# Tailnet policy file Last validated May 21, 2025 The tailnet policy file is a centralized [human JSON (HuJSON)][xt-hujson] configuration file that stores parameters, policies, and settings for your Tailscale network (known as a tailnet). [Owners, Admins, and Network admins](/docs/reference/user-roles/) can manage your tailnet policy file from the Tailscale admin console. You can also manage the tailnet policy file with [GitOps][kb-gitops] using GitHub, GitLab, or Bitbucket. The tailnet policy file is organized into multiple top-level [sections][ar-sections], each offering different functionality. You can use the various sections of the tailnet policy file to: * Define named groupings of users, devices, and network segments with [tags][kb-tags], [groups][kb-targets-groups], and [IP sets][kb-ipsets]. * Define access control policies at the [network layer][kb-osi-l3] using [ACLs][kb-acls]. * Define access control policies at the [network layer][kb-osi-l3] and [application layer][kb-osi-l7] using [grants][kb-grants]. * Assign aliases to IP addresses and [subnets][kb-subnets] (using the `hosts` section). * Define [device posture][kb-device-posture] rules. * Specify who can use [Tailscale SSH][kb-tailscale-ssh]. - Specify who can use which [tags][kb-tags] to authenticate devices. - Specify who can bypass the approval process to advertise [subnet routers][kb-subnets] and [exit nodes][kb-exit-nodes]. - Apply additional attributes called [node attributes][kb-nodeattr-syntax] to devices and users. - Write tests to make assertions about access policies ([ACLs][kb-acls] and [Tailscale SSH][kb-tailscale-ssh]) that should not change. - Define tailnet-wide policy options (such as disabling IPv4). Using the different sections of the tailnet policy file in unison lets you manage your tailnet in a modular and fine-grained manner. For example, you can define a custom group of users, then create an access control policy to specify how the users in that group can traverse the resources in your tailnet. ## Sections The following table provides an overview of each top-level section of the tailnet policy file. | Section | Name | What it's for | Resources | | --------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- | | `acls` | Access control lists (ACLs) | Create network-level access control policies. | [Syntax reference →][kb-acls-syntax] | | `autoApprovers` | Auto approvers | Specify who can bypass the approval process to advertise [subnet routers][kb-subnets], and [exit nodes][kb-exit-nodes], and [app connectors][kb-app-connectors]. | [Syntax reference →][kb-autoapprovers-syntax] | | `grants` | Grants | Define network-level and application-level access control policies. | [Syntax reference →][kb-grants-syntax] | | `groups` | Groups | Define named groups of users, devices, and subnets to target in access control policies and other definitions. | [Syntax reference →][kb-groups-syntax] | | `hosts` | Hosts | Define named aliases for devices and subnets. | [Syntax reference →][kb-hosts-syntax] | | `ipsets` | IP sets | Define [named network segments][kb-ipsets] to target in access control policies and other definitions. | [Syntax reference →][kb-ipsets-syntax] | | `nodeAttr` | Node attributes | Apply additional attributes to devices and users. | [Syntax reference →][kb-nodeattr-syntax] | | `postures` | Device posture policies | Define [device posture][kb-device-posture] rules to target in access control policies. | [Syntax reference →][kb-postures-syntax] | | `ssh` | Tailscale SSH | Specify who can use [Tailscale SSH][kb-tailscale-ssh]. | [Syntax reference →][kb-ssh-syntax] | | `sshTests` | Tailscale SSH tests | Write tests to make assertions about [Tailscale SSH][kb-tailscale-ssh] that should not change. | [Syntax reference →][kb-ssh-tests-syntax] | | `tagOwners` | Tag owners | Define who can assign which [tags][kb-tags] to devices in your tailnet. | [Syntax reference →][kb-tag-owners-syntax] | | `tests` | Access control tests | Write tests to make assertions about access policies ([ACLs][kb-acls] and network-level [grants][kb-grants]) that should not change. | [Syntax reference →][kb-acl-tests-syntax] | There's also additional sections for [network policy options][kb-network-policy-options], such as disabling IPv4 and customizing the [DERP][kb-derp-servers] map. In most cases, these settings are unnecessary. | Section | What it's for | Resources | | --------------------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | `derpMap` | Customize the DERP servers that a tailnet uses. | [Syntax reference →][kb-network-policy-options-derpmap] | | `disableIPv4` | Disable using IPv4 in a tailnet. | [Syntax reference →][kb-network-policy-options-disableipv4] | | `OneCGNATRoute` | Modify the routes the Tailscale clients generate. | [Syntax reference →][kb-network-policy-options-onecgnatroute] | | `randomizeClientPort` | Control whether devices prefer a random port number or the default `41641` for WireGuard traffic. | [Syntax reference →][kb-network-policy-options-randomizeclientport] | [ar-sections]: #sections [kb-acl-tests-syntax]: /docs/reference/syntax/policy-file#tests [kb-acls-syntax]: /docs/reference/syntax/policy-file#acls [kb-acls]: /docs/features/access-control/acls [kb-app-connectors]: /docs/features/app-connectors [kb-autoapprovers-syntax]: /docs/reference/syntax/policy-file#auto-approvers [kb-derp-servers]: /docs/reference/derp-servers [kb-device-posture]: /docs/features/device-posture [kb-exit-nodes]: /docs/features/exit-nodes [kb-gitops]: /docs/gitops [kb-grants-syntax]: /docs/reference/syntax/policy-file#grants [kb-grants]: /docs/features/access-control/grants [kb-groups-syntax]: /docs/reference/syntax/policy-file#groups [kb-hosts-syntax]: /docs/reference/syntax/policy-file#hosts [kb-ipsets-syntax]: /docs/reference/syntax/policy-file#ip-sets [kb-ipsets]: /docs/features/tailnet-policy-file/ip-sets [kb-network-policy-options-derpmap]: /docs/reference/syntax/policy-file#derpmap [kb-network-policy-options-disableipv4]: /docs/reference/syntax/policy-file#disableipv4 [kb-network-policy-options-onecgnatroute]: /docs/reference/syntax/policy-file#onecgnatroute [kb-network-policy-options-randomizeclientport]: /docs/reference/syntax/policy-file#randomizeclientport [kb-network-policy-options]: /docs/reference/syntax/policy-file#network-policy-options [kb-nodeattr-syntax]: /docs/reference/syntax/policy-file#node-attributes [kb-osi-l3]: /docs/concepts/tailscale-osi#network-layer [kb-osi-l7]: /docs/concepts/tailscale-osi#application-layer [kb-postures-syntax]: /docs/reference/syntax/policy-file#postures [kb-ssh-syntax]: /docs/reference/syntax/policy-file#ssh [kb-ssh-tests-syntax]: /docs/reference/syntax/policy-file#ssh-tests [kb-subnets]: /docs/features/subnet-routers [kb-tag-owners-syntax]: /docs/reference/syntax/policy-file#tag-owners [kb-tags]: /docs/features/tags [kb-tailscale-ssh]: /docs/features/tailscale-ssh [kb-targets-groups]: /docs/reference/targets-and-selectors#groups [xt-hujson]: https://github.com/tailscale/hujson