By default, and in the most common configuration, the Tailscale “idea” is to intercept all network requests made to a reserved IP range (100.x.x.x) that cannot

By default, and in the most common configuration, the Tailscale “idea” is to intercept all network requests made to a reserved IP range (100.x.x.x) that cannot have public services on it (similar to 192.168.x.x). Each of your devices gets a static IP and can reach any other of your devices using their static IP. All traffic will be encrypted, and it will work really really hard to get through all NAT gateways and firewalls in-between. As those static IPs are in a reserved range, they will never clash with a public service like a website and Tailscale does not mess with your regular traffic. You could make things more complicated by setting up exit nodes and exposing subnets, but that’s the general idea. So simple, it’s brilliant for their standard use-case.