// ACL-R07 // // ACLs: 3 rules // accept: src=['tag:client'] dst=['tag:server:22'] // accept: src=['autogroup:member'] dst=['tag:prod:5432'] // accept: src=['*'] dst=['autogroup:self:*'] // // Nodes with filter rules: 6 of 8 { "test_id": "ACL-R07", "timestamp": "2026-04-05T20:44:42Z", "propagation_wait_seconds": 20, "input": { "policy_file": "acl_policies/acl_r07.json", "full_policy": { "groups": { "group:admins": [ "kratail2tid@passkey" ], "group:developers": [ "kristoffer@dalby.cc", "kratail2tid@passkey" ], "group:monitors": [ "monitorpasskeykradalby@passkey" ], "group:empty": [] }, "tagOwners": { "tag:server": [ "kratail2tid@passkey" ], "tag:prod": [ "kratail2tid@passkey" ], "tag:client": [ "kratail2tid@passkey" ], "tag:router": [ "kratail2tid@passkey" ], "tag:exit": [ "kratail2tid@passkey" ] }, "hosts": { "webserver": "100.108.74.26", "prodbox": "100.103.8.15", "internal": "10.0.0.0/8", "subnet24": "192.168.1.0/24" }, "autoApprovers": { "routes": { "10.33.0.0/16": [ "tag:router" ], "0.0.0.0/0": [ "tag:exit" ], "::/0": [ "tag:exit" ] } }, "acls": [ { "action": "accept", "src": [ "tag:client" ], "dst": [ "tag:server:22" ] }, { "action": "accept", "src": [ "autogroup:member" ], "dst": [ "tag:prod:5432" ] }, { "action": "accept", "src": [ "*" ], "dst": [ "autogroup:self:*" ] } ] }, "api_endpoint": "https://api.tailscale.com/api/v2/tailnet/kratail2tid%40passkey/acl", "api_response_code": 200 }, "topology": { "nodes": { "exit-node": { "hostname": "exit-node", "tags": [ "tag:exit" ], "ipv4": "100.85.66.106", "ipv6": "fd7a:115c:a1e0::7c37:426a", "routable_ips": [ "0.0.0.0/0", "::/0" ], "approved_routes": [ "0.0.0.0/0", "::/0" ] }, "subnet-router": { "hostname": "subnet-router", "tags": [ "tag:router" ], "ipv4": "100.92.142.61", "ipv6": "fd7a:115c:a1e0::3e37:8e3d", "routable_ips": [ "10.33.0.0/16", "fd00:1::/64" ], "approved_routes": [ "10.33.0.0/16", "fd00:1::/64" ] }, "tagged-client": { "hostname": "tagged-client", "tags": [ "tag:client" ], "ipv4": "100.83.200.69", "ipv6": "fd7a:115c:a1e0::c537:c845", "routable_ips": [], "approved_routes": [] }, "tagged-prod": { "hostname": "tagged-prod", "tags": [ "tag:prod" ], "ipv4": "100.103.8.15", "ipv6": "fd7a:115c:a1e0::5b37:80f", "routable_ips": [], "approved_routes": [] }, "tagged-server": { "hostname": "tagged-server", "tags": [ "tag:server" ], "ipv4": "100.108.74.26", "ipv6": "fd7a:115c:a1e0::b901:4a87", "routable_ips": [], "approved_routes": [] }, "user-kris": { "hostname": "user-kris", "tags": [], "ipv4": "100.110.121.96", "ipv6": "fd7a:115c:a1e0::1737:7960", "routable_ips": [], "approved_routes": [] }, "user-mon": { "hostname": "user-mon", "tags": [], "ipv4": "100.103.90.82", "ipv6": "fd7a:115c:a1e0::9e37:5a52", "routable_ips": [], "approved_routes": [] }, "user1": { "hostname": "user1", "tags": [], "ipv4": "100.90.199.68", "ipv6": "fd7a:115c:a1e0::2d01:c747", "routable_ips": [], "approved_routes": [] } } }, "captures": { "exit-node": { "packet_filter_rules": [ { "SrcIPs": [ "100.83.200.69", "fd7a:115c:a1e0::c537:c845" ], "DstPorts": [ { "IP": "100.108.74.26", "Ports": { "First": 22, "Last": 22 } }, { "IP": "fd7a:115c:a1e0::b901:4a87", "Ports": { "First": 22, "Last": 22 } } ] }, { "SrcIPs": [ "100.103.90.82", "100.110.121.96", "100.90.199.68", "fd7a:115c:a1e0::1737:7960", "fd7a:115c:a1e0::2d01:c747", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.8.15", "Ports": { "First": 5432, "Last": 5432 } }, { "IP": "fd7a:115c:a1e0::5b37:80f", "Ports": { "First": 5432, "Last": 5432 } } ] }, { "SrcIPs": [ "100.90.199.68", "fd7a:115c:a1e0::2d01:c747" ], "DstPorts": [ { "IP": "100.90.199.68", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::2d01:c747", "Ports": { "First": 0, "Last": 65535 } } ] }, { "SrcIPs": [ "100.110.121.96", "fd7a:115c:a1e0::1737:7960" ], "DstPorts": [ { "IP": "100.110.121.96", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::1737:7960", "Ports": { "First": 0, "Last": 65535 } } ] }, { "SrcIPs": [ "100.103.90.82", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.90.82", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::9e37:5a52", "Ports": { "First": 0, "Last": 65535 } } ] } ], "netmap": { "PacketFilterRules": [ { "SrcIPs": [ "100.83.200.69", "fd7a:115c:a1e0::c537:c845" ], "DstPorts": [ { "IP": "100.108.74.26", "Ports": { "First": 22, "Last": 22 } }, { "IP": "fd7a:115c:a1e0::b901:4a87", "Ports": { "First": 22, "Last": 22 } } ] }, { "SrcIPs": [ "100.103.90.82", "100.110.121.96", "100.90.199.68", "fd7a:115c:a1e0::1737:7960", "fd7a:115c:a1e0::2d01:c747", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.8.15", "Ports": { "First": 5432, "Last": 5432 } }, { "IP": "fd7a:115c:a1e0::5b37:80f", "Ports": { "First": 5432, "Last": 5432 } } ] }, { "SrcIPs": [ "100.90.199.68", "fd7a:115c:a1e0::2d01:c747" ], "DstPorts": [ { "IP": "100.90.199.68", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::2d01:c747", "Ports": { "First": 0, "Last": 65535 } } ] }, { "SrcIPs": [ "100.110.121.96", "fd7a:115c:a1e0::1737:7960" ], "DstPorts": [ { "IP": "100.110.121.96", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::1737:7960", "Ports": { "First": 0, "Last": 65535 } } ] }, { "SrcIPs": [ "100.103.90.82", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.90.82", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::9e37:5a52", "Ports": { "First": 0, "Last": 65535 } } ] } ], "SelfNode": { "Name": "exit-node.tail78f774.ts.net.", "Addresses": [ "100.85.66.106/32", "fd7a:115c:a1e0::7c37:426a/128" ], "AllowedIPs": [ "100.85.66.106/32", "fd7a:115c:a1e0::7c37:426a/128", "0.0.0.0/0", "::/0" ], "Tags": [ "tag:exit" ], "Hostinfo": { "RoutableIPs": [ "0.0.0.0/0", "::/0" ] } }, "Peers": [] } }, "subnet-router": { "packet_filter_rules": null, "netmap": { "PacketFilterRules": null, "SelfNode": { "Name": "subnet-router.tail78f774.ts.net.", "Addresses": [ "100.92.142.61/32", "fd7a:115c:a1e0::3e37:8e3d/128" ], "AllowedIPs": [ "100.92.142.61/32", "fd7a:115c:a1e0::3e37:8e3d/128", "10.33.0.0/16", "fd00:1::/64" ], "Tags": [ "tag:router" ], "Hostinfo": { "RoutableIPs": [ "10.33.0.0/16", "fd00:1::/64" ] } }, "Peers": [] } }, "tagged-client": { "packet_filter_rules": null, "netmap": { "PacketFilterRules": null, "SelfNode": { "Name": "tagged-client.tail78f774.ts.net.", "Addresses": [ "100.83.200.69/32", "fd7a:115c:a1e0::c537:c845/128" ], "AllowedIPs": [ "100.83.200.69/32", "fd7a:115c:a1e0::c537:c845/128" ], "Tags": [ "tag:client" ], "Hostinfo": { "RoutableIPs": [] } }, "Peers": [ { "Name": "tagged-server.tail78f774.ts.net.", "Addresses": [ "100.108.74.26/32", "fd7a:115c:a1e0::b901:4a87/128" ], "AllowedIPs": [ "100.108.74.26/32", "fd7a:115c:a1e0::b901:4a87/128" ], "PrimaryRoutes": null, "Tags": [ "tag:server" ] } ] } }, "tagged-prod": { "packet_filter_rules": [ { "SrcIPs": [ "100.103.90.82", "100.110.121.96", "100.90.199.68", "fd7a:115c:a1e0::1737:7960", "fd7a:115c:a1e0::2d01:c747", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.8.15", "Ports": { "First": 5432, "Last": 5432 } }, { "IP": "fd7a:115c:a1e0::5b37:80f", "Ports": { "First": 5432, "Last": 5432 } } ] } ], "netmap": { "PacketFilterRules": [ { "SrcIPs": [ "100.103.90.82", "100.110.121.96", "100.90.199.68", "fd7a:115c:a1e0::1737:7960", "fd7a:115c:a1e0::2d01:c747", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.8.15", "Ports": { "First": 5432, "Last": 5432 } }, { "IP": "fd7a:115c:a1e0::5b37:80f", "Ports": { "First": 5432, "Last": 5432 } } ] } ], "SelfNode": { "Name": "tagged-prod.tail78f774.ts.net.", "Addresses": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "AllowedIPs": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "Tags": [ "tag:prod" ], "Hostinfo": { "RoutableIPs": [] } }, "Peers": [ { "Name": "user1.tail78f774.ts.net.", "Addresses": [ "100.90.199.68/32", "fd7a:115c:a1e0::2d01:c747/128" ], "AllowedIPs": [ "100.90.199.68/32", "fd7a:115c:a1e0::2d01:c747/128" ], "PrimaryRoutes": null, "Tags": null }, { "Name": "user-mon.tail78f774.ts.net.", "Addresses": [ "100.103.90.82/32", "fd7a:115c:a1e0::9e37:5a52/128" ], "AllowedIPs": [ "100.103.90.82/32", "fd7a:115c:a1e0::9e37:5a52/128" ], "PrimaryRoutes": null, "Tags": null }, { "Name": "user-kris.tail78f774.ts.net.", "Addresses": [ "100.110.121.96/32", "fd7a:115c:a1e0::1737:7960/128" ], "AllowedIPs": [ "100.110.121.96/32", "fd7a:115c:a1e0::1737:7960/128" ], "PrimaryRoutes": null, "Tags": null } ] } }, "tagged-server": { "packet_filter_rules": [ { "SrcIPs": [ "100.83.200.69", "fd7a:115c:a1e0::c537:c845" ], "DstPorts": [ { "IP": "100.108.74.26", "Ports": { "First": 22, "Last": 22 } }, { "IP": "fd7a:115c:a1e0::b901:4a87", "Ports": { "First": 22, "Last": 22 } } ] } ], "netmap": { "PacketFilterRules": [ { "SrcIPs": [ "100.83.200.69", "fd7a:115c:a1e0::c537:c845" ], "DstPorts": [ { "IP": "100.108.74.26", "Ports": { "First": 22, "Last": 22 } }, { "IP": "fd7a:115c:a1e0::b901:4a87", "Ports": { "First": 22, "Last": 22 } } ] } ], "SelfNode": { "Name": "tagged-server.tail78f774.ts.net.", "Addresses": [ "100.108.74.26/32", "fd7a:115c:a1e0::b901:4a87/128" ], "AllowedIPs": [ "100.108.74.26/32", "fd7a:115c:a1e0::b901:4a87/128" ], "Tags": [ "tag:server" ], "Hostinfo": { "RoutableIPs": [] } }, "Peers": [ { "Name": "tagged-client.tail78f774.ts.net.", "Addresses": [ "100.83.200.69/32", "fd7a:115c:a1e0::c537:c845/128" ], "AllowedIPs": [ "100.83.200.69/32", "fd7a:115c:a1e0::c537:c845/128" ], "PrimaryRoutes": null, "Tags": [ "tag:client" ] } ] } }, "user-kris": { "packet_filter_rules": [ { "SrcIPs": [ "100.110.121.96", "fd7a:115c:a1e0::1737:7960" ], "DstPorts": [ { "IP": "100.110.121.96", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::1737:7960", "Ports": { "First": 0, "Last": 65535 } } ] } ], "netmap": { "PacketFilterRules": [ { "SrcIPs": [ "100.110.121.96", "fd7a:115c:a1e0::1737:7960" ], "DstPorts": [ { "IP": "100.110.121.96", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::1737:7960", "Ports": { "First": 0, "Last": 65535 } } ] } ], "SelfNode": { "Name": "user-kris.tail78f774.ts.net.", "Addresses": [ "100.110.121.96/32", "fd7a:115c:a1e0::1737:7960/128" ], "AllowedIPs": [ "100.110.121.96/32", "fd7a:115c:a1e0::1737:7960/128" ], "Tags": null, "Hostinfo": { "RoutableIPs": [] } }, "Peers": [ { "Name": "tagged-prod.tail78f774.ts.net.", "Addresses": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "AllowedIPs": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "PrimaryRoutes": null, "Tags": [ "tag:prod" ] } ] } }, "user-mon": { "packet_filter_rules": [ { "SrcIPs": [ "100.103.90.82", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.90.82", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::9e37:5a52", "Ports": { "First": 0, "Last": 65535 } } ] } ], "netmap": { "PacketFilterRules": [ { "SrcIPs": [ "100.103.90.82", "fd7a:115c:a1e0::9e37:5a52" ], "DstPorts": [ { "IP": "100.103.90.82", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::9e37:5a52", "Ports": { "First": 0, "Last": 65535 } } ] } ], "SelfNode": { "Name": "user-mon.tail78f774.ts.net.", "Addresses": [ "100.103.90.82/32", "fd7a:115c:a1e0::9e37:5a52/128" ], "AllowedIPs": [ "100.103.90.82/32", "fd7a:115c:a1e0::9e37:5a52/128" ], "Tags": null, "Hostinfo": { "RoutableIPs": [] } }, "Peers": [ { "Name": "tagged-prod.tail78f774.ts.net.", "Addresses": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "AllowedIPs": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "PrimaryRoutes": null, "Tags": [ "tag:prod" ] } ] } }, "user1": { "packet_filter_rules": [ { "SrcIPs": [ "100.90.199.68", "fd7a:115c:a1e0::2d01:c747" ], "DstPorts": [ { "IP": "100.90.199.68", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::2d01:c747", "Ports": { "First": 0, "Last": 65535 } } ] } ], "netmap": { "PacketFilterRules": [ { "SrcIPs": [ "100.90.199.68", "fd7a:115c:a1e0::2d01:c747" ], "DstPorts": [ { "IP": "100.90.199.68", "Ports": { "First": 0, "Last": 65535 } }, { "IP": "fd7a:115c:a1e0::2d01:c747", "Ports": { "First": 0, "Last": 65535 } } ] } ], "SelfNode": { "Name": "user1.tail78f774.ts.net.", "Addresses": [ "100.90.199.68/32", "fd7a:115c:a1e0::2d01:c747/128" ], "AllowedIPs": [ "100.90.199.68/32", "fd7a:115c:a1e0::2d01:c747/128" ], "Tags": null, "Hostinfo": { "RoutableIPs": [] } }, "Peers": [ { "Name": "tagged-prod.tail78f774.ts.net.", "Addresses": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "AllowedIPs": [ "100.103.8.15/32", "fd7a:115c:a1e0::5b37:80f/128" ], "PrimaryRoutes": null, "Tags": [ "tag:prod" ] } ] } } } }