Several Tailscale tailnets, online at once.
Tailfuse is a menu-bar app for macOS, Windows and Linux. It runs one Tailscale node per tailnet and sends each hostname to the tailnet that owns it.
Type a hostname, see its tailnet
Tailfuse matches each hostname against the suffixes your profiles own. The longest match wins, and a name nobody owns is refused.
One local port in front of every tailnet
SOCKS5
The proxy that tailfuse run hands to a command, with DNS resolved on the tailnet side.
HTTP CONNECT
The same port answers tools that only take an HTTP proxy.
/tailfuse.pac
Browsers read the PAC file, send owned hostnames to the router and connect direct for the rest.
Isolation between tailnets
Two full Tailscale daemons fight over routes, DNS and firewall rules. Tailfuse runs each tailnet in userspace networking mode, so the kernel routing table stays as it was.
Leaves your Tailscale client alone
Each tailnet runs without a TUN device, a route or a DNS change. The official client keeps its primary tailnet.
Refuses hostnames nobody owns
Each suffix belongs to one profile and overlaps fail validation. An unowned name is refused, never sent to another tailnet.
Runs as your user
Tailfuse installs neither a root helper nor a kernel extension. The one system setting it changes is the PAC URL, cleared when you quit.
Pins a local port to a tailnet service
A tunnel maps a port on this machine to one service on one tailnet, so a database client connects with no proxy settings.
The same router in a terminal
The tailfuse command shares its core with the menu-bar app. Both read one config file.
profiles: personal: suffixes: [.home-lab.ts.net] work: suffixes: [.work.ts.net, .internal.example] accept_routes: true exit_node: exit-us tunnels: - name: prod-db profile: work listen: 127.0.0.1:5432 target: db.work.ts.net:5432
tailfuse profile login workSigns a profile in through the browser, once per tailnet.tailfuse upStarts everything and sets the system PAC.tailfuse statusShows each profile's state, hostname and Tailscale IPs.tailfuse ssh user@host.work.ts.netOpens SSH through the profile that owns the host.tailfuse run curl http://wiki.work.ts.netRuns any command with the proxy environment set.tailfuse envPrints the proxy environment for your shell.tailfuse downClears the system PAC.A license by optional donation
Two tailnets are free, forever. A third profile needs a license key, and the key costs what you choose: nothing, $10, or more. Keys are signed and verified offline: no phone-home, no account, no telemetry.
What does a license cost?
Whatever you choose, including nothing. The donation is optional, and a $0 key is the same key as a $10 one.
Is Tailfuse made by Tailscale?
No. Tailfuse is an independent tool. It runs the tailscaled binary, which stays under the Tailscale terms.
Does it replace the Tailscale app?
No. An installed Tailscale client keeps owning the primary tailnet, and Tailfuse adds the others beside it.
Can a server log in unattended?
Yes. Put a Tailscale auth key in that profile's config and it signs in with no browser step.