Subnets

Bind a whole network segment to one profile instead of registering every device on it.

What this step does

Most networks aren’t one flat range. You might have a LAN and a Tailscale overlay, a guest VLAN, or an IoT segment sitting off on its own subnet — and you don’t want to add every laptop, phone and light bulb on each of them as a separate device just to give them a profile.

A subnet fixes that: bind a CIDR range to a profile once, and anything with a source IP inside that range inherits it — no matter how many hosts come and go.

Add a subnet

Both --cidrs and --profile are required.

warden subnet add tailscale --cidrs 100.64.0.0/10 --profile trusted
warden subnet add lan --cidrs 192.168.1.0/24 --profile trusted

The input forms --cidrs accepts

Written to disk as canonical CIDR either way, but the CLI and TUI take a friendlier superset at input time:

Non-contiguous wildcards (10.*.0.*), a range mixed with a wildcard, and a range that isn’t aligned to the prefix boundary it implies are all rejected. IPv6 has no friendly forms — write it as canonical CIDR.

Where a subnet sits in the chain

A subnet is level 4 of 5 in the resolver chain. A device’s own pinned profile, an active schedule targeting that device or its group, and the device’s group membership all win first if any of them match. The global default ([server].default_profile) is what a source falls back to only when no subnet matches either. See decision precedence for the full chain.

Overlapping subnets

When two subnets both cover a source IP, the longest matching prefix wins — a /24 always beats a /16 regardless of anything else. Only when two subnets tie at the same prefix length does priority decide (higher wins), and the subnet id breaks any remaining tie.

A device’s own profile — pinned directly, via an active schedule, or via a group — still beats any subnet match, so binding a whole network to a profile never overrides a host you’ve mapped individually.

Allow or deny a domain across the whole profile

profile-allow and profile-deny write an allow or deny rule, but not to the subnet — to the profile the subnet references:

warden subnet profile-allow tailscale plex.tv
warden subnet profile-deny lan ads.example.com

Because the rule lands on the profile, it reaches every other subnet, group and device pointing at that same profile — not just the one you named. See custom rules for what else can write to a profile this way.

Check what a subnet actually matched

warden resolve 100.64.0.5

warden resolve <ip> prints the match level, the subnet id (if that’s what matched) and the effective profile against the config on disk — the fastest way to confirm a subnet is doing what you think before a real query hits it.

CLI reference

In the TUI

Section 3 · Network, leaf Subnets (g s).

See also

• Subnets (entity reference) — full schema, precedence chain, security notes
• Devices — profiles pinned to a single host, which always outrank a subnet
• Profiles — what a profile actually does with the domains a subnet routes to it
• Hierarchies — how subnets fit next to devices, groups and schedules