How Tailscale-Style Mesh VPNs Work: Control Plane, WireGuard Data Plane and What You Trust

Mesh VPNs replaced the office VPN at many companies because they are easy to roll out and default to giving each device less. Interviewers ask about them because the security model is subtle: the vendor cannot read your traffic, yet it decides which devices yours will talk to.

Two planes

The data plane is WireGuard: each device has a key pair, and tunnels run between devices. The control plane is the coordination server: it authenticates users through single sign-on, registers each device's public key, compiles the access policy into per-device peer lists, and helps devices find each other through NATs. Relays (Tailscale calls them DERP servers) carry traffic when a direct path is impossible, without decrypting it.

What you trust

• Devices: a stolen laptop has a valid key until removed or expired.
• Your identity provider: whoever can sign in as a user can enrol a device as them.
• The coordination server: it cannot decrypt traffic, but it can add a public key to your devices' peer lists. Tailscale's Tailnet Lock makes devices accept only node keys signed by your own trusted devices; self-hosting with headscale removes the vendor from this role and makes the server yours to protect.
• The policy file: a broad rule during migration often stays forever.

Where access quietly widens

Subnet routers advertise whole networks into the mesh, recreating the flat network for anyone allowed the route. Exit nodes see a device's internet traffic. Reusable enrolment keys stored in CI can add devices until they expire. Each deserves an owner and narrow policy. Licensing also moves: NetBird, another mesh option, moved its server components to the AGPL in 2025, which matters if you modify and offer it as a service.

Day-to-day controls

Write the access policy as code, review changes like any other pull request, and start from default deny with tags for servers rather than rules naming people. Set device key expiry so laptops re-authenticate periodically, require device approval for new enrolments, and use ephemeral, single-use enrolment keys for CI runners that disappear when the job ends. Export the mesh's audit and connection logs to your SIEM and alert on new subnet routes, policy changes and devices enrolled outside working hours. Put application authentication on top: being able to reach a database port should never be the same as being allowed to log in to it. Review which users hold exit-node and subnet-router permissions every quarter, since those quietly grant the widest reach.

Answer pattern for interviews

Draw the two planes, say what each sees, threat-model the coordinator (rogue keys, identity provider compromise) and name node-key signing or self-hosting as the control. Then cover policy as code with default deny, short key expiry, ephemeral CI keys, and subnet routers as the usual weak spot. Remember that network reachability is not application authorisation.

Go deeper

The full worked answer with a what-if ladder is how mesh VPNs work. The underlying protocol is in how WireGuard works, and the access model comparison in VPN versus zero-trust network access.