Blog

Notes from the network edge

Engineering deep dives, release notes, and opinions about how networks should work.

Most read: why NAT traversal is a solved problem (mostly)

Hole-punching, relay fallbacks, and a little optimism — the story of how mesh connections stay alive on hotel wifi, carrier NAT, and the world's weirdest corporate firewalls. The post our support team links to most often.

  • ✓The five NAT behaviors and the one that breaks everything
  • ✓When a relay path is actually faster than a bad direct one
  • ✓Reading connection logs to see which case you're in
the tailnet blog, by the numbers
engineeringdeep dives, post-mortems38%CORE
guidesplaybooks you can follow29%PRACTICAL
productreleases, design notes21%NEWS
case filesreal migrations, numbers12%FIELD
fluff—0%NEVER

All posts

Filter by what you came for.

NAT traversal — one thread weaving through a maze
Engineering

Why NAT traversal is a solved problem (mostly)

How hole-punching, relays, and a little optimism keep mesh connections alive on the world's weirdest networks.

Aug 12, 2026 · 9 min read
AI workload policies — GPUs behind a policy gate
Product

AI workload policies are now generally available

One policy file now governs which model providers your humans and your GPUs may reach. Here's how we built it.

Aug 4, 2026 · 6 min read
VPN migration — path from old appliance to mesh cloud
Guide

Migrating off a legacy VPN without a big-bang weekend

The parallel-run playbook: pilot group, subnet routers, and the moment you finally power off the concentrator.

Jul 28, 2026 · 11 min read
Deny by default — a page of rules gating a doorway
Security

Deny by default: writing ACLs people can read

Your access policy should fit on a page and survive a code review. Practical patterns for least privilege.

Jul 15, 2026 · 8 min read
MagicDNS — name resolving into an address
Engineering

MagicDNS under the hood

What happens between ping nas-01 and an answer — resolvers, search domains, and split DNS.

Jul 2, 2026 · 7 min read
Retired VPN — ticket stack dissolving into calm air
Case files

The 40-tickets-a-month VPN, retired

How one logistics helpdesk got its afternoons back. A walkthrough of the migration in numbers.

Jun 20, 2026 · 5 min read
SSH session recording — film strip onto a reel
Product

Session recording for SSH, beta

Every privileged session, captured and searchable. Announcing the beta and the design decisions behind it.

Jun 9, 2026 · 4 min read
Subnet routers — coffee, router, laptop, cloud
Guide

Subnet routers: the 10-minute VPC bridge

Advertise your first cloud subnet before your coffee cools. Includes the three approval mistakes everyone makes.

May 30, 2026 · 6 min read
Rust rewrite — flame graph tamed into blocks
Engineering

What we learned rewriting our control plane in Rust

Fewer allocations, fewer 3 a.m. pages, and one very educational flame graph.

May 14, 2026 · 12 min read

Demo site — articles are placeholders.

Blog FAQs

Can I subscribe instead of checking back?
The monthly digest carries new posts, major releases, and the best forum threads — one email, no drip sequence. RSS is there too if that's how you read.
Who writes these posts?
The engineers who shipped the thing being described. No ghostwriters — the Rust rewrite post was written by the person holding the flame graph. Support and security engineers contribute the field-guide and case-file posts.
Do you accept guest posts?
Yes, when the author did the migration they're describing. The case files series is guest-heavy by design: real numbers from real rollouts, edited lightly by us for clarity, never for spin.
Why do product announcements link to the changelog?
Because the changelog stays current and blog posts don't. The post explains the why; the changelog entry is what we keep updated as behavior evolves. Docs get the how, for the same reason.
What's your comment policy?
Comments live in the forum thread linked from each post — searchable, moderated for spam only. Disagreement is welcome; "you're wrong" without a config file is not.

Build networks worth writing about

Get started free Read the docs