Tailnet runbook · rfakhri100

Add a Windows laptop to the tailnet

Run these in order on each laptop. Open PowerShell as Administrator (right-click → Run as administrator). Steps must run top to bottom — each depends on the one before it.

Before you start: you need admin rights on the laptop, and you'll sign the Tailscale login into rfakhri100@gmail.com in the browser it opens.
1

Install Tailscale & join the tailnet

A browser opens — sign in as rfakhri100@gmail.com to link the device.

winget install --id Tailscale.Tailscale -e
tailscale up
2

Install & start the SSH server

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
3

Authorize the VM's key

Lets the vm00 server connect in without a password.

$key = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3AFSVlGeksVOF9BwUZ4OYDBpVDMhkIAXc2aU/mbM2+ vm00-to-pc'
Add-Content -Path C:\ProgramData\ssh\administrators_authorized_keys -Value $key
icacls C:\ProgramData\ssh\administrators_authorized_keys /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
4

Lock SSH to the tailnet only

Port 22 becomes reachable from the tailnet only — not local Wi-Fi, not the internet.

Disable-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
New-NetFirewallRule -Name sshd-tailscale -DisplayName 'OpenSSH (Tailscale only)' -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow -RemoteAddress 100.64.0.0/10