starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] Exit node is visible to nodes that aren't allowed to use it #1105

New Issue
Closed
opened 2025-12-29 02:28:18 +01:00 by adam · 3 comments
adam commented 2025-12-29 02:28:18 +01:00
Owner
Copy Link

Originally created by @nblock on GitHub (Sep 27, 2025).

Originally assigned to: @shashank-netapp on GitHub.

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

There seems to be a regression in Headscale 0.26.1 and main (bd35fcf338) where a exit node is visible to some? nodes in the tailnet even if nodes are not allowed to use the exit node.

The easiest way to check is: tailscale exit-node list or tailscale status

This is not the case for Headscale 0.25.1 or Tailscale SaaS.

Also mentioned some time ago in another issue.

Expected Behavior

Exit nodes should only be visible to nodes that are allowed to use them (policy: autogroup:internet:*).

Steps To Reproduce

  1. Add a user and register three nodes:
    • mobile (100.64.0.1), regular node
    • server (100.64.0.2), regular node
    • exit (100.64.0.3), exit node (--advertise-exit-node)
  2. Approve routes for exit node: headscale nodes approve-routes -i 3 -r ::/0
  3. Add a policy that allows mobile to communicate with server
  4. Observe that mobile can also see the exit node via tailscale exit-node list or tailscale status: 
    # tailscale exit-node list

 IP             HOSTNAME                COUNTRY     CITY      STATUS     
 100.64.0.3     exit.tn.example.com     -           -         -

Policy:

{
  "hosts": {
    "mobile": "100.64.0.1/32",
    "server": "100.64.0.2/32",
    "exit": "100.64.0.3/32"
  },

  "acls": [
    {
      "action": "accept",
      "src": [
        "mobile"
      ],
      "dst": [
        "server:80"
      ]
    }
  ]
}

headscale nodes list:

ID | Hostname | Name   | MachineKey | NodeKey | User  | IP addresses                  | Ephemeral | Last seen           | Expiration | Connected | Expired
1  | mobile   | mobile | [v5rhX]    | [ShtL4] | alice | 100.64.0.1, fd7a:115c:a1e0::1 | false     | 2025-09-27 14:06:14 | N/A        | online    | no     
2  | server   | server | [aZTsQ]    | [3/UFY] | alice | 100.64.0.2, fd7a:115c:a1e0::2 | false     | 2025-09-27 11:45:15 | N/A        | online    | no     
3  | exit     | exit   | [tjKJG]    | [cz7Bv] | alice | 100.64.0.3, fd7a:115c:a1e0::3 | false     | 2025-09-27 11:36:11 | N/A        | online    | no

Environment

- OS: Debian 13
- Headscale version: Headscale 0.26.1, main (bd35fcf338d678314fc5ef674d318f441fdf6fb6)
- Tailscale version: 1.88.3

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

Originally created by @nblock on GitHub (Sep 27, 2025). Originally assigned to: @shashank-netapp on GitHub. ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior There seems to be a regression in Headscale 0.26.1 and main (bd35fcf338d678314fc5ef674d318f441fdf6fb6) where a exit node is visible to some? nodes in the tailnet even if nodes are not allowed to use the exit node. The easiest way to check is: `tailscale exit-node list` or `tailscale status` This is not the case for Headscale 0.25.1 or Tailscale SaaS. [Also mentioned some time ago in another issue.](https://github.com/juanfont/headscale/issues/2577#issuecomment-2866184542) ### Expected Behavior Exit nodes should only be visible to nodes that are allowed to use them (policy: `autogroup:internet:*`). ### Steps To Reproduce 1. Add a user and register three nodes: - mobile (100.64.0.1), regular node - server (100.64.0.2), regular node - exit (100.64.0.3), exit node (`--advertise-exit-node`) 2. Approve routes for exit node: `headscale nodes approve-routes -i 3 -r ::/0` 3. Add a policy that allows mobile to communicate with server 5. Observe that mobile can also see the exit node via `tailscale exit-node list` or `tailscale status`: ``` # tailscale exit-node list IP HOSTNAME COUNTRY CITY STATUS 100.64.0.3 exit.tn.example.com - - - ``` Policy: ```json { "hosts": { "mobile": "100.64.0.1/32", "server": "100.64.0.2/32", "exit": "100.64.0.3/32" }, "acls": [ { "action": "accept", "src": [ "mobile" ], "dst": [ "server:80" ] } ] } ``` `headscale nodes list`: ``` ID | Hostname | Name | MachineKey | NodeKey | User | IP addresses | Ephemeral | Last seen | Expiration | Connected | Expired 1 | mobile | mobile | [v5rhX] | [ShtL4] | alice | 100.64.0.1, fd7a:115c:a1e0::1 | false | 2025-09-27 14:06:14 | N/A | online | no 2 | server | server | [aZTsQ] | [3/UFY] | alice | 100.64.0.2, fd7a:115c:a1e0::2 | false | 2025-09-27 11:45:15 | N/A | online | no 3 | exit | exit | [tjKJG] | [cz7Bv] | alice | 100.64.0.3, fd7a:115c:a1e0::3 | false | 2025-09-27 11:36:11 | N/A | online | no ``` ### Environment ```markdown - OS: Debian 13 - Headscale version: Headscale 0.26.1, main (bd35fcf338d678314fc5ef674d318f441fdf6fb6) - Tailscale version: 1.88.3 ``` ### Runtime environment - [ ] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Debug information * [Headscale debug/policy](https://github.com/user-attachments/files/22574615/headscale-debug-policy.json) * [Headscale debug/filter](https://github.com/user-attachments/files/22574622/headscale-debug-filter.json) * [Headscale debug/nodestore](https://github.com/user-attachments/files/22574628/headscale-debug-nodestore.txt) * [Headscale debug/policy-manager](https://github.com/user-attachments/files/22574657/headscale-debug-policy-manager.txt) * [mobile: tailscale status --json](https://github.com/user-attachments/files/22574763/tailscale-mobile-status.json) * [server: tailscale status --json](https://github.com/user-attachments/files/22574765/tailscale-server-status.json) * [exit: tailscale status --json](https://github.com/user-attachments/files/22574766/tailscale-exit-status.json) * [mobile: tailscale debug netmap](https://github.com/user-attachments/files/22574769/tailscale-mobile-netmap.txt) * [server: tailscale debug netmap](https://github.com/user-attachments/files/22574770/tailscale-server-netmap.txt) * [exit: tailscale debug netmap](https://github.com/user-attachments/files/22574772/tailscale-exit-netmap.txt)
adam added the bugregression labels 2025-12-29 02:28:18 +01:00
adam closed this issue 2025-12-29 02:28:18 +01:00
adam commented 2025-12-29 02:28:18 +01:00
Author
Owner
Copy Link

@shashank-netapp commented on GitHub (Sep 29, 2025):

Can this be assigned to me ? I can take a look into it.

@shashank-netapp commented on GitHub (Sep 29, 2025): Can this be assigned to me ? I can take a look into it.
adam commented 2025-12-29 02:28:18 +01:00
Author
Owner
Copy Link

@shafer commented on GitHub (Oct 11, 2025):

To me this seems like it's already been covered in other bugs. Like https://github.com/juanfont/headscale/issues/2469#issuecomment-2726777780

@shafer commented on GitHub (Oct 11, 2025): To me this seems like it's already been covered in other bugs. Like https://github.com/juanfont/headscale/issues/2469#issuecomment-2726777780
adam commented 2025-12-29 02:28:18 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Oct 11, 2025):

To me this seems like it's already been covered in other bugs. Like #2469 (comment)

I think this issue is a bit different as users see exit nodes in their node list even if they don't have a related autogroup:internet:* ACL rule.

@nblock commented on GitHub (Oct 11, 2025): > To me this seems like it's already been covered in other bugs. Like [#2469 (comment)](https://github.com/juanfont/headscale/issues/2469#issuecomment-2726777780) I think this issue is a bit different as users see exit nodes in their node list even if they don't have a related `autogroup:internet:*` ACL rule.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug regression
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1105
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?