starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] Can't split access for different users/groups to different Tailscale exit nodes in 0.26.1 #1104

New Issue
Closed
opened 2025-12-29 02:28:17 +01:00 by adam · 2 comments
adam commented 2025-12-29 02:28:17 +01:00
Owner
Copy Link

Originally created by @spymobilfon on GitHub (Sep 22, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

Hello!

I can't split access for different users/groups to different Tailscale exit nodes in 0.26.1.

In documentation said that

Configure autogroup:internet in an ACL rule to restrict who can use any of the available exit nodes.

I tried ACL config

tagOwners:
  tag:exit-nodes:
  - group:exit-nodes
  tag:special-exit-nodes:
  - group:special-exit-nodes

autoApprovers:
  exitNode:
  - tag:exit-nodes
  - tag:special-exit-nodes

acls:
  - action: accept
    src:
    - group:general
    dst:
    - tag:exit-nodes:*

  - action: accept
    src:
    - group:vip
    dst:
    - tag:special-exit-nodes:*

but it doesn't work in Headscale 0.26.1. This scheme was worked in previous versions.

ACL with this rights

- action: accept
  src:
  - group:general
  dst:
  - autogroup:internet:*

grants access to all exit nodes.

Expected Behavior

I can split access for different users/groups to different Tailscale exit nodes.

Steps To Reproduce

  1. Setup Headscale with ACL
- action: accept
  src:
  - group:general
  dst:
  - autogroup:internet:*
  1. Add 2 exit nodes
  2. Check access to internet via both nodes

Environment

OS: Ubuntu 24.04
Headscale version: 0.26.1
Tailscale version: 1.84.0

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

No

Originally created by @spymobilfon on GitHub (Sep 22, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior Hello! I can't split access for different users/groups to different Tailscale exit nodes in 0.26.1. In documentation said that ``` Configure autogroup:internet in an ACL rule to restrict who can use any of the available exit nodes. ``` I tried ACL config ``` tagOwners: tag:exit-nodes: - group:exit-nodes tag:special-exit-nodes: - group:special-exit-nodes autoApprovers: exitNode: - tag:exit-nodes - tag:special-exit-nodes acls: - action: accept src: - group:general dst: - tag:exit-nodes:* - action: accept src: - group:vip dst: - tag:special-exit-nodes:* ``` but it doesn't work in Headscale 0.26.1. This scheme was worked in previous versions. ACL with this rights ``` - action: accept src: - group:general dst: - autogroup:internet:* ``` grants access to all exit nodes. ### Expected Behavior I can split access for different users/groups to different Tailscale exit nodes. ### Steps To Reproduce 1. Setup Headscale with ACL ``` - action: accept src: - group:general dst: - autogroup:internet:* ``` 2. Add 2 exit nodes 3. Check access to internet via both nodes ### Environment ```markdown OS: Ubuntu 24.04 Headscale version: 0.26.1 Tailscale version: 1.84.0 ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Debug information No
adam added the bugregression labels 2025-12-29 02:28:17 +01:00
adam closed this issue 2025-12-29 02:28:17 +01:00
adam commented 2025-12-29 02:28:18 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Oct 10, 2025):

From the Tailscale ACL docs about subnet routers and exit nodes:

Only devices with access to autogroup:internet can use exit nodes. All other devices (without access to autogroup:internet) cannot use exit nodes.
...
You cannot restrict the use of specific exit nodes using ACLs.

See also the discussion in https://github.com/juanfont/headscale/issues/2469 and follow https://github.com/juanfont/headscale/issues/2409 for progress on the required feature to implement this: via.

@nblock commented on GitHub (Oct 10, 2025): From the Tailscale [ACL docs about subnet routers and exit nodes](https://tailscale.com/kb/1337/policy-syntax#subnet-routers-and-exit-nodes): > Only devices with access to autogroup:internet can use exit nodes. All other devices (without access to autogroup:internet) cannot use exit nodes. > ... > You cannot restrict the use of specific exit nodes using ACLs. See also the discussion in https://github.com/juanfont/headscale/issues/2469 and follow https://github.com/juanfont/headscale/issues/2409 for progress on the required feature to implement this: `via`.
adam commented 2025-12-29 02:28:18 +01:00
Author
Owner
Copy Link

@spymobilfon commented on GitHub (Oct 11, 2025):

It's bad news for us. It has been working before implementing 'autogroup:internet'. The changes should have been marked as breaking changes.

Do you have timeline of supporting the feature?

@spymobilfon commented on GitHub (Oct 11, 2025): It's bad news for us. It has been working before implementing 'autogroup:internet'. The changes should have been marked as breaking changes. Do you have timeline of supporting the feature?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug regression
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1104
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?