starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Feature] Support "Use with exit node" feature for nameservers #1116

New Issue
Open
opened 2025-12-29 02:28:20 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:28:20 +01:00
Owner
Copy Link

Originally created by @stratself on GitHub (Oct 26, 2025).

Use case

I want to use an exit node with my self-hosted DNS server (Pihole etc), without needing to take the round trip to the exit node itself.

Current:

graph LR
client --> exit-node --> internet
exit-node --> dns-server --> internet

Wanted:

graph LR
client --> exit-node --> internet
client --> dns-server --> internet

Previously, this wasn't possible, because connecting to an exit node teleports my DNS resolutions there too. I have to configure routebacks to Pihole and open up ACLs from the exit node.

Description

Starting with v1.90.1 Tailscale now allows you to use a specific DNS resolver even when connecting to an exit node. The feature is documented here.

On the Tailscale panel it looks something like this:

Image

I'd kindly request support for this feature to be integrated into Headscale.

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

Config-wise, it'd probably be another field in the config.yaml

dns:
  nameservers:
    global:
      - 100.64.0.53
    split: {}
    use_with_exit_node:
      - 100.64.0.53

But maybe nameservers can be configured via API too. I'll leave the details to implementors.

Originally created by @stratself on GitHub (Oct 26, 2025). ### Use case I want to use an exit node with my self-hosted DNS server (Pihole etc), without needing to take the round trip to the exit node itself. Current: ```mermaid graph LR client --> exit-node --> internet exit-node --> dns-server --> internet ``` Wanted: ```mermaid graph LR client --> exit-node --> internet client --> dns-server --> internet ``` Previously, this wasn't possible, because connecting to an exit node teleports my DNS resolutions there too. I have to configure routebacks to Pihole and open up ACLs from the exit node. ### Description Starting with [v1.90.1](https://tailscale.com/changelog#2025-10-23) Tailscale now allows you to use a specific DNS resolver even when connecting to an exit node. The feature is documented [here](https://tailscale.com/kb/1054/dns#nameservers-and-exit-nodes). On the Tailscale panel it looks something like this: <img height="600" alt="Image" src="https://github.com/user-attachments/assets/5ce23135-fd49-43c5-aae0-f3d0bebf105f" /> I'd kindly request support for this feature to be integrated into Headscale. ### Contribution - [ ] I can write the design doc for this feature - [ ] I can contribute this feature ### How can it be implemented? Config-wise, it'd probably be another field in the `config.yaml` ```yaml dns: nameservers: global: - 100.64.0.53 split: {} use_with_exit_node: - 100.64.0.53 ``` But maybe nameservers can be configured via API too. I'll leave the details to implementors.
adam added the enhancementno-stale-botDNS labels 2025-12-29 02:28:20 +01:00
adam commented 2025-12-29 02:28:21 +01:00
Author
Owner
Copy Link

@stratself commented on GitHub (Nov 17, 2025):

An update:

My initial understanding of this feature is incorrect. Tailscale allows UseWithExitNode with both Split DNS and Global nameservers:

  • In the first case, requests will go directly to the resolver for split DNS domains
  • In the second case, requests will go directly to the resolver for all domains

This could be useful for homelab setups, where you want only some of your domains to be resolved directly without the roundtrip to the exit node itself.

graph LR
  client -->|all-other-domains| exit-node --> internet
  client -->|homelab.domain| local-dns

The following configuration on Tailscale's control plane:

Image

Would result in the following tailscale debug netmap DNS:

{
    "DNS": {
        "Resolvers": [
            {
                "Addr": "100.64.0.1"
            },
            {
                "Addr": "100.64.0.2"
            },
            {
                "Addr": "100.64.0.3",
                "UseWithExitNode": true
            }
        ],
        "Routes": {
            "homelab.org": [
                {
                    "Addr": "100.64.0.1",
                    "UseWithExitNode": true
                },
                {
                    "Addr": "100.64.0.2"
                }
            ],
            "tailc4ff1e.ts.net.": null,
            "ts.net.": [
                {
                    "Addr": "199.247.155.53"
                },
                {
                    "Addr": "2620:111:8007::53"
                }
            ]
        }
    }
}
@stratself commented on GitHub (Nov 17, 2025): **An update:** My initial understanding of this feature is incorrect. Tailscale allows `UseWithExitNode` with both Split DNS and Global nameservers: - In the first case, requests will go directly to the resolver for split DNS domains - In the second case, requests will go directly to the resolver for all domains This could be useful for homelab setups, where you want only some of your domains to be resolved directly without the roundtrip to the exit node itself. ```mermaid graph LR client -->|all-other-domains| exit-node --> internet client -->|homelab.domain| local-dns ``` The following configuration on Tailscale's control plane: <img width="2074" height="1486" alt="Image" src="https://github.com/user-attachments/assets/a7a45d19-e5e3-4283-9faa-346df8c8c541" /> Would result in the following `tailscale debug netmap` DNS: ```json { "DNS": { "Resolvers": [ { "Addr": "100.64.0.1" }, { "Addr": "100.64.0.2" }, { "Addr": "100.64.0.3", "UseWithExitNode": true } ], "Routes": { "homelab.org": [ { "Addr": "100.64.0.1", "UseWithExitNode": true }, { "Addr": "100.64.0.2" } ], "tailc4ff1e.ts.net.": null, "ts.net.": [ { "Addr": "199.247.155.53" }, { "Addr": "2620:111:8007::53" } ] } } } ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label DNS enhancement no-stale-bot
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1116
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?