You can use ACLs to control what clients can connect to. https://news.ycombinator.com/item?id=22665589 https://news.ycombinator.com/item?id=22665589 It doesnt

You can use ACLs to control what clients can connect to. https://news.ycombinator.com/item?id=22665589 https://news.ycombinator.com/item?id=22665589 It doesnt look like a nail/hammer/screw at all. Tailscale isnt configured how he wants out of the box, but using SSO to control access isnt a massively complex hurdle. Anyone with Office 365 will be able to use their Office account to authenticate, which is basically Cloud Active Directory, and way better (if its something you have) than maintaining a separate username/password database for the VPN. ACLs and a relay node are a good fit for the request. https://tailscale.com/kb/1019/install-subnets https://tailscale.com/kb/1019/install-subnets Cloud SSO might be a deal breaker, but it doesnt make the solution the wrong class of solution.