starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 12:20:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

ACL src/dst with host-alias not working #367

New Issue
Closed
opened 2025-12-29 01:27:48 +01:00 by adam · 8 comments
adam commented 2025-12-29 01:27:48 +01:00
Owner
Copy Link

Originally created by @razza-guhl on GitHub (Nov 7, 2022).

Bug description

Using host alias as dst/destination in ACLs does not work. In this case no node can talk to each other. The command "tailscale status" only shows itself.
Same applies by using alias in src/source as well.

When using the IP instead host alias, the ACL works.

To Reproduce

A sample ACL which is not working:

{
    "hosts": {
        "client1": "100.64.0.1",
        "client2": "100.64.0.2",
        "server":  "100.64.0.4",
    },

    "acls": [
        {
            "action": "accept",
            "src": [
                "*",
            ],
            "dst": [
                "server:22,80",
            ],
        },
    ],
}

Context info

  • Version of headscale used: 0.17.0-beta2
  • Version of tailscale client: 1.32.2 (Windows), 1.32.0 (Linux)
  • OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version: Windows 10, Linux DietPi v8.9.2
  • Kernel version: 5.15.61-v8+
  • The relevant config parameters you used: see above
  • Log output: no
Originally created by @razza-guhl on GitHub (Nov 7, 2022). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the bug report in this language. --> **Bug description** Using host alias as dst/destination in ACLs does not work. In this case no node can talk to each other. The command "tailscale status" only shows itself. Same applies by using alias in src/source as well. When using the IP instead host alias, the ACL works. **To Reproduce** A sample ACL which is not working: ``` { "hosts": { "client1": "100.64.0.1", "client2": "100.64.0.2", "server": "100.64.0.4", }, "acls": [ { "action": "accept", "src": [ "*", ], "dst": [ "server:22,80", ], }, ], } ``` **Context info** - Version of headscale used: 0.17.0-beta2 - Version of tailscale client: 1.32.2 (Windows), 1.32.0 (Linux) - OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version: Windows 10, Linux DietPi v8.9.2 - Kernel version: 5.15.61-v8+ - The relevant config parameters you used: see above - Log output: no
adam added the bug label 2025-12-29 01:27:48 +01:00
adam closed this issue 2025-12-29 01:27:48 +01:00
adam commented 2025-12-29 01:27:49 +01:00
Author
Owner
Copy Link

@razza-guhl commented on GitHub (Nov 8, 2022):

I tested the ACL on headscale version 0.16.4 (stable) with the same result

@razza-guhl commented on GitHub (Nov 8, 2022): I tested the ACL on headscale version 0.16.4 (stable) with the same result
adam commented 2025-12-29 01:27:49 +01:00
Author
Owner
Copy Link

@camaeel commented on GitHub (Nov 28, 2022):

I have similar issues when using minimal acl at version 0.17.0:

acls: 
- src:
  - "*"
  dest:
  - "*:*"
  action: "accept"
@camaeel commented on GitHub (Nov 28, 2022): I have similar issues when using minimal acl at version 0.17.0: ``` acls: - src: - "*" dest: - "*:*" action: "accept" ```
adam commented 2025-12-29 01:27:50 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Nov 29, 2022):

ACLs are in a fragile state and we are getting to a point where we can start writing tests to verify that they work, so we will hopefully have time to improve and fix them from now on, but I cannot give an ETA.

@kradalby commented on GitHub (Nov 29, 2022): ACLs are in a fragile state and we are getting to a point where we can start writing tests to verify that they work, so we will hopefully have time to improve and fix them from now on, but I cannot give an ETA.
adam commented 2025-12-29 01:27:50 +01:00
Author
Owner
Copy Link

@camaeel commented on GitHub (Nov 29, 2022):

Then maybe it should be marked as not fully functional in the docs.

@camaeel commented on GitHub (Nov 29, 2022): Then maybe it should be marked as not fully functional in the docs.
adam commented 2025-12-29 01:27:50 +01:00
Author
Owner
Copy Link

@12nick12 commented on GitHub (Dec 6, 2022):

I can't wait till they're 100%. Right now it works if I have * open to *:anyport, but that means all devices get shown on each host.

@12nick12 commented on GitHub (Dec 6, 2022): I can't wait till they're 100%. Right now it works if I have `*` open to `*:anyport`, but that means all devices get shown on each host.
adam commented 2025-12-29 01:27:50 +01:00
Author
Owner
Copy Link

@camaeel commented on GitHub (Dec 6, 2022):

@kradalby Maybe there are some issues describing what is exactly missing/not working, so the community could help here?
Is it possible to test in an automated way what is working and what is not? Wither with unit tests or integration tests (using for example testcontainers to setup "the test case")?

@camaeel commented on GitHub (Dec 6, 2022): @kradalby Maybe there are some issues describing what is exactly missing/not working, so the community could help here? Is it possible to test in an automated way what is working and what is not? Wither with unit tests or integration tests (using for example testcontainers to setup "the test case")?
adam commented 2025-12-29 01:27:51 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Dec 15, 2022):

@camaeel my goal is to start writing these tests this week. which should hopefully make it more clear what is and isnt working because right now we actually dont know.

@kradalby commented on GitHub (Dec 15, 2022): @camaeel my goal is to start writing these tests this week. which should hopefully make it more clear what is and isnt working because right now we actually dont know.
adam commented 2025-12-29 01:27:51 +01:00
Author
Owner
Copy Link

@camaeel commented on GitHub (Dec 15, 2022):

That would be great.
I tried to figure out how tailscale client gets the data about other nodes? Does it call the same api that is used by the headscale cli, or something else?

@camaeel commented on GitHub (Dec 15, 2022): That would be great. I tried to figure out how tailscale client gets the data about other nodes? Does it call the same api that is used by the headscale cli, or something else?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#367
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?