TailMux

Product Introduction

1. Definition: TailMux is a specialized networking utility and proxy router application for macOS and Linux. It operates as a user-space client that enables simultaneous, isolated access to multiple independent Tailscale tailnets from a single workstation.
2. Core Value Proposition: TailMux exists to solve the fundamental limitation of the official Tailscale client, which can only maintain an active connection to one tailnet at a time. Its primary value is enabling developers, IT professionals, and hybrid workers to access resources across work, personal, and lab tailnets concurrently without the friction of account switching, running multiple system daemons, or resorting to virtual machines.

Main Features

1. Suffix-Based Hostname Routing: TailMux operates at the application proxy layer, inspecting the hostname of outgoing requests before DNS resolution occurs. It matches the hostname against user-configured, non-overlapping suffixes (e.g., .work.ts.net, .home-lab.ts.net) and routes the entire connection to the specific, isolated profile that owns that suffix. This "name as the routing key" principle is the core architectural decision.
2. Hardened Profile Isolation: Each configured tailnet profile runs as a fully isolated, embedded tsnet node within TailMux. This means separate node keys, independent state directories, unique control sockets, and distinct network namespaces. Critically, there is no fallback; a request for a hostname owned by one profile will never be forwarded to another profile or the system's default Tailscale client, ensuring strict security and traffic separation.
3. Multi-Protocol Access Paths: TailMux provides several integrated methods for routing traffic. This includes a system Proxy Auto-Configuration (PAC) file for automatic browser routing (Safari, Chrome, etc.), the tailmux env command to wrap shell commands, a built-in SOCKS5 proxy, direct TCP tunneling (tailmux tunnel), and a native SSH client (tailmux ssh) that automatically uses the correct profile based on the target hostname.
4. Comprehensive Diagnostics and CLI-First Design: The tool offers deep visibility with commands like tailmux diag path, which traces the routing decision, peer status, and network path (direct or via DERP) for a given hostname. The entire application is built as a CLI-first tool, with the macOS menu bar and web GUI acting as thin frontends to the same commands, ensuring everything is scriptable and automatable.

Problems Solved

1. Pain Point: The inefficiency and disruption of constantly logging in and out of different Tailscale accounts or tailnets on a single machine to access resources like internal APIs, databases, version control servers, or administrative interfaces.
2. Target Audience: The primary user personas are software developers, DevOps engineers, site reliability engineers (SREs), and IT administrators who regularly need access to resources in separate corporate, client, cloud, and personal/home-lab tailnets from their primary macOS or Linux development workstation or server.
3. Use Cases: A developer needs to run a git pull from a corporate GitHub Enterprise server on the work.ts.net tailnet while simultaneously running npm install from a private registry on a lab.ts.net tailnet. An administrator needs to SSH into a production server via a bastion host in a prod.ts.net tailnet while keeping an RDP session open to a management server in a mgmt.ts.net tailnet. A researcher needs to access data from a scientific instrument on a campus.ts.net tailnet while writing analysis code that pulls from a database in a collab.ts.net tailnet.

Unique Advantages

1. Differentiation: Unlike workarounds such as fast user switching, running multiple Tailscale daemons in containers, or using full virtual machines (e.g., OrbStack, Lima), TailMux provides a lightweight, integrated, and purpose-built solution. It does not create conflicting system-wide VPN routes or require managing separate OS environments. It is also distinct from Tailscale's own "shared node" feature, as it maintains strict isolation and user-controlled routing per tailnet, not per user within a tailnet.
2. Key Innovation: The innovation is the strict enforcement of routing decisions at the hostname/proxy layer before DNS resolution, combined with the use of isolated, embedded Tailscale nodes (tsnet). This creates a "hard wall" between profiles that is enforced by configuration validation (rejecting overlapping suffixes) and runtime logic, rather than being a user-configurable setting that could be accidentally disabled. This makes the system's behavior predictable and secure by design.

Frequently Asked Questions (FAQ)

1. Is TailMux an official Tailscale product? No, TailMux is an independent third-party tool developed by CQ Fabrication. It is not affiliated with, endorsed by, or sponsored by Tailscale Inc. It is a client that works with the Tailscale coordination server and protocol.
2. Does using TailMux interfere with my existing Tailscale client? No. TailMux runs completely independently. It does not modify, replace, or interact with the official Tailscale system daemon or its session. You can keep your primary tailnet connected via the official client while TailMux manages connections to additional tailnets.
3. Can TailMux route all traffic on my system? No, and this is by design. TailMux only routes traffic for the specific, configured hostname suffixes through its supported paths (browser via PAC, commands via env, explicit tunnels, or SSH). All other internet traffic flows directly, avoiding performance overhead and routing complexity for unrelated services.
4. What are the limitations of TailMux routing? TailMux cannot route traffic that does not present a hostname it can inspect. This includes low-level IP-based connections, some UDP-based protocols, and applications that bypass the system proxy settings or perform their own DNS resolution. It is designed for the documented HTTP/S, TCP tunnel, and SSH access paths.
5. Is TailMux a subscription service? No, TailMux is a one-time purchase which includes one year of updates. After that, the license is perpetual for the purchased version, though major new versions may require a new license.