starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

port knocking in front of headscale server? #620

New Issue
Closed
opened 2025-12-29 02:21:16 +01:00 by adam · 5 comments
adam commented 2025-12-29 02:21:16 +01:00
Owner
Copy Link

Originally created by @unusualevent on GitHub (Feb 2, 2024).

Why

The API server and STUN-like coordination usually need to happen on a public server.

For tailscale's own, they have it public.

Headscale could probably get away with having the coordination server itself have the host firewall (e.g., iptables) use a port knocking daemon. The cloud firewall would still be open on those port knocking ports.

Description

Is it possible to have a port knocking client on a device alongside the tailscale client?

is it possible to have headscale operate behind port knocking?

what would need to change for that to be the case?

This limits the ability of an attacker to try exploiting RCE without knowing the port knocking code. Or even knowing the headscale coordination server is there.

Originally created by @unusualevent on GitHub (Feb 2, 2024). ## Why The API server and STUN-like coordination usually need to happen on a public server. For tailscale's own, they have it public. Headscale could probably get away with having the coordination server itself have the host firewall (e.g., iptables) use a port knocking daemon. The cloud firewall would still be open on those port knocking ports. ## Description Is it possible to have a port knocking client on a device alongside the tailscale client? is it possible to have headscale operate behind port knocking? what would need to change for that to be the case? This limits the ability of an attacker to try exploiting RCE without knowing the port knocking code. Or even knowing the headscale coordination server is there.
adam added the enhancement label 2025-12-29 02:21:16 +01:00
adam closed this issue 2025-12-29 02:21:16 +01:00
adam commented 2025-12-29 02:21:16 +01:00
Author
Owner
Copy Link

@unusualevent commented on GitHub (Feb 2, 2024):

e.g., survivability onion: don't be there, don't be visible, don't be hit

@unusualevent commented on GitHub (Feb 2, 2024): e.g., survivability onion: don't be there, don't be visible, don't be hit
adam commented 2025-12-29 02:21:16 +01:00
Author
Owner
Copy Link

@ohdearaugustin commented on GitHub (Feb 9, 2024):

I don't think this is possible as you would need to implement port-knocking features in the tailscale client. This project doesn't implement the client and therefore I this feature would first need to be implemented there. This will only be the case if tailscale is going to implement this feature for their customers.

I don't see the headscale folks implementing this by themselves.

Furthermore I rather see it as an edge case, which is not realistic to be implemented. As usual PRs are welcome. I hope this will give a bit of an explanation to your concerns.

@ohdearaugustin commented on GitHub (Feb 9, 2024): I don't think this is possible as you would need to implement port-knocking features in the tailscale client. This project doesn't implement the client and therefore I this feature would first need to be implemented there. This will only be the case if tailscale is going to implement this feature for their customers. I don't see the headscale folks implementing this by themselves. Furthermore I rather see it as an edge case, which is not realistic to be implemented. As usual PRs are welcome. I hope this will give a bit of an explanation to your concerns.
adam commented 2025-12-29 02:21:16 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 10, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (May 10, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:21:17 +01:00
Author
Owner
Copy Link

@SuperSandro2000 commented on GitHub (May 17, 2024):

I would mark this out of scope and close it as won't implement.

@SuperSandro2000 commented on GitHub (May 17, 2024): I would mark this out of scope and close it as won't implement.
adam commented 2025-12-29 02:21:17 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (May 27, 2024):

Yes as mentioned, I think this is going to be too complicated for us to do. A requirement for headscale will continue to be that it is accessible of the public internet.

@kradalby commented on GitHub (May 27, 2024): Yes as mentioned, I think this is going to be too complicated for us to do. A requirement for headscale will continue to be that it is accessible of the public internet.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#620
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?