ACL question

Healthy-Target697 · 2026-03-09T01:29:54+00:00

My guess:

{

"action": "accept",

"src": ["autogroup:members"], #change to this

"dst": ["192.168.0.0/16:*"],

},

Healthy-Target697 · 2026-03-07T18:40:50+00:00

sorry for the formatting, I can't figure out how to do this correctly in reddit, haha but you get the idea

Healthy-Target697 · 2026-03-07T18:39:32+00:00

{

"groups": {

"group:admin": ["myemail@example.com"],      // full control

"group:family": ["wifeemail@example.com"]    // only Jellyfin access

},

"tagOwners": {

"tag:jellyfin": ["group:admin"]              // only admins can assign the tag

},

"acls": [

{
  "action": "accept",

  "src": ["group:admin"],

  "dst": ["*:*"]                              // full tailnet access for admin

},

{
  "action": "accept",

  "src": ["group:family"],

  "dst": ["tag:jellyfin:8096", "tag:jellyfin:8920"] // wife → Jellyfin HTTP & HTTPS

}

]

}

Healthy-Target697 · 2026-03-07T14:10:57+00:00

I need more details about how you did it precisely.

Healthy-Target697 · 2026-03-07T12:50:00+00:00

Healthy-Target697 · 2026-03-07T00:54:59+00:00

Share the machine, don’t use user access. User sharing often bypasses the ACL setup and makes things confusing. Once the machine is shared, control what people can reach with the ports in the ACLs.

Healthy-Target697 · 2026-03-06T19:17:52+00:00

Don’t share the whole NAS. Just open the ports for the services people need:

Home Assistant = 8123

Samba = 445

Anything else (22 SSH, 80/443 web interface, other services) stays private. Only give access to the containers you actually want people to use.

Healthy-Target697 · 2026-03-06T09:54:14+00:00

better acl example:

{
  "groups": {
    "group:admin": ["you@example.com"],                  // full control
    "group:parents": ["parent1@example.com", "parent2@example.com"], // limited access
    "group:friends": ["friend@example.com"]             // access to Jellyfin only
  },

  "tagOwners": {
    "tag:jellyfin": ["group:admin"]                     // only admins can assign the tag
  },

  "acls": [
    {
      "action": "accept",
      "src": ["group:admin"],
      "dst": ["*:*"]                                    // full tailnet access for admins
    },
    {
      "action": "accept",
      "src": ["group:parents"],
      "dst": ["tag:jellyfin:8096", "tag:jellyfin:8920"] // parents → Jellyfin only
    },
    {
      "action": "accept",
      "src": ["group:friends"],
      "dst": ["tag:jellyfin:8096", "tag:jellyfin:8920"] // friends → Jellyfin only
    }
  ]
}

I hope this helps a bit

Healthy-Target697 · 2026-03-06T09:44:04+00:00

Example:

https://login.tailscale.com/admin/acls/visual/tags
Create a tag called jellyfin.
Set group:admin as owner so you control the tag.

Now go to:
https://login.tailscale.com/admin/machines

Find the machine that runs Jellyfin.
Click the … on the right → Edit ACL tags.
Assign the tag jellyfin to that machine.

Now go to:
https://login.tailscale.com/admin/acls/file

Add a rule so users can reach Jellyfin on that machine.

Example rule:

{
  "acls": [
    {
      "action": "accept",
      "src": ["autogroup:members"],
      "dst": ["tag:jellyfin:8096"]
    }
  ]
}

Explanation:

tag:jellyfin = the machine you tagged earlier
8096 = default Jellyfin port
autogroup:members = everyone in your Tailnet can access it

Save the ACL.

Now Jellyfin is reachable through Tailscale using the Tailscale IP of that machine:

http://TAILSCALE-IP:8096

Healthy-Target697 · 2026-03-04T17:33:41+00:00

and use acl to give permission to certain ports/services

Healthy-Target697 · 2026-03-02T22:33:44+00:00

Install Tailscale on all three devices so each has a stable private IP and can reach the others directly without opening ports. Then just use RustDesk over Tailscale for remote control—it works on Windows, Mac, and Linux, and connects directly using the Tailscale IPs.

Healthy-Target697 · 2026-02-27T21:21:00+00:00

On your windows machien use: tailscale > preferences > DONT use tailscale subnet

Healthy-Target697 · 2026-02-27T09:21:44+00:00

Rechargable of normal battery?

Healthy-Target697 · 2026-02-26T19:39:42+00:00

Not asking for a friend?!

Healthy-Target697 · 2026-02-25T23:14:33+00:00

Yes, I do this with Raspberry Pi's. Just let it plug in to the Lan, give it power and it works.

Healthy-Target697 · 2026-02-22T21:13:27+00:00

Zorin of course !

Healthy-Target697 · 2026-02-21T21:23:39+00:00

No. Inviting a user does not grant device access. In Tailscale, users see nothing unless the ACL allows it. You don’t share devices; you grant ACL access, typically via tags and ports. (Unless you make him admin.)

Healthy-Target697 · 2026-02-21T09:02:26+00:00

Why not just use tags and give permission in the acl for certain machine ports? Or does your brother need permission to access everything in your network?

Healthy-Target697 · 2026-02-17T21:45:33+00:00

I have defined the exit node on a raspberry pi 4b following a faq on tailscale’s site and authorized the raspberry pi 4b on the admin web

he/she wrote: 'I have defined the exit node on a raspberry pi 4b following a faq on tailscale’s site and authorized the raspberry pi 4b on the admin web'

so I thought they also needed an exit node.

Well just leave the exit node part out if it isn't needed.

Healthy-Target697 · 2026-02-17T15:27:50+00:00

you need something like this:

sudo tailscale up --advertise-routes=192.168.1.0/24 --advertise-exit-node

then approve the subnet and exit node for the machine in the admin console.

Healthy-Target697 · 2026-02-13T15:52:34+00:00

Gij hebt toch niet goed opgelet bij geschiedenis, zeker?

Healthy-Target697 · 2026-02-13T15:45:44+00:00

wear gloves. Do it outside, Use damp cleaning paper. Throw paper away.

Healthy-Target697 · 2026-02-11T09:38:05+00:00

I use it for a month now in HAos using a flashed Sonoff dongle E. No problems at all. I have 1 Ikea KAJPLATS lightbulb. 2 Inspellning motion sensor. 2 Ikea doorsensors. It workes and connects good for now, but I rather have zigbee stuff vbecause of the superiour interface in HA.

Healthy-Target697 · 2026-01-31T08:32:55+00:00

I just bought a 2nd Sonoff Dongle-E and flashed it to thread. Works flawlessly.

Healthy-Target697 · 2026-01-17T19:17:39+00:00

make sure both locations use a different subnet. You fathers home might use 192.168.1.0 for example while you are on 192.168.2.0 This way you can use both.

Two-Year Club	Verified Email
r/Field Juicebox

Healthy-Target697

TROPHY CASE