Appearance
ts location
Show, create, change, or delete a named location: a set of address ranges and countries that an application's access policy can allow or refuse. Use it to keep an application to your office network, or away from a country.
Usage
text
ts locations [--csv] [--no-trunc]
ts location <location>
ts location new <name> [--range=CIDR]... [--country=CC]... [--unknown-countries]
ts location set <location> <property> <value>
ts location delete <location> [--force]Description
A named location holds address ranges, countries, or both. An address is in the location when one of its ranges contains it, when the IP-to-country data places it in one of its countries, or, if the location includes unknown countries, when the data places it in no country. ts locations lists each location with its ranges, its countries, whether it includes unknown countries, and its ID. Every singular form names a location by its ID or by its name in any case. The same locations appear in the Administration site under Identity → Locations.
An application uses locations on its Access tab, under Where It Can Be Used From: Anywhere, or Only These Locations, and never from the locations under Except. An address in both an included and an excluded location is refused. The condition is judged against the address a person, a guest, or a device connects from. ts app sets the same condition as access.network in an app's document, naming each location by its ID. Only a Server Administrator manages locations and an application's network condition.
Ranges and Countries
A range is a single address, such as 203.0.113.7, or a CIDR range, such as 203.0.113.0/24 or 2001:db8::/32. An IPv4 address must be written as four decimal parts, and * is refused: a condition that applies everywhere is Anywhere. A country is an ISO 3166-1 two-letter code in either case, such as US; XK names Kosovo. A location holds at most 2,000 ranges, and must hold a range or a country, or include unknown countries.
The server stores what it accepts in canonical form, and ts prints the location as stored after every write: a single address gets its full prefix (203.0.113.7/32), bits past the prefix are cleared (10.1.2.3/16 is stored as 10.1.0.0/16), countries are upper case and sorted, and duplicates are dropped. An IPv4 range also covers its addresses when they arrive in IPv4-mapped IPv6 form.
Countries depend on IP-to-country data, which a new server does not have. Until you import it with ts ip-countries, a location's countries match no address, and a location that includes unknown countries matches every address. An application kept to locations of countries can then be used from nowhere, and so can one that excepts a location including unknown countries.
Changing and Deleting
set changes one property: name, ranges, countries, or unknown-countries (true or false). ranges and countries take a comma-separated list that replaces the stored one; an empty value clears it. Names are unique, ignoring case.
delete confirms first, and is refused while an application's access policy names the location; the refusal names the applications. Remove the location from their Access tabs first. Creating, changing, and deleting a location are recorded in the audit log.
Options
| Flag | Description | Default/Values | Notes |
|---|---|---|---|
--range | An address or CIDR range. | CIDR, such as 203.0.113.0/24 | new only. Repeat it, or separate several with commas. |
--country | An ISO 3166-1 two-letter country code. | CC, such as US | new only. Repeat it, or separate several with commas. |
--unknown-countries | Include addresses the IP-to-country data places in no country. | new only. Change it later with set <location> unknown-countries true. | |
--force, -f | Delete without confirming. | delete only. Required when there is no terminal. | |
--csv | Tab-separated output, nothing truncated. | ts locations only. | |
--no-trunc | Do not truncate columns. | ts locations only. |
Examples
bash
# Which locations are there, and what do they hold?
ts locations
# One location, by name
ts location "Head office"
# An office network
ts location new "Head office" --range 203.0.113.0/24 --range 198.51.100.7 --country GB
# The countries an application may be used from
ts location new "Allowed countries" --country US,CA,GB
# Addresses the IP-to-country data cannot place
ts location new "Unplaced" --unknown-countries
# Replace the office's ranges after a network change
ts location set "Head office" ranges 203.0.113.0/24,192.0.2.0/25
# Stop matching the office by country
ts location set "Head office" countries ""
# Retire a location no application names
ts location delete "Head office" --forcebash
# A location of countries matches no address until IP-to-country data is
# imported. Check what the data says about an address before relying on one.
ts ip-countries 198.51.100.7Output
text
NAME RANGES COUNTRIES UNKNOWN ID
Allowed countries - CA,GB,US no 5d2c9a41-7e3b-4f10-9c6a-2b8e1f0d4a77
Head office 203.0.113.0/24,198.51.100.7/32 GB no a3f1c2d4-6b5e-4a79-8c10-3e2d1f0b9a65
Unplaced - - yes e8b04d2c-19f7-4a3e-b5d6-0c7a2f9e1b83new and set say what they did, then print the location as stored. Updated is in UTC.
text
Created location Head office
Name: Head office
ID: a3f1c2d4-6b5e-4a79-8c10-3e2d1f0b9a65
Ranges: 203.0.113.0/24, 198.51.100.7/32
Countries: GB
Unknown countries: not included
Updated: 2026-10-21 09:14Exit Codes
0 on success. -1 when the server refuses the location: a missing or taken name, a range or country code it cannot read, more than 2,000 ranges, a location that would hold nothing, or a delete while an application names it. -1 also when you decline the delete prompt. -2 when set names another property, or gives unknown-countries a value other than true or false. -4 when no account is signed in. -5 when the account is not a Server Administrator. -6 when no location has the ID or name.
Related Commands
- ts ip-countries — Imports the data that locations' countries are judged by.
- ts app — An app's
access.networknames the locations it can be used from. - ts audit — Who created, changed, or deleted a location.