{"slug":"manage-client-preferences","title":"Manage client preferences","tags":["tailscale"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Manage client preferences\r\n\r\nLast validated: Jan 5, 2026\r\n\r\n[Admins](https://tailscale.com/docs/reference/user-roles) can manage devices on a network, and restrict which devices can connect using access control policies.\r\n\r\nIndividual users still have control over their own devices, to block incoming connections from Tailscale or to ignore Tailscale's DNS settings and advertised routes.\r\n\r\n## [Default configuration](https://tailscale.com/docs/features/client/manage-preferences\\#default-configuration)\r\n\r\nBy default, a Tailscale client will:\r\n\r\n- Allow incoming connections\r\n- Use Tailscale DNS settings\r\n\r\nmacOS, Windows, and other non-Linux devices use Tailscale subnets by default. Linux devices do not use Tailscale by default.\r\n\r\n## [Allow incoming connections](https://tailscale.com/docs/features/client/manage-preferences\\#allow-incoming-connections)\r\n\r\nIf other devices in your tailnet are allowed to connect to your device based on access control policies, then the connection will be created. Access control policies are directional, so that an access rule allowing your laptop to connect to a web server does not allow the web server to establish connections to your laptop.\r\n\r\nIf you want to block all incoming connections, you can do so. This is also known as \"shields up\". In the menu bar of your device,\r\nuncheck **Allow incoming connections**. When unchecked, your device will still\r\nbe visible and allowed to _send_ traffic, but won't _accept_ any connections\r\nover Tailscale, including pings.\r\n\r\n### [Toggling incoming connections](https://tailscale.com/docs/features/client/manage-preferences\\#toggling-incoming-connections)\r\n\r\nThis can be configured in the client menu bar or the CLI.\r\n\r\n### [In the client menu bar](https://tailscale.com/docs/features/client/manage-preferences\\#in-the-client-menu-bar)\r\n\r\n[macOS](https://tailscale.com/docs/features/client/manage-preferences?tab=macos) [iOS](https://tailscale.com/docs/features/client/manage-preferences?tab=ios) [Android](https://tailscale.com/docs/features/client/manage-preferences?tab=android) [Windows](https://tailscale.com/docs/features/client/manage-preferences?tab=windows) [Linux](https://tailscale.com/docs/features/client/manage-preferences?tab=linux)\r\n\r\nIf you are running Tailscale v1.60.0 or later, from the menu bar, select Tailscale, select **Settings**, and then check/uncheck **Allow incoming connections**.\r\n\r\n![Tailscale Settings window with the 'Settings' tab selected. The 'Allow incoming connections' checkbox is checked.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fallow-incoming-macos.071628a1.png&w=1080&q=75)\r\n\r\nIf you are running a version of Tailscale earlier than v1.60.0, from the menu bar, select Tailscale and check/uncheck **Allow incoming connections**.\r\n\r\n![The Tailscale application menu opened from the macOS menu bar with the 'Allow incoming connections' option checked.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fallow-incoming-macos-legacy.9398201b.png&w=1080&q=75)\r\n\r\n### [In the CLI](https://tailscale.com/docs/features/client/manage-preferences\\#in-the-cli)\r\n\r\nTo block incoming connections:\r\n\r\n```shell\r\ntailscale set --shields-up\r\n```\r\n\r\nTo allow incoming connections (default):\r\n\r\n```shell\r\ntailscale set --shields-up=false\r\n```\r\n\r\n## [Use Tailscale DNS settings](https://tailscale.com/docs/features/client/manage-preferences\\#use-tailscale-dns-settings)\r\n\r\nIf an Admin has configured [DNS settings for your tailnet, including MagicDNS or split DNS](https://tailscale.com/docs/reference/dns-in-tailscale), then DNS queries for devices in your Tailscale network will respect those settings.\r\n\r\nIf you are using an [exit node](https://tailscale.com/docs/features/exit-nodes), your local DNS is the DNS for the exit node, not your device.\r\n\r\nThis can be configured in the client menu bar or the CLI.\r\n\r\n### [In the client menu bar](https://tailscale.com/docs/features/client/manage-preferences\\#in-the-client-menu-bar-1)\r\n\r\nIf you want to only use local DNS, in the menu bar of your device, uncheck **Use Tailscale DNS settings**.\r\n\r\n### [In the CLI](https://tailscale.com/docs/features/client/manage-preferences\\#in-the-cli-1)\r\n\r\nTo use Tailscale DNS settings (default):\r\n\r\n```shell\r\ntailscale set --accept-dns=true\r\n```\r\n\r\nTo not use Tailscale DNS settings:\r\n\r\n```shell\r\ntailscale set --accept-dns=false\r\n```\r\n\r\n## [Use Tailscale subnets](https://tailscale.com/docs/features/client/manage-preferences\\#use-tailscale-subnets)\r\n\r\nIf an Admin has created [subnet routes](https://tailscale.com/docs/features/subnet-routers) for your tailnet, then Tailscale will route your device's traffic for the advertised subnets to the appropriate subnet router.\r\n\r\nThis can be configured in the client menu bar or the CLI.\r\n\r\n### [In the client menu bar](https://tailscale.com/docs/features/client/manage-preferences\\#in-the-client-menu-bar-2)\r\n\r\nIf you want to ignore the advertised routes, in the menu bar of your device, uncheck **Use Tailscale subnets**.\r\n\r\n### [In the CLI](https://tailscale.com/docs/features/client/manage-preferences\\#in-the-cli-2)\r\n\r\nTo use Tailscale subnets (default, except for Linux):\r\n\r\n```shell\r\ntailscale set --accept-routes=true\r\n```\r\n\r\nTo not use Tailscale subnets (default on Linux):\r\n\r\n```shell\r\ntailscale set --accept-routes=false\r\n```\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Manage client preferences

\n

Last validated: Jan 5, 2026

\n

Admins can manage devices on a network, and restrict which devices can connect using access control policies.

\n

Individual users still have control over their own devices, to block incoming connections from Tailscale or to ignore Tailscale's DNS settings and advertised routes.

\n

Default configuration

\n

By default, a Tailscale client will:

\n\n

macOS, Windows, and other non-Linux devices use Tailscale subnets by default. Linux devices do not use Tailscale by default.

\n

Allow incoming connections

\n

If other devices in your tailnet are allowed to connect to your device based on access control policies, then the connection will be created. Access control policies are directional, so that an access rule allowing your laptop to connect to a web server does not allow the web server to establish connections to your laptop.

\n

If you want to block all incoming connections, you can do so. This is also known as \"shields up\". In the menu bar of your device,\r\nuncheck Allow incoming connections. When unchecked, your device will still\r\nbe visible and allowed to send traffic, but won't accept any connections\r\nover Tailscale, including pings.

\n

Toggling incoming connections

\n

This can be configured in the client menu bar or the CLI.

\n

In the client menu bar

\n

macOS iOS Android Windows Linux

\n

If you are running Tailscale v1.60.0 or later, from the menu bar, select Tailscale, select Settings, and then check/uncheck Allow incoming connections.

\n

\"Tailscale

\n

If you are running a version of Tailscale earlier than v1.60.0, from the menu bar, select Tailscale and check/uncheck Allow incoming connections.

\n

\"The

\n

In the CLI

\n

To block incoming connections:

\n
tailscale set --shields-up\n
\n

To allow incoming connections (default):

\n
tailscale set --shields-up=false\n
\n

Use Tailscale DNS settings

\n

If an Admin has configured DNS settings for your tailnet, including MagicDNS or split DNS, then DNS queries for devices in your Tailscale network will respect those settings.

\n

If you are using an exit node, your local DNS is the DNS for the exit node, not your device.

\n

This can be configured in the client menu bar or the CLI.

\n

In the client menu bar

\n

If you want to only use local DNS, in the menu bar of your device, uncheck Use Tailscale DNS settings.

\n

In the CLI

\n

To use Tailscale DNS settings (default):

\n
tailscale set --accept-dns=true\n
\n

To not use Tailscale DNS settings:

\n
tailscale set --accept-dns=false\n
\n

Use Tailscale subnets

\n

If an Admin has created subnet routes for your tailnet, then Tailscale will route your device's traffic for the advertised subnets to the appropriate subnet router.

\n

This can be configured in the client menu bar or the CLI.

\n

In the client menu bar

\n

If you want to ignore the advertised routes, in the menu bar of your device, uncheck Use Tailscale subnets.

\n

In the CLI

\n

To use Tailscale subnets (default, except for Linux):

\n
tailscale set --accept-routes=true\n
\n

To not use Tailscale subnets (default on Linux):

\n
tailscale set --accept-routes=false\n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}