starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

dst:"*:*" not working in ACLs #299

New Issue
Closed
opened 2025-12-29 01:26:21 +01:00 by adam · 7 comments
adam commented 2025-12-29 01:26:21 +01:00
Owner
Copy Link

Originally created by @fernandoenzo on GitHub (Jul 30, 2022).

Bug description

The error that I am going to describe is very simple, and I have almost said everything in the subject of the message.
I have two namespaces: ns_A and ns_B
In each namespace I have only one device registered: pc_A and pc_B
I want pc_A to be able to connect to pc_B and any other possible new namespace added in the future, but not the other way around, so I create this simple acl.hujson file:

"acls": [                                                                                                                                                                                                                                   
    {                                                                                                                                                                                                                                         
      "action": "accept",                                                                                                                                                                                                                     
      "src": ["ns_A"],                                                                                                                                                                                                                    
      "dst": ["*:*"]                                                                                                                                                                                                                          
    },                                                                                                                                                                                                                                        
  ]

Result: It is impossible for pc_A to even ping pc_B.
Additional info: When running tailscale status, pc_A can see pc_B and pc_B can't see pc_A, so that's fine. I don't know where the problem could be. And also, if you change "dst":["*:*"] to "dst":["ns_B:*"] everything works perfectly. So this looks a lot like a bug with the "dst":["*:*"] option.

I'm using the latest official Docker Headscale v0.16.

Originally created by @fernandoenzo on GitHub (Jul 30, 2022). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the bug report in this language. --> **Bug description** The error that I am going to describe is very simple, and I have almost said everything in the subject of the message. I have two namespaces: `ns_A` and `ns_B` In each namespace I have only one device registered: `pc_A` and `pc_B` I want `pc_A` to be able to connect to `pc_B` and any other possible new `namespace` added in the future, but not the other way around, so I create this simple `acl.hujson` file: ``` "acls": [ { "action": "accept", "src": ["ns_A"], "dst": ["*:*"] }, ] ``` **Result:** It is impossible for `pc_A` to even ping `pc_B`. **Additional info:** When running `tailscale status`, `pc_A` can see `pc_B` and `pc_B` can't see `pc_A`, so that's fine. I don't know where the problem could be. And also, if you change `"dst":["*:*"]` to `"dst":["ns_B:*"]` everything works perfectly. So this looks a lot like a bug with the `"dst":["*:*"]` option. I'm using the latest official Docker Headscale v0.16.
adam added the bug label 2025-12-29 01:26:21 +01:00
adam closed this issue 2025-12-29 01:26:22 +01:00
adam commented 2025-12-29 01:26:23 +01:00
Author
Owner
Copy Link

@peanutyost commented on GitHub (Jul 31, 2022):

I had the exact same problem.

@peanutyost commented on GitHub (Jul 31, 2022): I had the exact same problem.
adam commented 2025-12-29 01:26:24 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Sep 8, 2022):

@restanrm Have you encountered this?

@kradalby commented on GitHub (Sep 8, 2022): @restanrm Have you encountered this?
adam commented 2025-12-29 01:26:24 +01:00
Author
Owner
Copy Link

@skorokithakis commented on GitHub (Sep 12, 2022):

I have a similar problem as well. When adding nodes, the new node won't see any other nodes, and I have an ACL like this. I don't know if it affects, but it's an issue.

@skorokithakis commented on GitHub (Sep 12, 2022): I have a similar problem as well. When adding nodes, the new node won't see any other nodes, and I have an ACL like this. I don't know if it affects, but it's an issue.
adam commented 2025-12-29 01:26:24 +01:00
Author
Owner
Copy Link

@skorokithakis commented on GitHub (Sep 12, 2022):

Changing the ACL to list the tags explicitly worked.

@skorokithakis commented on GitHub (Sep 12, 2022): Changing the ACL to list the tags explicitly worked.
adam commented 2025-12-29 01:26:24 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (Sep 16, 2022):

@restanrm Have you encountered this?

I did not get the time to investigate this. If someone has more time for it, please go ahead.

@restanrm commented on GitHub (Sep 16, 2022): > @restanrm Have you encountered this? I did not get the time to investigate this. If someone has more time for it, please go ahead.
adam commented 2025-12-29 01:26:25 +01:00
Author
Owner
Copy Link

@razza-guhl commented on GitHub (Nov 7, 2022):

Same issue here. When change "dst":["*:*"] to "dst":["namespace:*"] it's working.

@razza-guhl commented on GitHub (Nov 7, 2022): Same issue here. When change `"dst":["*:*"]` to `"dst":["namespace:*"]` it's working.
adam commented 2025-12-29 01:26:25 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Mar 28, 2023):

This should have been fixed in main now, would be create if someone can help test this.

@kradalby commented on GitHub (Mar 28, 2023): This should have been fixed in `main` now, would be create if someone can help test this.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#299
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?