Move from connectivity to authorization

Joining the tailnet answers one question: who or what is this device? Access policy answers a different one: what may it reach? Keep these two apart in your head, because Tailscale keeps them apart in practice.

Up to now, everything in your practice tailnet could reach everything. New tailnets ship with a permissive starter policy so the first experience works without configuration:

{
  "grants": [
    {
      "src": ["*"],
      "dst": ["*"],
      "ip":  ["*"]
    }
  ]
}

Read it as: every device may reach every device on every port. Fine for a two-device experiment. Wrong for anything you plan to keep.

Deny by default

Once you replace that starter policy, Tailscale access controls are deny by default. Remove the wildcard grant and no packet flows anywhere until a rule allows it.

There is no “block” rule type. Rules grant access. They never add explicit deny entries. Anything not granted is denied.

This has one big consequence that I love: you can read a policy and know exactly what is reachable. There is no rule-ordering puzzle where a later deny overrides an earlier allow, like in a classic firewall. If it is not in the file, it is not allowed.

What a grant contains

Modern policies use grants for network and application capabilities. A grant names sources, destinations, and the IP protocols or ports it allows:

{
  "src": ["[email protected]"],
  "dst": ["tag:server"],
  "ip":  ["tcp:22"]
}

Sources and destinations can be users, groups, tags, or autogroups. The ip field narrows the grant to protocols and ports. This one says: Flavio may reach TCP port 22 on anything tagged tag:server. We will write and apply a real one in the next lesson.

Start from a sentence

Before touching JSON, write one sentence describing who should reach the lab server, on which port, and why. Everything else stays ungranted.

Mine reads: “My user may reach TCP port 22 on servers tagged tag:server, to administer them over SSH.”

If you cannot write the sentence, you are not ready to write the rule. The sentence forces you to name the source, the destination, and the purpose. That is exactly what a reviewer will ask about later, and exactly what you will need when you come back to this file in a year.