starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] No traffic until headscale restart (rejected due to acl ) #1172

New Issue
Closed
opened 2025-12-29 02:28:42 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:28:42 +01:00
Owner
Copy Link

Originally created by @Toomoch on GitHub (Dec 16, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

Tailscale client fails to ping tailscale IPs/subnets routes and logs to journal with the following errors:

de des. 16 19:00:14 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39478 > 10.200.1.38:53 rejected due to acl
de des. 16 19:00:15 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39478 > 10.200.1.38:53 rejected due to acl
de des. 16 19:00:15 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v")
de des. 16 19:00:24 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") (5 dropped)
de des. 16 19:00:24 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:54948 > 10.61.0.6:53 rejected due to acl
de des. 16 19:00:25 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:54948 > 10.61.0.6:53 rejected due to acl
de des. 16 19:00:25 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v")
de des. 16 19:00:35 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") (5 dropped)
de des. 16 19:00:35 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39556 > 10.200.1.5:53 rejected due to acl
de des. 16 19:00:36 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39556 > 10.200.1.5:53 rejected due to acl
de des. 16 19:00:36 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v")
de des. 16 19:00:42 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") (4 dropped)
de des. 16 19:00:42 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39556 > 10.200.1.5:53 rejected due to acl

After a headscale restart, it starts working.

Expected Behavior

For it to work without a restart

Steps To Reproduce

ACL:

{
  "groups": {
    "group:users": [
      "someuser@somedomain.com"
    ],
    "group:admin": [
      "someuser@somedomain.com"
    ],
  },
  "hosts": {
    "workstationsA": "10.200.0.0/16",
    "workstationsAB": "10.210.0.0/16",
    "workstationsB": "10.61.0.0/16",
    "workstationsC": "10.30.1.0/24",
  },
  "acls": [
    {
      "action": "accept",
      "src": [
        "group:users",
      ],
      "dst": [
        "workstationsC:*",
        "workstationsB:*",
        "workstationsA:*",
        "tag:farm:*"
      ]
    },
    {
      "action": "accept",
      "src": [
        "group:admin"
      ],
      "dst": [
        "workstationsAB:*"
      ]
    }
  ],
  "tagOwners": {
    "tag:farm": [
      "workstations@"
    ]
  }
}

Config (Nix module):

services.headscale = {
    enable = true;

    settings = {
      server_url = "https://redacted";
      policy.path = ./acl.jsonc;
      oidc = {
        issuer = "https://accounts.google.com";
        client_id = "redacted";
        client_secret_path = config.sops.secrets.headscaleOIDC.path;
        allowed_domains = [
          "redacted"
          "redacted"
        ];
      };
      dns = {
        magic_dns = false;
        override_local_dns = false;
        base_domain = "tailnet.redacted.lan";
        search_domains = [
          "redacted.lan"
          "redacted.dev"
        ];
        nameservers = {
          global = [
            "9.9.9.11"
            "149.112.112.11"
            "2620:fe::11"
            "2620:fe::fe:11"
          ];
          split = {
            "redacted.lan" = [
              "10.200.1.5"
              "10.200.1.38"
              "10.61.0.6"
            ];
            "redacted.dev" = [
              "10.200.1.5"
              "10.200.1.38"
              "10.61.0.6"
            ];
          };
        };
      };
    };
  };

Environment

- OS: NixOS 25.11
- Headscale version: 0.27.1
- Tailscale version: 1.90.9

There are only 3 nodes in the account "workstations" which are subnet routes.

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

I didn't dump the netmap because it contained sensitive information (emails and usernames). Is there any way to not export this?
log.txt
This log shows the no rules matched, after the wgengine: Reconfig: configuring userspace WireGuard config (with 14/57 peers) which is the headscale restart everything starts working.

Originally created by @Toomoch on GitHub (Dec 16, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior Tailscale client fails to ping tailscale IPs/subnets routes and logs to journal with the following errors: ``` de des. 16 19:00:14 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39478 > 10.200.1.38:53 rejected due to acl de des. 16 19:00:15 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39478 > 10.200.1.38:53 rejected due to acl de des. 16 19:00:15 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") de des. 16 19:00:24 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") (5 dropped) de des. 16 19:00:24 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:54948 > 10.61.0.6:53 rejected due to acl de des. 16 19:00:25 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:54948 > 10.61.0.6:53 rejected due to acl de des. 16 19:00:25 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") de des. 16 19:00:35 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") (5 dropped) de des. 16 19:00:35 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39556 > 10.200.1.5:53 rejected due to acl de des. 16 19:00:36 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39556 > 10.200.1.5:53 rejected due to acl de des. 16 19:00:36 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") de des. 16 19:00:42 b450 tailscaled[17058]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") (4 dropped) de des. 16 19:00:42 b450 tailscaled[17058]: open-conn-track: flow TCP 100.64.0.61:39556 > 10.200.1.5:53 rejected due to acl ``` After a headscale restart, it starts working. ### Expected Behavior For it to work without a restart ### Steps To Reproduce ACL: ```jsonc { "groups": { "group:users": [ "someuser@somedomain.com" ], "group:admin": [ "someuser@somedomain.com" ], }, "hosts": { "workstationsA": "10.200.0.0/16", "workstationsAB": "10.210.0.0/16", "workstationsB": "10.61.0.0/16", "workstationsC": "10.30.1.0/24", }, "acls": [ { "action": "accept", "src": [ "group:users", ], "dst": [ "workstationsC:*", "workstationsB:*", "workstationsA:*", "tag:farm:*" ] }, { "action": "accept", "src": [ "group:admin" ], "dst": [ "workstationsAB:*" ] } ], "tagOwners": { "tag:farm": [ "workstations@" ] } } ``` Config (Nix module): ```nix services.headscale = { enable = true; settings = { server_url = "https://redacted"; policy.path = ./acl.jsonc; oidc = { issuer = "https://accounts.google.com"; client_id = "redacted"; client_secret_path = config.sops.secrets.headscaleOIDC.path; allowed_domains = [ "redacted" "redacted" ]; }; dns = { magic_dns = false; override_local_dns = false; base_domain = "tailnet.redacted.lan"; search_domains = [ "redacted.lan" "redacted.dev" ]; nameservers = { global = [ "9.9.9.11" "149.112.112.11" "2620:fe::11" "2620:fe::fe:11" ]; split = { "redacted.lan" = [ "10.200.1.5" "10.200.1.38" "10.61.0.6" ]; "redacted.dev" = [ "10.200.1.5" "10.200.1.38" "10.61.0.6" ]; }; }; }; }; }; ``` ### Environment ```markdown - OS: NixOS 25.11 - Headscale version: 0.27.1 - Tailscale version: 1.90.9 There are only 3 nodes in the account "workstations" which are subnet routes. ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Debug information I didn't dump the netmap because it contained sensitive information (emails and usernames). Is there any way to not export this? [log.txt](https://github.com/user-attachments/files/24197921/log.txt) This log shows the no rules matched, after the `wgengine: Reconfig: configuring userspace WireGuard config (with 14/57 peers)` which is the headscale restart everything starts working.
adam added the bug label 2025-12-29 02:28:42 +01:00
adam closed this issue 2025-12-29 02:28:42 +01:00
adam commented 2025-12-29 02:28:43 +01:00
Author
Owner
Copy Link

@Toomoch commented on GitHub (Dec 16, 2025):

This is clearly #2888, closing

Sorry for the duplicate

@Toomoch commented on GitHub (Dec 16, 2025): This is clearly #2888, closing Sorry for the duplicate
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1172
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?