{"slug":"ip-sets","title":"IP sets","tags":["tailscale","access-control","file-sharing"],"agent_summary":"Last validated: Oct 29, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# IP sets\r\n\r\nLast validated: Oct 29, 2025\r\n\r\nAn IP set is a way to manage groups of IP addresses. It can encapsulate a collection of [targets](https://tailscale.com/docs/reference/targets-and-selectors), such as IP addresses, CIDRs, hosts, [autogroups](https://tailscale.com/docs/reference/targets-and-selectors#autogroups), and other IP sets. Tailscale translates everything in the IP set to a list of IP address ranges. You can use the [`ipset` syntax](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#syntax) to create IP sets within your [tailnet policy file](https://tailscale.com/docs/features/tailnet-policy-file) and [reference](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#references) them from [access control](https://tailscale.com/docs/features/access-control) policies such as [ACLs](https://tailscale.com/docs/features/access-control/acls) and [grants](https://tailscale.com/docs/features/access-control/grants).\r\n\r\nThe primary benefit of IP sets is that they let you group multiple network parts into a single collection, enabling you to apply access control policies to the collection rather than the individual IP addresses, hosts, or subnets.\r\n\r\nYou can leverage IP sets in a variety of ways. For example, you can:\r\n\r\n- Target and manage logical cross-sections of your tailnet independently of other groupings like [subnets](https://tailscale.com/docs/features/subnet-routers), [tags](https://tailscale.com/docs/features/tags), and [groups](https://tailscale.com/docs/reference/syntax/policy-file#groups).\r\n- Target a subnet in access control policies while excluding a few specific hosts.\r\n- [Customize an autogroup](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#customize-autogroupinternet) to exclude some private or public subnets from global [exit node](https://tailscale.com/docs/features/exit-nodes) access.\r\n- Facilitate a more modular organization of your [tailnet policy file](https://tailscale.com/docs/features/tailnet-policy-file).\r\n\r\n## [Limitations](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#limitations)\r\n\r\nIP sets have the following limitations:\r\n\r\n- You can't include [tags](https://tailscale.com/docs/features/tags), [users](https://tailscale.com/docs/reference/user-roles), or [groups](https://tailscale.com/docs/reference/syntax/policy-file#groups) in IP sets.\r\n- You can't use circular references to IP sets.\r\n- The only supported [autogroup](https://tailscale.com/docs/reference/syntax/policy-file#autogroups) is `autogroup:internet`. This is because `autogroup:internet` is the only autogroup that refers to IP address ranges. The other autogroups refer to unsupported targets, such as tags, users, and dynamic sets of devices.\r\n\r\n## [Syntax](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#syntax)\r\n\r\nAn `ipset` is an object within the tailnet policy file that defines one or more named `ipsets`. Each named `ipset` contains one or more [operations](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#operations), each adding or removing a [target](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#targets).\r\n\r\nThe following example demonstrates the basic syntax for creating an `ipset` in the tailnet policy file where `` is the name of the IP set and `` is a CIDR, IP address, host, autogroup, or IP set.\r\n\r\n```json\r\n\"ipsets\": {\r\n \"ipset:\": [\\\r\n \"add \",\\\r\n \"remove \"\\\r\n ]\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n### [Operations](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#operations)\r\n\r\nThe `ipset` syntax supports two operations: `add` and `remove`. Each named IP set can have one or more operations, which are processed in order.\r\n\r\nYou must include the operation type before the [target](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#targets) unless the named [IP set only uses `add` operations](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#create-ip-sets-with-only-add-operations).\r\n\r\n| **Operation** | **Description** |\r\n| --- | --- |\r\n| `add` | Adds a target to a named IP set. |\r\n| `remove` | Removes a target from a named IP set. |\r\n\r\n### [Targets](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#targets)\r\n\r\nA target is a [CIDR](https://www.rfc-editor.org/rfc/rfc4632.html), IP address, [host](https://tailscale.com/docs/reference/syntax/policy-file#hosts), autogroup, or IP set that you add to or remove from a named IP set. Each target must be preceded by an [operation](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#operations) (`add` or `remove`) unless the named IP set only adds targets (and doesn't remove any IP addresses).\r\n\r\n| **Target** | **Syntax** | **Example** |\r\n| --- | --- | --- |\r\n| CIDR | `` | `192.0.2.0/24`, `2001:db8::/32` |\r\n| IP address | `` | `192.0.2.33`, `2001:db8::` |\r\n| IP address range | `-` | `192.0.2.50-192.0.2.100` , `2001:db8::5-2001:db8::9` |\r\n| Host | `host:` | `host:sql-server-1` |\r\n| Autogroup | `autogroup:internet` | `autogroup:internet` |\r\n| IP set | `ipset:` | `ipset:prod` |\r\n\r\nHosts refers to the [hosts](https://tailscale.com/docs/reference/syntax/policy-file#hosts) section of the tailnet policy file, not MagicDNS names.\r\n\r\n### [References](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#references)\r\n\r\nYou can reference named IP sets from specific parts of the tailnet policy file using the format `ipset:` where `` is the name of the IP set.\r\n\r\nThe following sections of the tailnet policy file support referencing IP sets:\r\n\r\n- [ACLs](https://tailscale.com/docs/features/access-control/acls) (sources and destinations)\r\n- [Grants](https://tailscale.com/docs/features/access-control/grants) (sources and destinations)\r\n- IP sets\r\n\r\n## [Examples](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#examples)\r\n\r\nThe following examples illustrate how to leverage IP sets.\r\n\r\n- [Create an IP set with only add operations](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#create-ip-sets-with-only-add-operations).\r\n- [Create an IP set that contains several subnets and excludes a single IP address](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#create-an-ip-set-that-adds-several-subnets-and-excludes-a-single-ip-address).\r\n- [Create an IP set that excludes another IP set](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#create-an-ip-set-that-excludes-another-ip-set).\r\n- [Reference IP sets in grants](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#reference-ip-sets-in-grants).\r\n- [Reference IP sets in ACLs](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#reference-ip-sets-in-acls).\r\n- [Customize `autogroup:internet`](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#customize-autogroupinternet).\r\n\r\n### [Create IP sets with only add operations](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#create-ip-sets-with-only-add-operations)\r\n\r\nThe following IP sets don't remove any [targets](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#targets). As a result, they can use a simplified syntax that omits the [operation type](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#operations) (because `add` is assumed).\r\n\r\n```json\r\n\"ipsets\": {\r\n \"ipset:prod\": [\"192.0.2.0/24\"],\r\n \"ipset:dev\": [\\\r\n \"198.51.100.0/24\",\\\r\n \"203.0.113.0/24\",\\\r\n \"host:sql-server-1\",\\\r\n ]\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n### [Create an IP set that adds several subnets and excludes a single IP address](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#create-an-ip-set-that-adds-several-subnets-and-excludes-a-single-ip-address)\r\n\r\nThe following example shows how to create an IP set that includes several subnets and excludes a single IP address.\r\n\r\n```json\r\n\"ipsets\": {\r\n \"ipset:prod\": [\\\r\n \"add 192.0.2.0/24\",\\\r\n \"add 2001:db8::/32\",\\\r\n \"add 198.51.100.0/24\",\\\r\n \"add 203.0.113.0/24\",\\\r\n \"remove 192.0.2.33\",\\\r\n ],\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n### [Create an IP set that excludes another IP set](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#create-an-ip-set-that-excludes-another-ip-set)\r\n\r\nThe following example creates a `dev` IP set and a `prod` IP set. The `prod` IP set excludes anything in the `dev` IP set.\r\n\r\n```json\r\n\"ipsets\": {\r\n \"ipset:dev\": [\"host:sql-server-1\"],\r\n \"ipset:prod\": [\\\r\n \"add 192.0.2.0/24\",\\\r\n \"add 198.51.100.0/24\",\\\r\n \"remove ipset:dev\",\\\r\n ]\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n### [Reference IP sets in grants](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#reference-ip-sets-in-grants)\r\n\r\nThe following example shows how to create [grants](https://tailscale.com/docs/features/access-control/grants) that [reference](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#references) the `dev` IP set.\r\n\r\n```json\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"group:devops\"],\\\r\n \"dst\": [\"ipset:dev\"],\\\r\n \"ip\": [\"80\",\"443\",\"22\"]\\\r\n },\\\r\n {\\\r\n \"src\": [\"group:dev\"],\\\r\n \"dst\": [\"ipset:dev\"],\\\r\n \"ip\": [\"80\",\"443\"],\\\r\n \"via\": [\"tag:office-routers\"],\\\r\n },\\\r\n]\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n### [Reference IP sets in ACLs](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#reference-ip-sets-in-acls)\r\n\r\nThe following example shows how to create [ACLs](https://tailscale.com/docs/features/access-control/acls) that [reference](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets#references) the `prod` IP set.\r\n\r\n```json\r\n\"acls\": [\\\r\n {\\\r\n \"src\": [\"group:devops\"],\\\r\n \"dst\": [\"ipset:prod:*\"],\\\r\n \"action\": \"accept\",\\\r\n },\\\r\n],\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n### [Customize `autogroup:internet`](https://tailscale.com/docs/features/tailnet-policy-file/ip-sets\\#customize-autogroupinternet)\r\n\r\nYou can use IP sets to customize the traffic that flows through an exit node (when enabled) in the tailnet using [`autogroup:internet`](https://tailscale.com/docs/reference/syntax/policy-file#autogroups).\r\n\r\nThe following example creates an IP set named `internet` that customizes `autogroup:internet` by doing the following:\r\n\r\n- Adds `autogroup:internet`.\r\n- Removes the production application gateways (`ipset:cdn-edge`).\r\n- Removes the publicly accessible partner network (`ipset:partner-net`).\r\n- [Grants](https://tailscale.com/docs/features/access-control/grants) the `internet` IP set (a subset of internet-bound traffic) access to the Seattle and London office [exit nodes](https://tailscale.com/docs/features/exit-nodes).\r\n\r\n```json\r\n\"ipsets\": {\r\n \"ipset:internet\": [\\\r\n \"add autogroup:internet\",\\\r\n \"remove ipset:cdn-edge\",\\\r\n \"remove ipset:partner-net\"\\\r\n ],\r\n \"ipset:cdn-edge\": [\"8.21.9.6\", \"8.21.9.7\", \"8.21.9.13\", \"8.21.9.14\"],\r\n \"ipset:partner-net\": [\"52.23.40.0/24\"]\r\n},\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"group:sea\"],\\\r\n \"dst\": [\"ipset:internet\"],\\\r\n \"ip\": [\"*\"],\\\r\n \"via\": [\"tag:officerouter-sea\"],\\\r\n },\\\r\n {\\\r\n \"src\": [\"group:lhr\"],\\\r\n \"dst\": [\"ipset:internet\"],\\\r\n \"ip\": [\"*\"],\\\r\n \"via\": [\"tag:officerouter-lhr\"],\\\r\n }\\\r\n]\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

IP sets

\n

Last validated: Oct 29, 2025

\n

An IP set is a way to manage groups of IP addresses. It can encapsulate a collection of targets, such as IP addresses, CIDRs, hosts, autogroups, and other IP sets. Tailscale translates everything in the IP set to a list of IP address ranges. You can use the ipset syntax to create IP sets within your tailnet policy file and reference them from access control policies such as ACLs and grants.

\n

The primary benefit of IP sets is that they let you group multiple network parts into a single collection, enabling you to apply access control policies to the collection rather than the individual IP addresses, hosts, or subnets.

\n

You can leverage IP sets in a variety of ways. For example, you can:

\n
    \n
  • Target and manage logical cross-sections of your tailnet independently of other groupings like subnets, tags, and groups.
    • \n
  • Target a subnet in access control policies while excluding a few specific hosts.
    • \n
  • Customize an autogroup to exclude some private or public subnets from global exit node access.
    • \n
  • Facilitate a more modular organization of your tailnet policy file.
    • \n
\n

Limitations

\n

IP sets have the following limitations:

\n
    \n
  • You can't include tags, users, or groups in IP sets.
    • \n
  • You can't use circular references to IP sets.
    • \n
  • The only supported autogroup is autogroup:internet. This is because autogroup:internet is the only autogroup that refers to IP address ranges. The other autogroups refer to unsupported targets, such as tags, users, and dynamic sets of devices.
    • \n
\n

Syntax

\n

An ipset is an object within the tailnet policy file that defines one or more named ipsets. Each named ipset contains one or more operations, each adding or removing a target.

\n

The following example demonstrates the basic syntax for creating an ipset in the tailnet policy file where <name> is the name of the IP set and <target> is a CIDR, IP address, host, autogroup, or IP set.

\n
\"ipsets\": {\r\n  \"ipset:<name>\": [\\\r\n    \"add <target>\",\\\r\n    \"remove <target>\"\\\r\n  ]\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Operations

\n

The ipset syntax supports two operations: add and remove. Each named IP set can have one or more operations, which are processed in order.

\n

You must include the operation type before the target unless the named IP set only uses add operations.

\n

| Operation | Description |\r\n| --- | --- |\r\n| add | Adds a target to a named IP set. |\r\n| remove | Removes a target from a named IP set. |

\n

Targets

\n

A target is a CIDR, IP address, host, autogroup, or IP set that you add to or remove from a named IP set. Each target must be preceded by an operation (add or remove) unless the named IP set only adds targets (and doesn't remove any IP addresses).

\n

| Target | Syntax | Example |\r\n| --- | --- | --- |\r\n| CIDR | <cidr> | 192.0.2.0/24, 2001:db8::/32 |\r\n| IP address | <ip-address> | 192.0.2.33, 2001:db8:: |\r\n| IP address range | <ip-range-start>-<ip-range-end> | 192.0.2.50-192.0.2.100 , 2001:db8::5-2001:db8::9 |\r\n| Host | host:<name> | host:sql-server-1 |\r\n| Autogroup | autogroup:internet | autogroup:internet |\r\n| IP set | ipset:<name> | ipset:prod |

\n

Hosts refers to the hosts section of the tailnet policy file, not MagicDNS names.

\n

References

\n

You can reference named IP sets from specific parts of the tailnet policy file using the format ipset:<name> where <name> is the name of the IP set.

\n

The following sections of the tailnet policy file support referencing IP sets:

\n
    \n
  • ACLs (sources and destinations)
    • \n
  • Grants (sources and destinations)
    • \n
  • IP sets
    • \n
\n

Examples

\n

The following examples illustrate how to leverage IP sets.

\n\n

Create IP sets with only add operations

\n

The following IP sets don't remove any targets. As a result, they can use a simplified syntax that omits the operation type (because add is assumed).

\n
\"ipsets\": {\r\n  \"ipset:prod\": [\"192.0.2.0/24\"],\r\n  \"ipset:dev\": [\\\r\n    \"198.51.100.0/24\",\\\r\n    \"203.0.113.0/24\",\\\r\n    \"host:sql-server-1\",\\\r\n  ]\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Create an IP set that adds several subnets and excludes a single IP address

\n

The following example shows how to create an IP set that includes several subnets and excludes a single IP address.

\n
\"ipsets\": {\r\n  \"ipset:prod\": [\\\r\n    \"add 192.0.2.0/24\",\\\r\n    \"add 2001:db8::/32\",\\\r\n    \"add 198.51.100.0/24\",\\\r\n    \"add 203.0.113.0/24\",\\\r\n    \"remove 192.0.2.33\",\\\r\n  ],\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Create an IP set that excludes another IP set

\n

The following example creates a dev IP set and a prod IP set. The prod IP set excludes anything in the dev IP set.

\n
\"ipsets\": {\r\n  \"ipset:dev\": [\"host:sql-server-1\"],\r\n  \"ipset:prod\": [\\\r\n    \"add 192.0.2.0/24\",\\\r\n    \"add 198.51.100.0/24\",\\\r\n    \"remove ipset:dev\",\\\r\n  ]\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Reference IP sets in grants

\n

The following example shows how to create grants that reference the dev IP set.

\n
\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"group:devops\"],\\\r\n    \"dst\": [\"ipset:dev\"],\\\r\n    \"ip\": [\"80\",\"443\",\"22\"]\\\r\n  },\\\r\n  {\\\r\n    \"src\": [\"group:dev\"],\\\r\n    \"dst\": [\"ipset:dev\"],\\\r\n    \"ip\": [\"80\",\"443\"],\\\r\n    \"via\": [\"tag:office-routers\"],\\\r\n  },\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Reference IP sets in ACLs

\n

The following example shows how to create ACLs that reference the prod IP set.

\n
\"acls\": [\\\r\n  {\\\r\n    \"src\":    [\"group:devops\"],\\\r\n    \"dst\":    [\"ipset:prod:*\"],\\\r\n    \"action\": \"accept\",\\\r\n  },\\\r\n],\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Customize autogroup:internet

\n

You can use IP sets to customize the traffic that flows through an exit node (when enabled) in the tailnet using autogroup:internet.

\n

The following example creates an IP set named internet that customizes autogroup:internet by doing the following:

\n
    \n
  • Adds autogroup:internet.
    • \n
  • Removes the production application gateways (ipset:cdn-edge).
    • \n
  • Removes the publicly accessible partner network (ipset:partner-net).
    • \n
  • Grants the internet IP set (a subset of internet-bound traffic) access to the Seattle and London office exit nodes.
    • \n
\n
\"ipsets\": {\r\n  \"ipset:internet\": [\\\r\n    \"add autogroup:internet\",\\\r\n    \"remove ipset:cdn-edge\",\\\r\n    \"remove ipset:partner-net\"\\\r\n  ],\r\n  \"ipset:cdn-edge\": [\"8.21.9.6\", \"8.21.9.7\", \"8.21.9.13\", \"8.21.9.14\"],\r\n  \"ipset:partner-net\": [\"52.23.40.0/24\"]\r\n},\r\n\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"group:sea\"],\\\r\n    \"dst\": [\"ipset:internet\"],\\\r\n    \"ip\":  [\"*\"],\\\r\n    \"via\": [\"tag:officerouter-sea\"],\\\r\n  },\\\r\n  {\\\r\n    \"src\": [\"group:lhr\"],\\\r\n    \"dst\": [\"ipset:internet\"],\\\r\n    \"ip\":  [\"*\"],\\\r\n    \"via\": [\"tag:officerouter-lhr\"],\\\r\n  }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}