Tailscale ACLs & Grants

~15 min · tailscale, acl, tags, grants

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

Access control for the tailnet

By default, every device on your tailnet can reach every other device on every port. For a single-user personal tailnet that's fine. As soon as you share with family, contractors, or coworkers, you'll want ACLs — rules that restrict who can reach what.

Tags decouple identity from machine

Rather than naming individual devices in ACLs (which churns when devices change), tag machines by role (tag:server, tag:dev, tag:prod). Then write ACLs against tags. Tags also let you give a server a stable identity that isn't tied to any single user account.

Grants — the next-gen syntax

Tailscale is migrating from the older ACL syntax to grants, which provide finer-grained capabilities — including SSH user-mapping, app-level controls, and time-limited access. New tailnets default to grants; old ones can opt in. The ACL example below shows both styles.

Code

Classic ACL syntax·json

{
  "groups": {
    "group:admin": ["you_username@github"],
    "group:family": ["spouse@github"]
  },
  "tagOwners": {
    "tag:server": ["group:admin"]
  },
  "acls": [
    { "action": "accept", "src": ["group:admin"], "dst": ["*:*"] },
    { "action": "accept", "src": ["group:family"], "dst": ["tag:server:80,443"] }
  ]
}

Grants syntax — finer SSH control·json

{
  "grants": [{
    "src": ["group:admin"],
    "dst": ["tag:server"],
    "app": {
      "tailscale.com/cap/ssh": [{
        "users": ["root", "you_username"]
      }]
    }
  }]
}

External links

Exercise

Open your Tailscale admin console (login.tailscale.com). Look at the current ACLs (Settings → Access Controls). For a single-user tailnet, you'll see the default accept */* rule. Don't change anything — just understand what's there. When you share the tailnet, that's the rule you'll replace.