starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Feature] Restricted nameservers without search domains #711

New Issue
Closed
opened 2025-12-29 02:22:43 +01:00 by adam · 4 comments
adam commented 2025-12-29 02:22:43 +01:00
Owner
Copy Link

Originally created by @casdr on GitHub (May 13, 2024).

Use case

I use the restricted_nameservers option for my own implementation of App Connectors (the DNS server adds routes to the subnet router) so I can route services like 1Password over the tailnet. The issue with the current implementation is that 1password.com will also be added as a search domain, which I don't want.

Description

It would be nice if it was possible to add a restricted nameserver without the domain being added as a searchdomain.

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

I've been digging in the Tailscale client sourcecode, and I think this can be implemented by adding the domain to DNSConfig.MatchDomains instead of DNSConfig.SearchDomains, but I'm not really sure about this.

Originally created by @casdr on GitHub (May 13, 2024). ### Use case I use the `restricted_nameservers` option for my own implementation of App Connectors (the DNS server adds routes to the subnet router) so I can route services like 1Password over the tailnet. The issue with the current implementation is that 1password.com will also be added as a search domain, which I don't want. ### Description It would be nice if it was possible to add a restricted nameserver without the domain being added as a searchdomain. ### Contribution - [ ] I can write the design doc for this feature - [ ] I can contribute this feature ### How can it be implemented? I've been digging in the Tailscale client sourcecode, and I think this can be implemented by adding the domain to `DNSConfig.MatchDomains` instead of `DNSConfig.SearchDomains`, but I'm not really sure about this.
adam added the enhancement label 2025-12-29 02:22:43 +01:00
adam closed this issue 2025-12-29 02:22:44 +01:00
adam commented 2025-12-29 02:22:44 +01:00
Author
Owner
Copy Link

@Hypnotist1148 commented on GitHub (Jun 14, 2024):

I am facing the same issue, it's really frustrating especially because I get some dns resolution errors because of this.

@Hypnotist1148 commented on GitHub (Jun 14, 2024): I am facing the same issue, it's really frustrating especially because I get some dns resolution errors because of this.
adam commented 2025-12-29 02:22:44 +01:00
Author
Owner
Copy Link

@code-sigil commented on GitHub (Aug 4, 2024):

My current fix is a slight modification of the v0.22.3 code, where I remove line 448 from the file hscontrol/config.go . This keeps headscale from appending the restricted servers to the search domains.

@code-sigil commented on GitHub (Aug 4, 2024): My current fix is a slight modification of the v0.22.3 code, where I remove line 448 from the file hscontrol/config.go . This keeps headscale from appending the restricted servers to the search domains.
adam commented 2025-12-29 02:22:45 +01:00
Author
Owner
Copy Link

@SuperSandro2000 commented on GitHub (Aug 12, 2024):

I think DNSConfig.MatchDomains is filled via 218110963d/net/dns/manager.go (L292) and 7aec8d4e6b/net/dns/config.go (L146) which we don't set according to tailscaled -verbose 2.

Edit: I think my personal issue was caused by an /etc/hosts entry on the exit node I was using rather than this issue. Nevertheless I think I found an issue and raised #2057

@SuperSandro2000 commented on GitHub (Aug 12, 2024): I think DNSConfig.MatchDomains is filled via https://github.com/tailscale/tailscale/blob/218110963dbb12002529a4a91ffc149b70ac21ac/net/dns/manager.go#L292 and https://github.com/tailscale/tailscale/blob/7aec8d4e6b4e72d5053d9ff7d819c28f9e035c2c/net/dns/config.go#L146 which we don't set according to tailscaled -verbose 2. Edit: I think my personal issue was caused by an /etc/hosts entry on the exit node I was using rather than this issue. Nevertheless I think I found an issue and raised #2057
adam commented 2025-12-29 02:22:45 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Aug 16, 2024):

I think we have implemented this wrongly the whole time, looking into it now, it does not seem that tailscale saas, nor the client adds split dns to search domains, and I dont think there is a good reason to do it. I will address this as part of #2034.

@kradalby commented on GitHub (Aug 16, 2024): I think we have implemented this wrongly the whole time, looking into it now, it does not seem that tailscale saas, nor the client adds split dns to search domains, and I dont think there is a good reason to do it. I will address this as part of #2034.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#711
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?