Tailscale VPN

On networks that already use Tailscale, Complement can join the existing tailnet instead of using a site-to-site VPN. Start with the VPN Overview if the setup questions haven’t been answered yet.

How It Works

Complement runs a gateway that joins the tailnet as a device named complement with the tag tag:complement. It connects out to Tailscale, so no public IP or firewall changes are required. The tailnet access rules control what the gateway can reach.

Removing the Complement device from the tailnet disconnects Complement at any time. Revoking the OAuth client as well keeps it from rejoining.

Create an OAuth Client

The gateway registers itself with an OAuth client from the tailnet. A tailnet admin sets it up:

• Add tag:complement to tagOwners in the tailnet policy file.
• In the admin console under Settings, then OAuth clients, create a client with write access to auth keys and the tag tag:complement.
• Send Complement the client secret through the one-time secure link Complement provides. Never send it by plain email.

Grant Access

Add a grant so tag:complement can reach only the hosts and ports provided to Complement. For example, to allow a file server on port 445:

"tagOwners": {
  "tag:complement": ["autogroup:admin"]
},
"grants": [
  {
    "src": ["tag:complement"],
    "dst": ["192.168.1.20"],
    "ip": ["tcp:445"]
  }
]

Grants add to any access the tailnet policy already allows. Review existing ACLs and grants that match tag:complement, including wildcard rules, and narrow them so the combined policy allows only the hosts and ports provided to Complement.

Reach LAN Hosts

Hosts Running Tailscale

The gateway reaches them directly at their Tailscale addresses. The grant controls which ones.

Hosts Without Tailscale

Machines such as CNC controllers and ERP servers often can’t run Tailscale. Run a subnet router on the same LAN that advertises the subnet, then approve the route in the admin console. Traffic arrives at those hosts from the subnet router’s LAN IP, so allow that address in any host firewall.

Troubleshooting

Issue	Possible Cause	Solution
The complement device never appears in the tailnet	The OAuth client secret is wrong, the client lacks the auth keys write scope, or it can’t assign tag:complement	Check the client’s scopes and tags, and that tag:complement is in tagOwners. Send Complement a new secret if the client is recreated
The device is connected but can’t reach a host	The tailnet access rules don’t grant tag:complement that host and port	Add a grant from tag:complement to the host and port
A LAN host doesn’t answer	No subnet router advertises its subnet, the route isn’t approved, or the host’s own firewall blocks the subnet router	Advertise and approve the subnet route, and allow the subnet router’s LAN IP on the host, such as in Windows Defender Firewall