diff --git a/src/services/headscale-adapter.ts b/src/services/headscale-adapter.ts
index d17291b..c5c5ec7 100644
--- a/src/services/headscale-adapter.ts
+++ b/src/services/headscale-adapter.ts
@@ -73,16 +73,31 @@ export class HeadscaleAdapter {
     unresolved: string[]
     error?: string
   }> {
+    const gatewaySources = [...new Set(
+      config.headscaleGatewayUsers.map((user) => this.toHeadscaleUserName(user)),
+    )]
     const policy: HeadscalePolicy = {
       groups: {},
       tagOwners: {
         'tag:teaching-device': [`${config.headscaleTeachingDeviceOwner}@`],
       },
-      acls: [{
-        action: 'accept',
-        src: ['*'],
-        dst: ['*:*'],
-      }],
+      acls: [
+        {
+          action: 'accept',
+          src: ['*'],
+          dst: ['*:*'],
+        },
+        {
+          action: 'accept',
+          src: gatewaySources,
+          dst: ['*:*'],
+        },
+        {
+          action: 'accept',
+          src: ['tag:teaching-device'],
+          dst: ['*:*'],
+        },
+      ],
     }
 
     const result = await this.applyPolicy(policy)