I've just completed a phased implementation of Tailscale to create a segmented network specifically for handling payment card data, aiming to meet PCI DSS requirements for network segmentation and restricted access. My background is primarily in ERP systems like NetSuite and managing complex supply chain integrations, so this dive into networking for compliance was a new, but necessary, challenge for our manufacturing and B2B ecommerce operations.
Our environment consists of several on-premises servers for inventory management and order processing, a cloud-based ERP, and a few legacy systems that needed to interface with a new, isolated payment processing application. The goal was to ensure that only explicitly authorized personnel and systems could reach this payment segment, with all access logged and controllable. After evaluating traditional VPNs and more complex firewall rule sets, we decided to pilot Tailscale due to its promise of a zero-trust model and relatively simple management.
The implementation itself was straightforward for the most part. We installed Tailscale on the payment application server and designated it as a subnet router, then gradually added other necessary nodes like the specific workstations for our finance team and the single integration server that needs to submit batch files. Using ACLs in the admin panel to define tags and restrict access so that only tagged devices can even see the payment server was a clear win. The fact that it uses existing OS credentials and doesn't require opening inbound firewall ports on our premises felt significantly more secure from the start.
However, being cautious, I have a number of detailed questions after running this in a monitoring phase for a few weeks. I am particularly interested in the experiences of others who have used Tailscale for similar compliance-driven segmentation, especially in regulated or audit-heavy environments like manufacturing or healthcare.
* From a logging and audit perspective, how detailed are the Tailscale admin console logs for proving "who accessed what and when" to an external auditor? Are the connection logs sufficient, or did you need to supplement with additional system-level logging on the individual nodes?
* Concerning the stability of the subnet routers, have you encountered any scenarios where the advertised routes became unstable or required manual intervention? Our payment server is critical, and any loss of its route would break our checkout process.
* I am also thinking about the scenario of a device being lost or stolen. We are using device approval and key expiry, but I am curious about real-world response procedures. How quickly can you, in practice, revoke a device's access in the admin console, and is that revocation truly immediate from a network perspective?
* Finally, for those with hybrid environments, have you integrated Tailscale access controls with existing directory services like Azure AD or Okta beyond the initial login? We are considering if we need to layer on additional group policy or endpoint security measures on the devices themselves, even though they are on the Tailscale network.
I would greatly appreciate any insights, especially any pitfalls you encountered during your own audits or unexpected issues that arose after the initial implementation seemed sound. The documentation is good, but firsthand experience with the nuances of maintaining this setup under compliance scrutiny is what I'm seeking to understand.