First boot

A new gateway configures itself like a home router: join its Wi-Fi, open the setup page, and answer a few questions. No serial tools, IP knowledge or Tailscale experience needed.

Install the firmware from the browser installer or the Easy Install package.
Power the board. After a few seconds it opens an open Wi-Fi network called ESP32-Tailnet-Setup-XXXX (XXXX identifies your board).
Join that network with a phone or computer. Most phones and PCs then show a sign-in notification or open the setup page by themselves.
If nothing opens, open http://192.168.4.1/ in a browser. This address always works while the setup network is active.
Confirm it is yours: press the BOOT button on the board once. No reachable button? Connect USB, open a serial console at 115200 baud and enter the current 8-digit code it prints in the setup page.
Secure your gateway: create the admin password (at least 8 characters). There is no default password.
Choose the Internet uplink: Wi-Fi, a W5500 Ethernet cable or a cellular modem. For Wi-Fi, pick your home network, enter its password and press Test connection. Your phone may briefly lose the setup network. Ethernet and cellular are experimental and require external hardware; follow the wiring and APN prompts rather than choosing them on a Wi-Fi-only board.
Connect your Tailnet: paste a Tailscale or Headscale auth key, or skip and do it later from the dashboard.
Choose your gateway role: connect a device to your Tailnet, connect a network, IoT gateway, wake or recover a NAS/PC, Home Assistant & automation, or advanced configuration. Also name the gateway's own Wi-Fi and set its password.
Finish: the summary shows where the gateway will be, then it saves everything and restarts. Rejoin your home Wi-Fi and open a link from the last page: the address received during the Wi-Fi test, or the displayed .local name. The default is http://esp32-tailnet-xxxx.local/, where xxxx is the code of its setup Wi-Fi; a configured hostname can replace it. The client and LAN must support mDNS. If name resolution is unavailable, use the tested IP address. Once enrolled, the gateway's tailnet name is another option. Sign in: the roles you chose are highlighted under What do you want to do? at the end of the Status page.

The setup is available in English, Italiano, Español, 简体中文, Français and Deutsch. Select the language in the setup page; the browser also supplies the initial time zone.

Why the setup network is open, and how it is protected

The setup Wi-Fi has no password so that any phone can join it, but only a gateway that has never been configured opens it. An existing installation, including one updated from 1.13, never does.

Only the person holding the board can pair: the BOOT button or the console code must confirm, and only one pairing at a time is allowed.
Passwords and keys are encrypted in your browser before they cross the open network (X25519 key agreement and AES-256-GCM).
While unconfigured, the gateway exposes no other function and forwards nothing to your home network.

Remaining risk: someone nearby, during the few minutes of setup, could imitate the setup network with a fake one. Set the gateway up where you can see it.

Later, without Wi-Fi

If the home Wi-Fi disappears, the gateway opens its own protected Wi-Fi (the name and password you chose) after about a minute, so you can sign in and fix the settings. That recovery network never uses the open setup mode. See Device recovery.