Access rules

How the rules work

Every private network has its own access rules: open the network and its Access tab. A rule reads as a phrase — who → where · which ports:

• Only what a rule allows gets through. Traffic that no rule allows is blocked; there are no “deny” rules to write.
• A device always reaches itself.
• A rule works one way: “laptop → NAS” lets the laptop open connections to the NAS, and the answers come back, but the NAS can't start connections to the laptop without a rule of its own.
• With no active rules, nothing is allowed: the devices of the network don't see each other.

A new network starts with one rule — All devices → Everything · all ports — which is the same as “everything is allowed”. The dashboard builds the network's policy from the rules and applies it within seconds. If you'd rather write the policy by hand, see Custom HuJSON.

Add a rule

Add rule next to the Access rules heading opens the form Add a rule.

Press Add rule in the form. To change a rule, press the pencil (Edit) in its row: the same form opens with its values, and Save rule saves it. If a device of a rule has left the network, the form asks to pick another one instead of silently widening the rule.

“All devices” as a destination means the devices of the network, not the subnets behind them and not the internet; “Everything” includes all three.

Ports

• The quick choices: All ports, SSH 22, Web 80, 443, RDP 3389, SMB 445, DNS 53 — tick as many as you need.
• Your own ports: numbers and ranges separated by commas, for example 8080, 9000-9100, udp:51820.
• A port without tcp: or udp: is open for both protocols; with the prefix — for that one only.
• All ports overrides everything else ticked.
• Ports don't apply to the internet: an exit node is either allowed or not.
• A port is 1–65535; a rule holds up to 40 ports and ranges.

Device groups

A group is a named set of devices; use it in rules instead of listing devices one by one. Under Device groups each group is a row with the number of its devices:

• New group opens the form: type the Group name (1–40 characters, unique in the network), tick the devices and press Create group.
• A group's row unfolds into the same form: change the members or the name and press Save group: the rules that use it follow at once.
• Delete group also deletes the rules that use it — the confirmation says how many.

Presets

Presets next to the Access rules heading opens the list of presets. A preset replaces all the rules at once; groups stay. Apply asks for a confirmation.

Order, turning rules on and off

• The switch next to a rule turns it off without deleting it; an off rule is marked turned off. Turn it back on the same way.
• The arrows Move up and Move down change the order. Rules only allow, so the order doesn't change what gets through; it decides which rule Check access names first, and keeps the list readable.
• The bin icon (Delete) removes a rule after a confirmation.

Every change of the rules goes to the network's notifications.

Who can reach whom

The table Who can reach whom shows the result of all the rules at once. Rows — where traffic starts, columns — where it goes: ✓ — all ports, numbers — only these ports, — — nothing. Sites are columns too, one per subnet of a site. The table appears once the network has two devices and opens by itself while there are no more than eight.

Check access

Check access next to the Who can reach whom heading opens the form: pick a device in From, a device, subnet, site or the internet in To, a Port and a Protocol, then press Check. The answer names the first rule that allows the connection, says it's allowed by an automatic reverse-proxy rule, or says no rule allows it. For a subnet it also warns when the route isn't approved on any device — then the traffic doesn't flow whatever the rules say.

Rules for subnets

• A subnet appears in To once a device of the network advertises it; the router's name is shown next to it.
• All subnets covers every subnet the network's routers advertise, including ones added later.
• A rule needs an approved route to have any effect, and the devices must accept routes.
• Under the list of rules, a note names the subnets no rule gives access to.
• A rule on an IPv4 subnet doesn't open a site with the same subnet: pick the site itself.

Internet (exit node)

Internet (exit node) as a destination lets the devices go out to the internet through an exit node of the network. Without such a rule (or Everything), a device that picks an exit node loses the internet. Ports don't apply here.

Automatic reverse-proxy rules

When the network publishes services, the reverse-proxy device needs to reach their targets. The dashboard adds these rules by itself and lists them under the rules with the tag automatic: the proxy reaches exactly the target address and port. They keep the services working even with the Isolated: nothing allowed by default preset; they go away with the route.

“The network isn't running these rules yet”

The rules are saved in the dashboard first and then sent to the network's server. If it didn't take them (for example, it was restarting), a notice says so, and mesh-net keeps retrying automatically. Retry now tries at once. Until then the network runs the previous rules.

The policy built from the rules

Show the policy under Policy shows what the network gets from the rules — HuJSON, read-only. Devices appear there as dev-<id> hosts with their 100.x addresses, sites as site-<number>. It's useful to compare with a Tailscale policy you know, or as a starting point for custom HuJSON.

Custom HuJSON

Instead of the rules, the policy can be written by hand in HuJSON, the same format as in Tailscale: who can talk to whom (acls), tag owners (tagOwners), SSH access (ssh). In this mode the page is an editor: change the text and press Save policy. If the network rejects the policy, the page shows why and keeps your text. A network without a policy shows a starting one: everything allowed, with comments.

Tags

Device tags work only with a custom policy: declare each tag in tagOwners — for example "tag:server": ["main@"], where main@ is a user of the network (in a policy a user is written with a trailing @) — save the policy, then assign the tag on the device's page. Mind that a tag changes the device's owner: see the warning in Tags.

Sites in custom HuJSON

Your policy decides who reaches the network's sites: allow a site by its 4via6 route, not by its IPv4 subnet. The editor page lists the hosts to add (one per subnet of a site) and an example rule — see Sites with custom HuJSON.

Switching between rules and custom HuJSON

• To custom HuJSON: Switch to custom HuJSON next to the Policy heading. The current policy goes into the editor, and the rules stop applying; they are kept.
• Back to the rules: Switch to visual rules next to the heading of the editor page. Your HuJSON is replaced by the policy built from the saved rules; if there are none, you start with one rule — all devices → everything, all ports.
• Both switches ask for a confirmation. They are announced in the network's notifications and by email, unless you turned the Access policy (ACL) events off.

Examples