Write your first grant

Let’s write one narrow rule: your user may reach TCP port 22 on the lab server. One rule, one port, one destination.

If this works, you understand the whole model. Everything after is repetition with different values.

Prepare the tag

The source is your real tailnet identity. The destination is a server tag. Tags need owners before they can be assigned, so declare that first in the policy file:

{
  "tagOwners": {
    "tag:server": ["[email protected]"]
  }
}

This says: Flavio may put tag:server on devices. Now tag the lab server, either from the machine list in the admin console or from the server itself:

sudo tailscale up --advertise-tags=tag:server

Once tagged, the node’s identity is its role, not your user account. In tailscale status the owner column changes from your email to tagged-devices.

Write the grant

The ip capability names the protocol and port. Add this to the grants section, replacing the wildcard grant from the previous lesson:

{
  "grants": [
    {
      "src": ["[email protected]"],
      "dst": ["tag:server"],
      "ip": ["tcp:22"]
    }
  ]
}

Replace [email protected] with your identity.

Be careful about where you save this from. Use an existing recovery session, not a session that depends on the policy you are editing. If you edit the policy over tailnet SSH and the edit breaks tailnet SSH, you have locked the door with the keys inside.

Verify both directions

Now check that SSH works and that an unrelated port does not:

ssh ubuntu@lab-server           # should connect
nc -zv -w 3 lab-server 5432     # should time out

The second command matters as much as the first. A policy that allows what you want proves nothing until you also confirm it blocks what you did not grant. Port 5432 stands in for anything else running on the server: nothing granted, nothing reachable.

If SSH fails after the change, check the exact spelling of your identity and the tag. A typo in src silently matches nobody, and deny by default does the rest. It is very easy to lose twenty minutes to a missing letter in an email address. Check the spelling first.