starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] ACLs although going one way, are discoverable by the "dst". #717

New Issue
Closed
opened 2025-12-29 02:22:47 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:22:47 +01:00
Owner
Copy Link

Originally created by @mifraburneo on GitHub (May 28, 2024).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

I have this users as an example:
image

As well as this ACL:
image

So now currently:
Mifra's (admin's) machines are able to see all the network's machines.
BUT
Any user's machines are able to see Mifra's machines as well (aka discover via UI or tailscale status, providing information like IP and if they're up or not) although it seems that they're not able to ping nor ssh, etc.

Expected Behavior

I expect that the only rule in the ACL is considered.
That is, only the admin group members can see and access other machines and not viceversa.

Steps To Reproduce

Create 3 users at least and assign an ACL in the same matter as shown above.

Environment

- OS: Ubuntu 24.4
- Headscale version: 0.22.3
- Tailscale version: indifferent, but 1.64 for example

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

No response

Originally created by @mifraburneo on GitHub (May 28, 2024). ### Is this a support request? - [X] This is not a support request ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current Behavior I have this users as an example: <img width="283" alt="image" src="https://github.com/juanfont/headscale/assets/31111883/06f1e8a9-8b14-41fa-aec3-c9a19f49b667"> As well as this ACL: <img width="580" alt="image" src="https://github.com/juanfont/headscale/assets/31111883/1bc528cf-dd7f-4710-8118-d291d88cfd58"> So now currently: Mifra's (admin's) machines are able to see all the network's machines. BUT Any user's machines are able to see Mifra's machines as well (aka discover via UI or tailscale status, providing information like IP and if they're up or not) although it seems that they're not able to ping nor ssh, etc. ### Expected Behavior I expect that the only rule in the ACL is considered. That is, **only the admin group members can _see and access_ other machines and not viceversa**. ### Steps To Reproduce Create 3 users at least and assign an ACL in the same matter as shown above. ### Environment ```markdown - OS: Ubuntu 24.4 - Headscale version: 0.22.3 - Tailscale version: indifferent, but 1.64 for example ``` ### Runtime environment - [ ] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Anything else? _No response_
adam added the bug label 2025-12-29 02:22:47 +01:00
adam closed this issue 2025-12-29 02:22:47 +01:00
adam commented 2025-12-29 02:22:48 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (May 30, 2024):

Hi, this is intended behaviour, if one of two machines can reach each other, they will be visible in each others map (and therefore UI/status). Only nodes that cannot connect to each other at all will be fully removed from the list.

Access should be correctly limited, but they wont be removed from the list, from what I understand, they can see, but not access.

@kradalby commented on GitHub (May 30, 2024): Hi, this is intended behaviour, if one of two machines can reach each other, they will be visible in each others map (and therefore UI/status). Only nodes that cannot connect to each other at all will be fully removed from the list. Access should be correctly limited, but they wont be removed from the list, from what I understand, they can see, but not access.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#717
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?