starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

How to setup an unstrusted private Derper #260

New Issue
Closed
opened 2025-12-29 01:25:13 +01:00 by adam · 7 comments
adam commented 2025-12-29 01:25:13 +01:00
Owner
Copy Link

Originally created by @cryptagoras on GitHub (Apr 29, 2022).

I am trying a simple setup, 2-3 nodes in a single namespaceA and a Derper running on a VPS.
The requirements are:

  • Use derper --verify-clients so the Derper can't not used by anyone but my tailnet nodes
  • (Since from what I understand --verify-clients needs the machine to be part of the tailnet) Deny access to any part of the tailnet (to all ports & clients) just in case the Derper machine gets compromised.

My try
I tried adding the Derper machine on the tailnet but on a second/separate namespaceB and using ACL to limit any access, but the Derper then can't get the peer set of namespaceA.

2022/04/28 22:00:00 derp: 128.128.128.128:46458: client 8472834283423423423A5235235 rejected: client nodekey:8959350349bc82394234 not in set of peers

Also, I couldn't find a way to add tags, maybe with tags, I could initially add the Derper on the same namespace but then tag it on a limited group (related to #558).
If anyone knows if it's possible, it would be great to share, I'll be even happy to add it on the docs unless objected.

Thank you

Originally created by @cryptagoras on GitHub (Apr 29, 2022). I am trying a simple setup, 2-3 nodes in a single namespaceA and a Derper running on a VPS. The requirements are: - Use `derper --verify-clients` so the Derper can't not used by anyone but my tailnet nodes - (Since from what I understand `--verify-clients` needs the machine to be part of the tailnet) Deny access to any part of the tailnet (to all ports & clients) just in case the Derper machine gets compromised. **My try** I tried adding the Derper machine on the tailnet but on a second/separate namespaceB and using ACL to limit any access, but the Derper then can't get the peer set of namespaceA. ``` 2022/04/28 22:00:00 derp: 128.128.128.128:46458: client 8472834283423423423A5235235 rejected: client nodekey:8959350349bc82394234 not in set of peers ``` Also, I couldn't find a way to add tags, maybe with tags, I could initially add the Derper on the same namespace but then tag it on a limited group (related to #558). If anyone knows if it's possible, it would be great to share, I'll be even happy to add it on the docs unless objected. Thank you
adam added the enhancement label 2025-12-29 01:25:13 +01:00
adam closed this issue 2025-12-29 01:25:13 +01:00
adam commented 2025-12-29 01:25:14 +01:00
Author
Owner
Copy Link

@enoperm commented on GitHub (May 10, 2022):

Last time checked (read: about half a year ago) derper with --verify-clients only cares for the machine keys returned by the peer API, so if we provide an "alternative" tailscaled.sock to derper that serves this information, the host does not need to be joined to the tailnet at all. I have a dirty, but functional implementation for an older version of derper (since then, I believe the key format has changed), I could share, but I do not believe I have the time to fix it up right now. Also, it currently only works with the sqlite3 database backend, though I imagine it would not be hard to change that.

@enoperm commented on GitHub (May 10, 2022): Last time checked (read: about half a year ago) derper with `--verify-clients` only cares for the machine keys returned by the peer API, so if we provide an "alternative" `tailscaled.sock` to derper that serves this information, the host does not need to be joined to the tailnet at all. I have a dirty, but functional implementation for an older version of derper (since then, I believe the key format has changed), I could share, but I do not believe I have the time to fix it up right now. Also, it currently only works with the `sqlite3` database backend, though I imagine it would not be hard to change that.
adam commented 2025-12-29 01:25:14 +01:00
Author
Owner
Copy Link

@enoperm commented on GitHub (May 10, 2022):

See https://github.com/enoperm/derpyhead, if you do not mind refactoring it a bit to suit your current usecases.

@enoperm commented on GitHub (May 10, 2022): See https://github.com/enoperm/derpyhead, if you do not mind refactoring it a bit to suit your current usecases.
adam commented 2025-12-29 01:25:14 +01:00
Author
Owner
Copy Link

@cryptagoras commented on GitHub (May 15, 2022):

@enoperm thanks for sharing! Very interesting, I'll look into it since that's the only piece missing from having a working setup in my case.

@cryptagoras commented on GitHub (May 15, 2022): @enoperm thanks for sharing! Very interesting, I'll look into it since that's the only piece missing from having a working setup in my case.
adam commented 2025-12-29 01:25:15 +01:00
Author
Owner
Copy Link

@zhwk commented on GitHub (Jun 19, 2022):

我用了一个变通的方法，从headscale的日志中检索出登录用户的ip地址和machine_key,对比数据库中是否包含该machine_key,如果包含则为信任用户，通过mqqt把该ip传给derp的ipset写入iptables白名单。
headscale的log

2022-06-19T13:05:59Z INF Client sent endpoint update and is ok with a response without peer list handler=PollNetMap machine=****
[GIN] 2022/06/19 - 13:05:59 | 200 | 21.424ms | 1**.1**.1**.38 | POST "/machine/*****ecd207e650765d6c6d794c24b7c47630c0863a4fc5453544e0912/map"
ip_send_success: 1.1.1.38

derp的log

2022/06/19 13:05:26 derp client 192.168.88.254:48180/6e6f64656b65793a62626632313266643766303838313664613538306435623738343938643638653133323036396362343566333438376230356133613964383262393963653735: removing connection
add:1**.1**.1**.38
ipset v7.15: Element cannot be added to the set: it's already added

@zhwk commented on GitHub (Jun 19, 2022): 我用了一个变通的方法，从headscale的日志中检索出登录用户的ip地址和machine_key,对比数据库中是否包含该machine_key,如果包含则为信任用户，通过mqqt把该ip传给derp的ipset写入iptables白名单。 headscale的log ------ 2022-06-19T13:05:59Z INF Client sent endpoint update and is ok with a response without peer list handler=PollNetMap machine=**** [GIN] 2022/06/19 - 13:05:59 | 200 | 21.424ms | 1**.1**.1**.38 | POST "/machine/***********ecd207e650765d6c6d794c24b7c47630c0863a4fc5453544e0912/map" ip_send_success: 1**.1**.1**.38 ------ derp的log ------ 2022/06/19 13:05:26 derp client 192.168.88.254:48180/6e6f64656b65793a62626632313266643766303838313664613538306435623738343938643638653133323036396362343566333438376230356133613964383262393963653735: removing connection add:1**.1**.1**.38 ipset v7.15: Element cannot be added to the set: it's already added -----
adam commented 2025-12-29 01:25:15 +01:00
Author
Owner
Copy Link

@enoperm commented on GitHub (Jun 24, 2022):

For what it's worth, I have had some time to dust off the aforementioned derper nodekey provider, it does not depend on sqlite3 anymore and can now return keys from arbitrary sources.

@enoperm commented on GitHub (Jun 24, 2022): For what it's worth, I have had some time to dust off the aforementioned derper nodekey provider, it does not depend on sqlite3 anymore and can now return keys from arbitrary sources.
adam commented 2025-12-29 01:25:16 +01:00
Author
Owner
Copy Link

@enoperm commented on GitHub (Jun 24, 2022):

Also, it is now tested and compatible with the latest derper.

@enoperm commented on GitHub (Jun 24, 2022): Also, it is now tested and compatible with the latest derper.
adam commented 2025-12-29 01:25:16 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Sep 8, 2022):

headscale now has a built in derper, while I dont think this would resolve this issues without any more changes, has anyone played around with the combination?

@kradalby commented on GitHub (Sep 8, 2022): headscale now has a built in derper, while I dont think this would resolve this issues without any more changes, has anyone played around with the combination?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#260
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?