![\"Project](\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\")
Last validated: May 21, 2025
\nThe tailnet policy file is a centralized human JSON (HuJSON) configuration file that stores parameters, policies, and settings for your Tailscale network (known as a tailnet). Owners, Admins, and Network admins can manage your tailnet policy file from the Tailscale admin console. You can also manage the tailnet policy file with GitOps using GitHub, GitLab, or Bitbucket.
\nThe tailnet policy file is organized into multiple top-level sections, each offering different functionality. You can use the various sections of the tailnet policy file to:
\nDefine named groupings of users, devices, and network segments with tags, groups, and IP sets.
\nDefine access control policies at the network layer using ACLs.
\nDefine access control policies at the network layer and application layer using grants.
\nAssign aliases to IP addresses and subnets (using the hosts section).
Define device posture rules.
\nSpecify who can use Tailscale SSH.
\nSpecify who can use which tags to authenticate devices.
\nSpecify who can bypass the approval process to advertise subnet routers and exit nodes.
\nApply additional attributes called node attributes to devices and users.
\nWrite tests to make assertions about access policies ( ACLs and Tailscale SSH) that should not change.
\nDefine tailnet-wide policy options (such as disabling IPv4).
\nUsing the different sections of the tailnet policy file in unison lets you manage your tailnet in a modular and fine-grained manner. For example, you can define a custom group of users, then create an access control policy to specify how the users in that group can traverse the resources in your tailnet.
\nThe following table provides an overview of each top-level section of the tailnet policy file.
\n| Section | Name | What it's for | Resources |\r\n| --- | --- | --- | --- |\r\n| acls | Access control lists (ACLs) | Create network-level access control policies. | Syntax reference → |\r\n| autoApprovers | Auto approvers | Specify who can bypass the approval process to advertise subnet routers, and exit nodes, and app connectors. | Syntax reference → |\r\n| grants | Grants | Define network-level and application-level access control policies. | Syntax reference → |\r\n| groups | Groups | Define named groups of users, devices, and subnets to target in access control policies and other definitions. | Syntax reference → |\r\n| hosts | Hosts | Define named aliases for devices and subnets. | Syntax reference → |\r\n| ipsets | IP sets | Define named network segments to target in access control policies and other definitions. | Syntax reference → |\r\n| nodeAttr | Node attributes | Apply additional attributes to devices and users. | Syntax reference → |\r\n| postures | Device posture policies | Define device posture rules to target in access control policies. | Syntax reference → |\r\n| ssh | Tailscale SSH | Specify who can use Tailscale SSH. | Syntax reference → |\r\n| sshTests | Tailscale SSH tests | Write tests to make assertions about Tailscale SSH that should not change. | Syntax reference → |\r\n| tagOwners | Tag owners | Define who can assign which tags to devices in your tailnet. | Syntax reference → |\r\n| tests | Access control tests | Write tests to make assertions about access policies ( ACLs and network-level grants) that should not change. | Syntax reference → |
There's also additional sections for network policy options, such as disabling IPv4 and customizing the DERP map. In most cases, these settings are unnecessary.
\n| Section | What it's for | Resources |\r\n| --- | --- | --- |\r\n| derpMap | Customize the DERP servers that a tailnet uses. | Syntax reference → |\r\n| disableIPv4 | Disable using IPv4 in a tailnet. | Syntax reference → |\r\n| OneCGNATRoute | Modify the routes the Tailscale clients generate. | Syntax reference → |\r\n| randomizeClientPort | Control whether devices prefer a random port number or the default 41641 for WireGuard traffic. | Syntax reference → |
Ask AI
\nreCAPTCHA
\nRecaptcha requires verification.
\nprotected by reCAPTCHA
\n"}