{"slug":"ip-pool","title":"IP pool","tags":["tailscale"],"agent_summary":"Last validated: Jan 12, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# IP pool\r\n\r\nLast validated: Jan 12, 2026\r\n\r\nIP poolis currently [in beta](https://tailscale.com/docs/reference/tailscale-release-stages#beta).\r\n\r\nBy default, Tailscale assigns IPv4 addresses to nodes in your tailnet\r\nfrom the 100.64.0.0/10 [CGNAT range](https://tailscale.com/docs/concepts/tailscale-ip-addresses).\r\nThis is a private IP range not used on the public internet.\r\n\r\nThe following IP ranges are [reserved by Tailscale](https://tailscale.com/docs/reference/reserved-ip-addresses), and cannot be used in IP pools:\r\n\r\n- 100.100.0.0/24\r\n- 100.100.100.0/24\r\n- 100.115.92.0/23\r\n\r\nFor corporate networks that use parts of the same range for other\r\npurposes, you can configure Tailscale to use a specific smaller\r\nsubset of the CGNAT range.\r\n\r\nTo do this, you can configure an \"IP pool\" in your tailnet policy file.\r\nThis is done using a node attribute that specifies an `ipPool`:\r\n\r\n```json\r\n{\r\n \"grants\": [\"...\"],\r\n \"nodeAttrs\": [\\\r\n {\\\r\n \"target\": [\"autogroup:admin\"],\\\r\n \"ipPool\": [\"100.81.0.0/16\"],\\\r\n },\\\r\n {\\\r\n \"target\": [\"group:dev\"],\\\r\n \"ipPool\": [\"100.85.0.0/16\"],\\\r\n },\\\r\n ],\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\nWith this [node attribute](https://tailscale.com/docs/reference/syntax/policy-file#nodeattrs) set, all new nodes managed by admins in your tailnet will be assigned an IP\r\nfrom the range: `100.81.0.0/16`, whereas nodes managed by members of `group:dev` will be assigned an IP from a subset\r\nfrom the range: `100.85.0.0/16`.\r\n\r\nYou can also change the IPv4 address of a node at any time by an admin in your tailnet.\r\n\r\n![IPv4 Edit Dialog](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fedit-machine-ip.bc612c35.png&w=1080&q=75)\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

IP pool

\n

Last validated: Jan 12, 2026

\n

IP poolis currently in beta.

\n

By default, Tailscale assigns IPv4 addresses to nodes in your tailnet\r\nfrom the 100.64.0.0/10 CGNAT range.\r\nThis is a private IP range not used on the public internet.

\n

The following IP ranges are reserved by Tailscale, and cannot be used in IP pools:

\n\n

For corporate networks that use parts of the same range for other\r\npurposes, you can configure Tailscale to use a specific smaller\r\nsubset of the CGNAT range.

\n

To do this, you can configure an \"IP pool\" in your tailnet policy file.\r\nThis is done using a node attribute that specifies an ipPool:

\n
{\r\n  \"grants\": [\"...\"],\r\n  \"nodeAttrs\": [\\\r\n    {\\\r\n      \"target\": [\"autogroup:admin\"],\\\r\n      \"ipPool\": [\"100.81.0.0/16\"],\\\r\n    },\\\r\n    {\\\r\n      \"target\": [\"group:dev\"],\\\r\n      \"ipPool\": [\"100.85.0.0/16\"],\\\r\n    },\\\r\n  ],\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

With this node attribute set, all new nodes managed by admins in your tailnet will be assigned an IP\r\nfrom the range: 100.81.0.0/16, whereas nodes managed by members of group:dev will be assigned an IP from a subset\r\nfrom the range: 100.85.0.0/16.

\n

You can also change the IPv4 address of a node at any time by an admin in your tailnet.

\n

\"IPv4

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}