Guide·July 10, 2026
How to connect to multiple Tailscale tailnets simultaneously
A practical, neutral guide to simultaneous multi-tailnet access: what account switching cannot do, when shared nodes, VMs, or userspace proxies fit, and where TailMux fits on macOS and Linux.
View as MarkdownYou can access resources in multiple independent Tailscale tailnets at the same time from one computer, but the right design depends on what “access” means. If an application, server, or VM can deliberately sit between the tailnets, use that simpler architecture. If one Mac or Linux workstation needs supported browser, command, SSH, or local TCP-tunnel access to resources in several tailnets without repeatedly switching accounts, TailMux is designed for that job.
TailMux creates an isolated profile for each tailnet and selects a profile from the configured hostname suffix. It keeps supported connections separate without changing the official Tailscale client. It is an application-layer routing tool, not an additional native system-wide VPN interface.
Why account switching is not simultaneous access#
Tailscale can retain more than one account and let a user switch between them. That is useful when only one tailnet is needed at a time, because the user avoids repeating a login flow. It does not give one local browser, shell, or database client a concurrent path to both tailnets. A switch changes the active connection, so it is not a replacement for a workflow where two independent resources must stay reachable together.
For the distinction in detail, read TailMux versus Tailscale fast user switching. If switching is enough for a workflow, it remains the simplest option.
Choose the smallest architecture that fits#
| Approach | Best when | Trade-off |
|---|---|---|
| Shared node or shared application endpoint | A service can be intentionally exposed to the people or tailnets that need it | Does not make one workstation a simultaneous member of independent tailnets |
| Fast user switching | Only one tailnet is needed at a time | It is still switching, so ongoing access through the other tailnet is interrupted |
| VM or container with a second client | A full second environment or system-level networking is genuinely required | You maintain an operating system, port forwarding, updates, and a boundary between tools |
| Manually managed userspace proxy | A small set of proxy-aware tools need one additional tailnet | Each tool needs proxy configuration and hostname dispatch remains your responsibility |
| Multiple daemons or namespaces on Linux | The machine itself must provide infrastructure-level behavior in each tailnet | Routes, DNS, firewall rules, and lifecycle need explicit administration |
| TailMux | A workstation needs supported hostname-preserving access paths across independent tailnets | It deliberately does not create another native system-wide VPN route |
The Linux-specific trade-offs, including second daemons, namespaces, containers, and userspace networking, are covered in the multiple-tailnets Linux guide.
Where TailMux fits#
TailMux runs a separate embedded userspace node for each configured profile. A local, loopback-only router receives a supported connection while its hostname is still known, matches that hostname to exactly one configured suffix, and dials only that profile. A name that is not classified is denied; a failed connection does not fall back to another profile.
Set up simultaneous access with TailMux#
- Install TailMux for macOS or Linux, then run
tailmux init. - Define one profile per tailnet and assign non-overlapping hostname suffixes. Validate the configuration with
tailmux config validate. - Start TailMux with
tailmux up, then authenticate each profile withtailmux profile login <profile>. - Choose the supported access path: browser PAC routing on macOS where documented,
tailmux sshfor SSH, a local TCP tunnel for a fixed client endpoint, or the command/proxy path for compatible HTTP tooling. - Check the selected profile before connecting with
tailmux test <hostname>.
The getting-started guide is the canonical setup reference. For a Mac-specific walkthrough, including browser routing, use connect to multiple tailnets on macOS.
Limitations and security#
Use TailMux only where its routing model matches the workload. Browser routing relies on a documented PAC and proxy path; SSH uses the TailMux SSH command; database, RDP, SMB, and similar TCP clients use a configured loopback tunnel. Resolve names through the appropriate profile rather than treating overlapping addresses as globally routable.
Read the limitations and routing model before adopting it for UDP, system-wide routing, raw IP, MagicDNS, subnet-route, or credential-storage assumptions. The same page explains the isolation guarantees and links to operational troubleshooting.
Next steps#
Download TailMux from the download page, read the profile configuration reference, or compare it with fast user switching and a VM before choosing an architecture. TailMux is independent of Tailscale and is not affiliated with, endorsed by, or sponsored by Tailscale Inc.
Skip the workarounds
TailMux keeps configured profiles reachable through supported hostname-preserving paths, with no cross-profile fallback. Review the routing limitations before choosing it for a workflow. The one-time license includes one year of updates.
Keep reading
TailMux is not affiliated with, endorsed by, or sponsored by Tailscale Inc.
Multiple Tailscale tailnets simultaneously — FAQ
Direct answers for the design and setup questions behind this workflow.
Can you connect to two Tailscale networks at the same time?
TailMux is built for simultaneous access to resources in multiple independent Tailscale tailnets on macOS and Linux. It keeps a separate profile per tailnet and routes supported hostname-based connections to the profile that owns the suffix.
What is the difference between fast user switching and simultaneous tailnets?
Fast user switching changes which account or tailnet is active. TailMux keeps its configured profiles available to supported paths and selects a profile per hostname-based connection, so a workflow does not need an account switch for every destination.
Do I need a VM (OrbStack or Lima) to use two tailnets on macOS?
No, not when the workload fits TailMux's documented browser, command, SSH, or local TCP-tunnel paths. A VM remains appropriate when you need a separate full operating environment or native system-level networking.
How is isolation between tailnets enforced?
A hostname owned by one profile never falls back to another. Overlapping suffixes are rejected during validation, unclassified names are not routed, and profile state, sockets, logs, and node identities stay separate.
What platforms does TailMux support?
macOS (menu-bar app plus CLI) and Linux (CLI). There is no Windows build today.
Is TailMux a tmux terminal project?
No. TailMux at tailmux.app is a multiple-tailnet connectivity tool for macOS and Linux. It is unrelated to browser-based tmux terminal projects with similar names.
Is TailMux affiliated with Tailscale?
No. TailMux is an independent CQ Fabrication tool and is not affiliated with, endorsed by, or sponsored by Tailscale Inc.