starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

suspected bug with ipv4/ipv6 #456

New Issue
Closed
opened 2025-12-29 01:29:36 +01:00 by adam · 3 comments
adam commented 2025-12-29 01:29:36 +01:00
Owner
Copy Link

Originally created by @MaxMatti on GitHub (Mar 30, 2023).

Bug description

After setting up headscale as a systemd service according to the documentation with a listen_addr: 0.0.0.0:16000, netstat reports port 16000 only being open on ip ::, not on 0.0.0.0. The port is also not reachable from other devices. Unfortunately due to my network config I am unable to test whether the ipv6 port is reachable from other devices.

To Reproduce

full config file:

---
server_url: http://[...]:16000
listen_addr: 0.0.0.0:16000
metrics_listen_addr: 127.0.0.1:9090
grpc_listen_addr: 127.0.0.1:50443
grpc_allow_insecure: false
private_key_path: /var/lib/headscale/private.key
noise:
  private_key_path: /var/lib/headscale/noise_private.key
ip_prefixes:
  - fd7a:115c:a1e0::/48
  - 100.64.0.0/10
derp:
  server:
    enabled: false
    region_id: 999
    region_code: "headscale"
    region_name: "Headscale Embedded DERP"
    stun_listen_addr: "0.0.0.0:3478"
  urls:
    - https://controlplane.tailscale.com/derpmap/default
  paths: []
  auto_update_enabled: true
  update_frequency: 24h
disable_check_updates: false
ephemeral_node_inactivity_timeout: 30m
node_update_check_interval: 10s
db_type: sqlite3
db_path: /var/lib/headscale/db.sqlite
acme_url: https://acme-v02.api.letsencrypt.org/directory
acme_email: ""
tls_letsencrypt_hostname: ""
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
tls_letsencrypt_challenge_type: HTTP-01
tls_letsencrypt_listen: ":http"
tls_cert_path: ""
tls_key_path: ""
log:
  format: text
  level: info
acl_policy_path: ""
dns_config:
  override_local_dns: true
  nameservers:
    - 9.9.9.9
    - 1.1.1.1
    - 8.8.8.8
  domains: []
unix_socket: /var/run/headscale/headscale.sock
unix_socket_permission: "0770"
logtail:
  enabled: false
randomize_client_port: false

Context info

  • Version of headscale used: v0.21.0
  • OS version:
Oracle Linux Server release 8.7
NAME="Oracle Linux Server"
VERSION="8.7"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="8.7"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Oracle Linux Server 8.7"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:8:7:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://bugzilla.oracle.com/"

ORACLE_BUGZILLA_PRODUCT="Oracle Linux 8"
ORACLE_BUGZILLA_PRODUCT_VERSION=8.7
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=8.7
Red Hat Enterprise Linux release 8.7 (Ootpa)
Oracle Linux Server release 8.7

(fresh install)

  • Kernel version: Linux instance-20230329-2333 5.15.0-6.80.3.1.el8uek.x86_64 #2 SMP Tue Jan 10 11:28:16 PST 2023 x86_64 x86_64 x86_64 GNU/Linux
  • Log output:
Mar 29 22:25:36 instance-20230329-2333 systemd[1]: Stopped headscale controller.
Mar 29 22:25:36 instance-20230329-2333 systemd[1]: Started headscale controller.
Mar 29 22:25:37 instance-20230329-2333 headscale[14722]: 2023-03-29T22:25:37Z INF Setting up a DERPMap update worker frequency=86400000
Mar 29 22:25:37 instance-20230329-2333 headscale[14722]: 2023-03-29T22:25:37Z INF listening and serving HTTP on: 0.0.0.0:16000
Mar 29 22:25:37 instance-20230329-2333 headscale[14722]: 2023-03-29T22:25:37Z INF listening and serving metrics on: 127.0.0.1:9090
Originally created by @MaxMatti on GitHub (Mar 30, 2023). **Bug description** After setting up headscale [as a systemd service](https://github.com/juanfont/headscale/blob/main/docs/running-headscale-linux.md#running-headscale-in-the-background-with-systemd) according to [the documentation](https://github.com/juanfont/headscale/blob/main/docs/running-headscale-linux.md) with a `listen_addr: 0.0.0.0:16000`, netstat reports port 16000 only being open on ip `::`, not on `0.0.0.0`. The port is also not reachable from other devices. Unfortunately due to my network config I am unable to test whether the ipv6 port is reachable from other devices. **To Reproduce** full config file: ```yaml --- server_url: http://[...]:16000 listen_addr: 0.0.0.0:16000 metrics_listen_addr: 127.0.0.1:9090 grpc_listen_addr: 127.0.0.1:50443 grpc_allow_insecure: false private_key_path: /var/lib/headscale/private.key noise: private_key_path: /var/lib/headscale/noise_private.key ip_prefixes: - fd7a:115c:a1e0::/48 - 100.64.0.0/10 derp: server: enabled: false region_id: 999 region_code: "headscale" region_name: "Headscale Embedded DERP" stun_listen_addr: "0.0.0.0:3478" urls: - https://controlplane.tailscale.com/derpmap/default paths: [] auto_update_enabled: true update_frequency: 24h disable_check_updates: false ephemeral_node_inactivity_timeout: 30m node_update_check_interval: 10s db_type: sqlite3 db_path: /var/lib/headscale/db.sqlite acme_url: https://acme-v02.api.letsencrypt.org/directory acme_email: "" tls_letsencrypt_hostname: "" tls_letsencrypt_cache_dir: /var/lib/headscale/cache tls_letsencrypt_challenge_type: HTTP-01 tls_letsencrypt_listen: ":http" tls_cert_path: "" tls_key_path: "" log: format: text level: info acl_policy_path: "" dns_config: override_local_dns: true nameservers: - 9.9.9.9 - 1.1.1.1 - 8.8.8.8 domains: [] unix_socket: /var/run/headscale/headscale.sock unix_socket_permission: "0770" logtail: enabled: false randomize_client_port: false ``` **Context info** - Version of headscale used: v0.21.0 - OS version: ``` Oracle Linux Server release 8.7 NAME="Oracle Linux Server" VERSION="8.7" ID="ol" ID_LIKE="fedora" VARIANT="Server" VARIANT_ID="server" VERSION_ID="8.7" PLATFORM_ID="platform:el8" PRETTY_NAME="Oracle Linux Server 8.7" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:oracle:linux:8:7:server" HOME_URL="https://linux.oracle.com/" BUG_REPORT_URL="https://bugzilla.oracle.com/" ORACLE_BUGZILLA_PRODUCT="Oracle Linux 8" ORACLE_BUGZILLA_PRODUCT_VERSION=8.7 ORACLE_SUPPORT_PRODUCT="Oracle Linux" ORACLE_SUPPORT_PRODUCT_VERSION=8.7 Red Hat Enterprise Linux release 8.7 (Ootpa) Oracle Linux Server release 8.7 ``` (fresh install) - Kernel version: `Linux instance-20230329-2333 5.15.0-6.80.3.1.el8uek.x86_64 #2 SMP Tue Jan 10 11:28:16 PST 2023 x86_64 x86_64 x86_64 GNU/Linux` - Log output: ``` Mar 29 22:25:36 instance-20230329-2333 systemd[1]: Stopped headscale controller. Mar 29 22:25:36 instance-20230329-2333 systemd[1]: Started headscale controller. Mar 29 22:25:37 instance-20230329-2333 headscale[14722]: 2023-03-29T22:25:37Z INF Setting up a DERPMap update worker frequency=86400000 Mar 29 22:25:37 instance-20230329-2333 headscale[14722]: 2023-03-29T22:25:37Z INF listening and serving HTTP on: 0.0.0.0:16000 Mar 29 22:25:37 instance-20230329-2333 headscale[14722]: 2023-03-29T22:25:37Z INF listening and serving metrics on: 127.0.0.1:9090 ```
adam added the bug label 2025-12-29 01:29:36 +01:00
adam closed this issue 2025-12-29 01:29:36 +01:00
adam commented 2025-12-29 01:29:37 +01:00
Author
Owner
Copy Link

@PikuZheng commented on GitHub (Apr 1, 2023):

[::]:16000 include 0.0.0.0:16000 if you mean

@PikuZheng commented on GitHub (Apr 1, 2023): [::]:16000 include 0.0.0.0:16000 if you mean
adam commented 2025-12-29 01:29:37 +01:00
Author
Owner
Copy Link

@dunnl commented on GitHub (May 29, 2023):

If a service is listening on the same port on ipv4 and ipv6, it is common for netstat to show a single entry for tcp6 (or upd6). Basically the ipv6 stack internally is able to handle ipv4 traffic as well. I think you should elaborate on what problem you're experiencing, and what you want to happen, because it's unclear from the report. Since you say The port is also not reachable from other devices., you may just have a problem with your firewall configuration.

By the way, netstat has been deprecated for 10+ years I believe. The modern program is ss although the behavior will be similar.

@dunnl commented on GitHub (May 29, 2023): If a service is listening on the same port on ipv4 and ipv6, it is common for `netstat` to show a single entry for `tcp6` (or `upd6`). Basically the ipv6 stack internally is able to handle ipv4 traffic as well. I think you should elaborate on what problem you're experiencing, and what you want to happen, because it's unclear from the report. Since you say `The port is also not reachable from other devices.`, you may just have a problem with your firewall configuration. By the way, `netstat` has been deprecated for 10+ years I believe. The modern program is `ss` although the behavior will be similar.
adam commented 2025-12-29 01:29:37 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Jun 19, 2023):

Hi

Can you try with the official .deb package, or the .rpm repo provided at copr.fedorainfracloud.org/coprs/jonathanspw/headscale?

It sounds like a Linux thing, and not Headscale.

@kradalby commented on GitHub (Jun 19, 2023): Hi Can you try with the official `.deb` package, or the `.rpm` repo provided at [copr.fedorainfracloud.org/coprs/jonathanspw/headscale](https://copr.fedorainfracloud.org/coprs/jonathanspw/headscale/)? It sounds like a Linux thing, and not Headscale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#456
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?