Skip to main content
A Tailscale gateway joins your tailnet as a device. Agents then reach any address your tailnet can reach, including subnets behind your subnet routers.

​
Prerequisites

Before you start, ensure that:
  • Your plan includes Tailscale. Scale and above include it. On another plan, the option shows a plan badge; click it to upgrade, or contact the Asteroid team.
  • You have a Tailscale auth key. Create one in the Tailscale admin console, under Settings → Keys:
    • Reusable. The gateway runs two devices, and each joins again on every restart.
    • Ephemeral (recommended). Old devices then leave the tailnet on their own.
    • Tags (recommended). Tag the key, for example tag:asteroid, and write ACLs that let that tag reach only the apps your agents need.
    Keys expire after at most 90 days.

​
Set it up

  1. In Environments → Gateways, click New gateway and pick Tailscale.
  2. Name it, paste the auth key, and click Create gateway.
  3. Wait for Connected. The devices appear in your tailnet as gw- followed by the gateway’s ID.
  4. Pick the gateway on an environment.
The gateway accepts the routes your subnet routers advertise. Addresses outside your tailnet still leave from Asteroid’s network.

​
Replace the key

Replace the key before it expires. Open the gateway, click Edit, enter the New auth key, and save. The gateway reconnects with the new key.

​
Troubleshooting