starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

ACLs and routes #236

New Issue
Closed
opened 2025-12-29 01:24:36 +01:00 by adam · 6 comments
adam commented 2025-12-29 01:24:36 +01:00
Owner
Copy Link

Originally created by @reynico on GitHub (Mar 15, 2022).

👋 Hi!

I'm using an EC2 instance as a VPN termination node to connect to my internal VPC resources. With no ACLs defined I'm able to push the required route (10.0.0.0/16) from the Tailscale instance living on EC2, thus I'm also able to connect from my laptop to my internal resources.

These are the routes I see on my laptop, for the Tailscale client (on utun3)

default            link#27            UCSIg           utun3
10/16              link#27            UCS             utun3
10.0.11.161        link#27            UHWIi           utun3
10.1/16            link#27            UCS             utun3
100.64.0.1/32      link#27            UCS             utun3
100.64.0.2         100.64.0.2         UH              utun3
100.100.100.100/32 link#27            UCS             utun3
100.100.100.100    link#27            UHWIi           utun3
224.0.0/4          link#27            UmCSI           utun3
255.255.255.255/32 link#27            UCSI            utun3

If I define the following ACL huJSON file:

{
    "ACLs": [
        {
            "Action": "accept",
            "Users": [
                "ec2-dev",
            ],
            "Ports": [
                "*:*",
            ],
        },
        {
            "Action": "accept",
            "Users": [
                "nico-mbp",
            ],
            "Ports": [
                "10.0.0.0/16:*",
                "100.0.0.0/8:*",
            ]
        }
    ]
}

I lose connection to the entire 10.0.0.0/16 network, but I'm still able to ping/ssh the ec2-dev EC2 instance on 100.64.0.1 (where Headscale and Tailscale are running). And my routes look the following now:

10.0.11.161        link#27            UHWIig          utun3
100.64.0.2         100.64.0.2         UH              utun3
100.100.100.100/32 link#27            UCS             utun3
100.100.100.100    link#27            UHWIi           utun3
224.0.0/4          link#27            UmCSI           utun3
255.255.255.255/32 link#27            UCSI            utun3

If I set my ACL as Ports *:* the 10.0.0.0/16 networks access comes back:

 {
            "Action": "accept",
            "Users": [
                "nico-mbp",
            ],
            "Ports": [
                "*:*",
            ]
        }

EDIT:
Narrowing down the last test where I set Ports *:*, connection to my internal resources also works if I just permit 22

 {
            "Action": "accept",
            "Users": [
                "nico-mbp",
            ],
            "Ports": [
                "*:22",
            ]
        }

Not sure what am I missing here,
Thanks.

Originally created by @reynico on GitHub (Mar 15, 2022). 👋 Hi! I'm using an EC2 instance as a VPN termination node to connect to my internal VPC resources. With no ACLs defined I'm able to push the required route (`10.0.0.0/16`) from the Tailscale instance living on EC2, thus I'm also able to connect from my laptop to my internal resources. These are the routes I see on my laptop, for the Tailscale client (on utun3) ``` default link#27 UCSIg utun3 10/16 link#27 UCS utun3 10.0.11.161 link#27 UHWIi utun3 10.1/16 link#27 UCS utun3 100.64.0.1/32 link#27 UCS utun3 100.64.0.2 100.64.0.2 UH utun3 100.100.100.100/32 link#27 UCS utun3 100.100.100.100 link#27 UHWIi utun3 224.0.0/4 link#27 UmCSI utun3 255.255.255.255/32 link#27 UCSI utun3 ``` If I define the following ACL huJSON file: ``` { "ACLs": [ { "Action": "accept", "Users": [ "ec2-dev", ], "Ports": [ "*:*", ], }, { "Action": "accept", "Users": [ "nico-mbp", ], "Ports": [ "10.0.0.0/16:*", "100.0.0.0/8:*", ] } ] } ``` I lose connection to the entire `10.0.0.0/16` network, but I'm still able to ping/ssh the `ec2-dev` EC2 instance on `100.64.0.1` (where Headscale and Tailscale are running). And my routes look the following now: ```default link#27 UCSIg utun3 10.0.11.161 link#27 UHWIig utun3 100.64.0.2 100.64.0.2 UH utun3 100.100.100.100/32 link#27 UCS utun3 100.100.100.100 link#27 UHWIi utun3 224.0.0/4 link#27 UmCSI utun3 255.255.255.255/32 link#27 UCSI utun3 ``` If I set my ACL as Ports `*:*` the `10.0.0.0/16` networks access comes back: ``` { "Action": "accept", "Users": [ "nico-mbp", ], "Ports": [ "*:*", ] } ``` EDIT: Narrowing down the last test where I set Ports `*:*`, connection to my internal resources also works if I just permit `22` ``` { "Action": "accept", "Users": [ "nico-mbp", ], "Ports": [ "*:22", ] } ``` Not sure what am I missing here, Thanks.
adam added the bug label 2025-12-29 01:24:36 +01:00
adam closed this issue 2025-12-29 01:24:36 +01:00
adam commented 2025-12-29 01:24:37 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (Mar 17, 2022):

What is the name of you router ?

I saw in my config that we need to allow the computers to talk to the router in order to allow traffic to be forwarded to subnet, so the good rule would be (if my understanding of your setup is ok):

{
  "acls": [
    {"action":"accept", "users": ["ec2-dev"], "ports": ["*:*"]},
    {"action":"accept", "users": ["nico-mbp"], "ports": [
      "ec2-dev:0",       // Allow nico-mbp to go through ec2-dev without accessing any ports
      "10.0.0.0/16:*",   // allow traffic to go to destination on all ports
      ], 
    },
  ]
}
@restanrm commented on GitHub (Mar 17, 2022): What is the name of you router ? I saw in my config that we need to allow the computers to talk to the router in order to allow traffic to be forwarded to subnet, so the good rule would be (if my understanding of your setup is ok): ```hujson { "acls": [ {"action":"accept", "users": ["ec2-dev"], "ports": ["*:*"]}, {"action":"accept", "users": ["nico-mbp"], "ports": [ "ec2-dev:0", // Allow nico-mbp to go through ec2-dev without accessing any ports "10.0.0.0/16:*", // allow traffic to go to destination on all ports ], }, ] } ```
adam commented 2025-12-29 01:24:38 +01:00
Author
Owner
Copy Link

@reynico commented on GitHub (Mar 17, 2022):

Hi! ec2-dev acts as a router.

Cool, by adding "ec2-dev:0", the routing works as expected. Thank you!

@kradalby should we add some information under the ACLs doc?

@reynico commented on GitHub (Mar 17, 2022): Hi! `ec2-dev` acts as a router. Cool, by adding `"ec2-dev:0", ` the routing works as expected. Thank you! @kradalby should we add some information under the ACLs doc?
adam commented 2025-12-29 01:24:38 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Mar 17, 2022):

Yes please

@kradalby commented on GitHub (Mar 17, 2022): Yes please
adam commented 2025-12-29 01:24:40 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (May 14, 2022):

Can we close this issue ?

@restanrm commented on GitHub (May 14, 2022): Can we close this issue ?
adam commented 2025-12-29 01:24:40 +01:00
Author
Owner
Copy Link

@reynico commented on GitHub (May 14, 2022):

@restanrm what do you think about https://github.com/juanfont/headscale/pull/510?

@reynico commented on GitHub (May 14, 2022): @restanrm what do you think about https://github.com/juanfont/headscale/pull/510?
adam commented 2025-12-29 01:24:40 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (May 16, 2022):

Sorry I didn't looked through the documentation. It's a good addition !! 

@restanrm commented on GitHub (May 16, 2022): Sorry I didn't looked through the documentation. It's a good addition !! 
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#236
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?