starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] ACL can't work with netmask smaller than /24 #715

New Issue
Closed
opened 2025-12-29 02:22:47 +01:00 by adam · 7 comments
adam commented 2025-12-29 02:22:47 +01:00
Owner
Copy Link

Originally created by @duongmn89 on GitHub (May 20, 2024).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

I've been working with headscale ACL for taiscale clients.
My current ACL file

{
  "groups": {
    "group:sre": ["sre1", "sre2"],
    "group:dev": ["dev1", "dev2"]
  },
  "tagOwners": {
    "tag:exitnode": ["group:sre"],
  },
  "acls": [
    { "action": "accept", "src": ["autogroup:members"], "dst": ["autogroup:self:*"] },
    { "action": "accept", "src": ["*"], "dst": ["tag:exitnode:*"] },
    { "action": "accept", "src": ["group:sre"], "dst": ["*:*"] },
    { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.0/25:8006"] },
    { "action": "accept", "src": ["group:dev"], "dst": ["10.21.1.0/24:80,443"] }
  ]
}

With this configuration, from 1 of my dev nodes, I test connection through an exit node :

  • I can connect to 10.21.1.33 tcp/80 (match with 5th rule)
  • but I can't connect to 10.20.1.113 tcp/8006 (match with 4th rule)
    In the log of tailscale on dev nodes:
open-conn-track: flow TCP 100.64.0.5:43166 > 10.20.1.113:8006 rejected due to acl

If I change 4th rule to 10.20.1.0/24:8006 or 10.20.0.0/16:8006 instead of 10.20.1.0/25:8006, then the connection can be opened.
I tested with /32, /30 also didn't work, but /24, /16 are work
I also tried to replace 10.20.1.0/25 with host definition, but also didn't work

Expected Behavior

I can connect 10.20.1.113:8006 with one of these acl:

    { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.113/32:8006"] },
or 
    { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.0/25:8006"] },
or 
    { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.0/24:8006"] },

Steps To Reproduce

Create ACL at headscale and test at tailscale

Environment

- OS: ubuntu 22.04
- Headscale version: v0.23.0-alpha9
- Tailscale version: 1.66.1

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

No response

Originally created by @duongmn89 on GitHub (May 20, 2024). ### Is this a support request? - [X] This is not a support request ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current Behavior I've been working with headscale ACL for taiscale clients. My current ACL file ``` { "groups": { "group:sre": ["sre1", "sre2"], "group:dev": ["dev1", "dev2"] }, "tagOwners": { "tag:exitnode": ["group:sre"], }, "acls": [ { "action": "accept", "src": ["autogroup:members"], "dst": ["autogroup:self:*"] }, { "action": "accept", "src": ["*"], "dst": ["tag:exitnode:*"] }, { "action": "accept", "src": ["group:sre"], "dst": ["*:*"] }, { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.0/25:8006"] }, { "action": "accept", "src": ["group:dev"], "dst": ["10.21.1.0/24:80,443"] } ] } ``` With this configuration, from 1 of my dev nodes, I test connection through an exit node : - I can connect to 10.21.1.33 tcp/80 (match with 5th rule) - but I can't connect to 10.20.1.113 tcp/8006 (match with 4th rule) In the log of tailscale on dev nodes: ``` open-conn-track: flow TCP 100.64.0.5:43166 > 10.20.1.113:8006 rejected due to acl ``` If I change 4th rule to 10.20.1.0/**24**:8006 or 10.20.0.0/**16**:8006 instead of 10.20.1.0/25:8006, then the connection can be opened. I tested with /32, /30 also didn't work, but /24, /16 are work I also tried to replace 10.20.1.0/25 with host definition, but also didn't work ### Expected Behavior I can connect 10.20.1.113:8006 with one of these acl: ``` { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.113/32:8006"] }, or { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.0/25:8006"] }, or { "action": "accept", "src": ["group:dev"], "dst": ["10.20.1.0/24:8006"] }, ``` ### Steps To Reproduce Create ACL at headscale and test at tailscale ### Environment ```markdown - OS: ubuntu 22.04 - Headscale version: v0.23.0-alpha9 - Tailscale version: 1.66.1 ``` ### Runtime environment - [X] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Anything else? _No response_
adam added the bugpolicy 📝 labels 2025-12-29 02:22:47 +01:00
adam closed this issue 2025-12-29 02:22:47 +01:00
adam commented 2025-12-29 02:22:47 +01:00
Author
Owner
Copy Link

@duongmn89 commented on GitHub (May 20, 2024):

I want to dump current acl at tailscale client but I can't find any solutions to do that.

@duongmn89 commented on GitHub (May 20, 2024): I want to dump current acl at tailscale client but I can't find any solutions to do that.
adam commented 2025-12-29 02:22:48 +01:00
Author
Owner
Copy Link

@duongmn89 commented on GitHub (May 20, 2024):

I tested with headscale version v0.22.3 and didn't see this problem, ACL can work as expected with /32 or /25 or /24
So I guess this is the new bug of v0.23.0-alpha9

@duongmn89 commented on GitHub (May 20, 2024): I tested with headscale version v0.22.3 and didn't see this problem, ACL can work as expected with /32 or /25 or /24 So I guess this is the new bug of v0.23.0-alpha9
adam commented 2025-12-29 02:22:48 +01:00
Author
Owner
Copy Link

@winterheart commented on GitHub (May 21, 2024):

This should be fixed in alpha10, see #1817.

@winterheart commented on GitHub (May 21, 2024): This should be fixed in alpha10, see #1817.
adam commented 2025-12-29 02:22:48 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (May 21, 2024):

@duongmn89 can you test if it is fixed as mentioned?

@kradalby commented on GitHub (May 21, 2024): @duongmn89 can you test if it is fixed as mentioned?
adam commented 2025-12-29 02:22:48 +01:00
Author
Owner
Copy Link

@duongmn89 commented on GitHub (May 23, 2024):

Thanks, I will test alpha10 today

@duongmn89 commented on GitHub (May 23, 2024): Thanks, I will test alpha10 today
adam commented 2025-12-29 02:22:48 +01:00
Author
Owner
Copy Link

@duongmn89 commented on GitHub (May 23, 2024):

@kradalby @winterheart this problem does not exist in alpha10, thanks

@duongmn89 commented on GitHub (May 23, 2024): @kradalby @winterheart this problem does not exist in alpha10, thanks
adam commented 2025-12-29 02:22:48 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (May 23, 2024):

Great!

@kradalby commented on GitHub (May 23, 2024): Great!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug policy 📝
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#715
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?