starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

ACLs with multiple users do not work #475

New Issue
Closed
opened 2025-12-29 01:30:07 +01:00 by adam · 2 comments
adam commented 2025-12-29 01:30:07 +01:00
Owner
Copy Link

Originally created by @ToeiRei on GitHub (Apr 18, 2023).

Config as follows:


  "groups": {
    "group:admin": ["user1"],
    "group:family": ["user2"],
  },

  "Hosts": {
    "firewall": "100.64.0.1",
    "lan": "192.168.1.0/24",
  },
    
  "acls": [
    // Admin can connect to LAN
    {
      "action": "accept",
      "src": ["group:admin"],
      "dst": ["lan:*", "firewall:0", "group:admin:*" ]
    },
       
    // Family can connect to LAN
    {
      "action": "accept",
      "src": ["group:family"],
      "dst": ["lan:*", "firewall:0", "group:family:*" ]
    },
  ] 
}

firewall is 'owned' by user1

The problem:

  • user1 (admin) can connect to headscale
  • user2 (family group) can connect to headscale
  • user1 is able to connect to a host in the LAN
  • user2 cannot talk to any hosts in the LAN

Environment:
tested with v0.22.0-alpha2 as well as with v0.21.0

Originally created by @ToeiRei on GitHub (Apr 18, 2023). Config as follows: ```json "groups": { "group:admin": ["user1"], "group:family": ["user2"], }, "Hosts": { "firewall": "100.64.0.1", "lan": "192.168.1.0/24", }, "acls": [ // Admin can connect to LAN { "action": "accept", "src": ["group:admin"], "dst": ["lan:*", "firewall:0", "group:admin:*" ] }, // Family can connect to LAN { "action": "accept", "src": ["group:family"], "dst": ["lan:*", "firewall:0", "group:family:*" ] }, ] } ``` firewall is 'owned' by user1 The problem: - user1 (admin) can connect to headscale - user2 (family group) can connect to headscale - user1 is able to connect to a host in the LAN - user2 cannot talk to any hosts in the LAN Environment: tested with v0.22.0-alpha2 as well as with v0.21.0
adam added the stalebug labels 2025-12-29 01:30:07 +01:00
adam closed this issue 2025-12-29 01:30:07 +01:00
adam commented 2025-12-29 02:18:38 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Oct 16, 2023):

This issue is stale because it has been open for 180 days with no activity.

@github-actions[bot] commented on GitHub (Oct 16, 2023): This issue is stale because it has been open for 180 days with no activity.
adam commented 2025-12-29 02:18:38 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Oct 31, 2023):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Oct 31, 2023): This issue was closed because it has been inactive for 14 days since being marked as stale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#475
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?