app: tailscale
  template:
    metadata:
      labels:
        app: tailscale
    spec:
      containers:
      - name: tailscale
        image: tailscale/tailscale:latest
        env:
        - name: TS_AUTHKEY
          valueFrom:
            secretKeyRef:
              name: tailscale-auth
              key: TS_AUTHKEY
        - name: TS_KUBE_SECRET
          value: tailscale-state
        - name: TS_USERSPACE
          value: "true"
        securityContext:
          capabilities:
            add: ["NET_ADMIN"]

访问控制列表（ACL）

Tailscale ACL 使用声明式 JSON 格式定义谁可以访问 tailnet 中的哪些内容。默认策略为拒绝所有，使其在设计上即具备零信任特性。

{
  "acls": [
    // Engineering team can access development servers
    {
      "action": "accept",
      "src": ["group:engineering"],
      "dst": ["tag:dev-server:*"]
    },
    // SRE team can access production infrastructure
    {
      "action": "accept",
      "src": ["group:sre"],
      "dst": ["tag:production:22,443,8080"]
    },
    // Database access restricted to backend services
    {
      "action": "accept",
      "src": ["tag:backend"],
      "dst": ["tag:database:5432,3306,27017"]
    },
    // All employees can access internal tools
    {
      "action": "accept",
      "src": ["group:employees"],
      "dst": ["tag:internal-tools:443"]
    }
  ],

  "groups": {
    "group:engineering": ["[email protected]", "[email protected]"],
    "group:sre": ["[email protected]", "[email protected]"],
    "group:employees": ["autogroup:members"]
  },

  "tagOwners": {
    "tag:dev-server": ["group:engineering"],
    "tag:production": ["group:sre"],
    "tag:backend": ["group:sre"],
    "tag:database": ["group:sre"],
    "tag:internal-tools": ["group:sre"],
    "tag:container": ["group:sre"]
  },

  "ssh": [
    {
      "action": "check",
      "src": ["group:sre"],
      "dst": ["tag:production"],
      "users": ["root", "admin"]
    },
    {
      "action": "accept",
      "src": ["group:engineering"],
      "dst": ["tag:dev-server"],
      "users": ["autogroup:nonroot"]
    }
  ],

  "nodeAttrs": [
    {
      "target": ["autogroup:members"],
      "attr": ["funnel:deny"]
    }
  ]
}

出口节点与子网路由

配置出口节点

# On the exit node machine
sudo tailscale up --advertise-exit-node

# On the client machine, use the exit node
sudo tailscale up --exit-node=<exit-node-ip>

# Verify exit node routing
curl ifconfig.me  # Should show exit node's public IP

子网路由器配置

# Advertise local subnets through Tailscale
sudo tailscale up --advertise-routes=10.0.0.0/24,192.168.1.0/24

# Enable IP forwarding on Linux
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Accept routes on client
sudo tailscale up --accept-routes

Tailscale SSH（零信任 SSH）

Tailscale SSH 以基于身份的访问取代传统的 SSH 密钥管理。

# Enable Tailscale SSH on a server
sudo tailscale up --ssh

# Connect using Tailscale SSH (no SSH keys needed)
ssh user@hostname  # Authenticates via Tailscale identity

# Session recording (audit logging)
# Configure in ACL policy:
# "ssh": [{"action": "check", "src": [...], "dst": [...], "users": [...]}]
# "check" action requires re-authentication and records sessions

MagicDNS 配置

# MagicDNS is enabled by default in new tailnets
# Access devices by hostname instead of IP
ping my-server  # Resolves via MagicDNS

# Custom DNS configuration via admin console
# Split DNS: route specific domains to internal DNS servers
# Global nameservers: override default DNS resolution

使用 Headscale 自托管

# Install Headscale (open-source Tailscale control server)
wget https://github.com/juanfont/headscale/releases/latest/download/headscale_linux_amd64
chmod +x headscale_linux_amd64
sudo mv headscale_linux_amd64 /usr/local/bin/headscale

# Create configuration
sudo mkdir -p /etc/headscale
sudo headscale generate config > /etc/headscale/config.yaml

# Edit config for your environment
# Key settings:
#   server_url: https://headscale.example.com
#   listen_addr: 0.0.0.0:8080
#   private_key_path: /etc/headscale/private.key
#   db_type: sqlite3
#   db_path: /var/lib/headscale/db.sqlite

# Start Headscale
sudo headscale serve

# Create user and pre-auth key
headscale users create myorg
headscale preauthkeys create --user myorg --reusable --expiration 24h

# Connect Tailscale client to Headscale
tailscale up --login-server https://headscale.example.com

安全加固

密钥过期与轮换

# Set key expiry in admin console (default: 180 days)
# Force re-authentication periodically

# Disable key expiry for servers (use auth keys instead)
sudo tailscale up --authkey=tskey-auth-xxxxx

# Pre-auth keys for automated deployment
# Create ephemeral, single-use keys for CI/CD

设备授权

{
  "nodeAttrs": [
    {
      "target": ["autogroup:members"],
      "attr": [
        "mullvad:deny",
        "funnel:deny"
      ]
    }
  ],
  "autoApprovers": {
    "routes": {
      "10.0.0.0/24": ["group:sre"],
      "192.168.0.0/16": ["group:sre"]
    },
    "exitNode": ["group:sre"]
  }
}

网络锁定（Tailnet Lock）

# Initialize network lock with signing keys
tailscale lock init

# Add trusted signing keys
tailscale lock add nodekey:xxxxx

# All new nodes require signing before joining
# Prevents unauthorized nodes from joining the tailnet

监控与可观测性

# View network status
tailscale status --json | jq '.Peer | to_entries[] | {name: .value.HostName, online: .value.Online, os: .value.OS}'

# Check connection quality
tailscale ping <peer-ip>

# View network map
tailscale netcheck

# Audit logs available in Tailscale admin console
# Integration with SIEM via webhook or API

集成模式

服务网格集成

# Tailscale as sidecar for service-to-service communication
# Each service gets a Tailscale identity
# ACLs enforce service-to-service access policies

# Example: API service can only reach database service
# ACL: tag:api -> tag:database:5432

CI/CD 流水线集成

# Use ephemeral auth keys in CI/CD
export TS_AUTHKEY=tskey-auth-xxxxx-ephemeral
tailscale up --authkey=$TS_AUTHKEY --hostname=ci-runner-$CI_JOB_ID

# Access internal resources during build/deploy
# Node automatically removed when container stops

参考资料

• Tailscale 文档
• Tailscale 工作原理
• Tailscale ACL 文档
• Headscale - 开源控制服务
• WireGuard 协议
• Tailscale SSH