mirror of
https://github.com/juanfont/headscale.git
synced 2026-01-13 20:53:29 +01:00
[Bug] DNS not working when using exit nodes #851
Open
opened 2025-12-29 02:24:49 +01:00 by adam
·
15 comments
No Branch/Tag Specified
main
update_flake_lock_action
gh-pages
kradalby/release-v0.27.2
dependabot/go_modules/golang.org/x/crypto-0.45.0
dependabot/go_modules/github.com/opencontainers/runc-1.3.3
copilot/investigate-headscale-issue-2788
copilot/investigate-visibility-issue-2788
copilot/investigate-issue-2833
copilot/debug-issue-2846
copilot/fix-issue-2847
dependabot/go_modules/github.com/go-viper/mapstructure/v2-2.4.0
dependabot/go_modules/github.com/docker/docker-28.3.3incompatible
kradalby/cli-experiement3
doc/0.26.1
doc/0.25.1
doc/0.25.0
doc/0.24.3
doc/0.24.2
doc/0.24.1
doc/0.24.0
kradalby/build-docker-on-pr
topic/docu-versioning
topic/docker-kos
juanfont/fix-crash-node-id
juanfont/better-disclaimer
update-contributors
topic/prettier
revert-1893-add-test-stage-to-docs
add-test-stage-to-docs
remove-node-check-interval
fix-empty-prefix
fix-ephemeral-reusable
bug_report-debuginfo
autogroups
logs-to-stderr
revert-1414-topic/fix_unix_socket
rename-machine-node
port-embedded-derp-tests-v2
port-derp-tests
duplicate-word-linter
update-tailscale-1.36
warn-against-apache
ko-fi-link
more-acl-tests
fix-typo-standalone
parallel-nolint
tparallel-fix
rerouting
ssh-changelog-docs
oidc-cleanup
web-auth-flow-tests
kradalby-gh-runner
fix-proto-lint
remove-funding-links
go-1.19
enable-1.30-in-tests
0.16.x
cosmetic-changes-integration
tmp-fix-integration-docker
fix-integration-docker
configurable-update-interval
show-nodes-online
hs2021
acl-syntax-fixes
ts2021-implementation
fix-spurious-updates
unstable-integration-tests
mandatory-stun
embedded-derp
prtemplate-fix
v0.28.0-beta.1
v0.27.2-rc.1
v0.27.1
v0.27.0
v0.27.0-beta.2
v0.27.0-beta.1
v0.26.1
v0.26.0
v0.26.0-beta.2
v0.26.0-beta.1
v0.25.1
v0.25.0
v0.25.0-beta.2
v0.24.3
v0.25.0-beta.1
v0.24.2
v0.24.1
v0.24.0
v0.24.0-beta.2
v0.24.0-beta.1
v0.23.0
v0.23.0-rc.1
v0.23.0-beta.5
v0.23.0-beta.4
v0.23.0-beta3
v0.23.0-beta2
v0.23.0-beta1
v0.23.0-alpha12
v0.23.0-alpha11
v0.23.0-alpha10
v0.23.0-alpha9
v0.23.0-alpha8
v0.23.0-alpha7
v0.23.0-alpha6
v0.23.0-alpha5
v0.23.0-alpha4
v0.23.0-alpha4-docker-ko-test9
v0.23.0-alpha4-docker-ko-test8
v0.23.0-alpha4-docker-ko-test7
v0.23.0-alpha4-docker-ko-test6
v0.23.0-alpha4-docker-ko-test5
v0.23.0-alpha-docker-release-test-debug2
v0.23.0-alpha-docker-release-test-debug
v0.23.0-alpha4-docker-ko-test4
v0.23.0-alpha4-docker-ko-test3
v0.23.0-alpha4-docker-ko-test2
v0.23.0-alpha4-docker-ko-test
v0.23.0-alpha3
v0.23.0-alpha2
v0.23.0-alpha1
v0.22.3
v0.22.2
v0.23.0-alpha-docker-release-test
v0.22.1
v0.22.0
v0.22.0-alpha3
v0.22.0-alpha2
v0.22.0-alpha1
v0.22.0-nfpmtest
v0.21.0
v0.20.0
v0.19.0
v0.19.0-beta2
v0.19.0-beta1
v0.18.0
v0.18.0-beta4
v0.18.0-beta3
v0.18.0-beta2
v0.18.0-beta1
v0.17.1
v0.17.0
v0.17.0-beta5
v0.17.0-beta4
v0.17.0-beta3
v0.17.0-beta2
v0.17.0-beta1
v0.17.0-alpha4
v0.17.0-alpha3
v0.17.0-alpha2
v0.17.0-alpha1
v0.16.4
v0.16.3
v0.16.2
v0.16.1
v0.16.0
v0.16.0-beta7
v0.16.0-beta6
v0.16.0-beta5
v0.16.0-beta4
v0.16.0-beta3
v0.16.0-beta2
v0.16.0-beta1
v0.15.0
v0.15.0-beta6
v0.15.0-beta5
v0.15.0-beta4
v0.15.0-beta3
v0.15.0-beta2
v0.15.0-beta1
v0.14.0
v0.14.0-beta2
v0.14.0-beta1
v0.13.0
v0.13.0-beta3
v0.13.0-beta2
v0.13.0-beta1
upstream/v0.12.4
v0.12.4
v0.12.3
v0.12.2
v0.12.2-beta1
v0.12.1
v0.12.0-beta2
v0.12.0-beta1
v0.11.0
v0.10.8
v0.10.7
v0.10.6
v0.10.5
v0.10.4
v0.10.3
v0.10.2
v0.10.1
v0.10.0
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.1
v0.8.0
v0.7.1
v0.7.0
v0.6.1
v0.6.0
v0.5.2
v0.5.1
v0.5.0
v0.4.0
v0.3.6
v0.3.5
v0.3.4
v0.3.3
v0.3.2
v0.3.1
v0.3.0
v0.2.2
v0.2.1
v0.2.0
v0.1.1
v0.1.0
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
Mirrored from GitHub Pull Request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/headscale#851
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @myOmikron on GitHub (Nov 12, 2024).
Is this a support request?
Is there an existing issue for this?
Current Behavior
When setting an exit-node on any client, DNS to external addresses isn't working anymore.
Steps tried:
When using public DNS, using tools like https://whatismyipaddress.com/, I can verify that I'm using the exit node as intended. I guess this is also the case when using MagicDNS, but as no public address is resolved, I can't check this right now.
Expected Behavior
DNS working regardless of usage of a exit-node
Steps To Reproduce
tailscale set --exit-node <exit-node>Environment
Runtime environment
Anything else?
No response
@myOmikron commented on GitHub (Nov 16, 2024):
Additional information:
Got it to working after installing
systemd-resolvedand linking itsstub-resolveto/etc/resolve.conflike proposed in tailwinds article about Linux DNS systems on the exit-node.@nblock commented on GitHub (Nov 16, 2024):
Thanks for the update, is your issue now fully resolved?
For others with DNS related issues: recent tailscale versions have a command to print the DNS status which might be helpful for debugging:
tailscale dns status@myOmikron commented on GitHub (Nov 18, 2024):
I don't think so.
The behavior I described was broken with a
resolv.confgenerated by tailscale, which pointed DNS to100.100.100.100. As DNS should happen on my client machine asking100.100.100.100directly, I think the exit-node shouldn't have anything to do with resolving.@nblock commented on GitHub (Nov 22, 2024):
I assume that
/etc/resolv.confwas statically configured and tailscale overwrites the file on startup. Can you provide some logs during startup and then when you enable/disable the exit node? Given that you want to go back fromsystemd-resolvedto a statically managed/etc/resolv.conf. DNS related configuration of your headscale might also be interesting.@tho22 commented on GitHub (Nov 22, 2024):
Same problem here when --accept-dns=true
internal names are resolved. external ones are not :
config.yaml snippet:
status on the client:
Server run on docker headscale/headscale:0.23.0
any ideas?
@nblock commented on GitHub (Nov 22, 2024):
Do you use an exit node?
@tho22 commented on GitHub (Nov 22, 2024):
Yes, this problem only exists with exit node constellations.
For me, I have a workaround.
Instead of using "--advertise-exit-node", I use the routing for all "--advertise-routes=0.0.0.0/1,128.0.0.0/1,::/1,8000::/1".
@baiyz0825 commented on GitHub (Dec 7, 2024):
i have the same problem , i check the tailscale outpot ,in my client use exit node A ,controler config the router
tailscale dns status outpput below:
@bentemple commented on GitHub (Feb 13, 2025):
Having this same problem as well. Was trying to setup an exit-node using a tailscale docker client, but DNS resolving is broken when trying to use the exit-node.
I think I got it working, I had to add the following to my exit node:
if hosting the tailscale exit node on the host you can also add these directly to sysctls.conf
They mention this network configuration here: https://tailscale.com/kb/1408/quick-guide-exit-nodes
@kiawizard commented on GitHub (Feb 26, 2025):
I confirm this issue exists, Windows Exit Nodes used by Windows or Android clients do not answer to DNS queries to 100.100.100.100 for external domains while exit node is used
@clr1107 commented on GitHub (May 11, 2025):
Same issue here. I am not using magic dns, but have two dns resolvers set. I am using the mac tailscale client, and I am running my own dnsmasq instances to handle dns. It would be good to get this working, as I currently have to stop using an exit node to access internal resources (as they resolve via internal dns servers) and then turn it back on.
If I use
digit flags this warning about recursion, if that helps:If I am not using an exit node:
@kiawizard commented on GitHub (Jul 20, 2025):
Please consider raising the priority of this bug, this is critical, MagicDNS (which is on by default) does not work together with Exit Node
@djeclemen commented on GitHub (Oct 8, 2025):
Any update?
@nblock commented on GitHub (Oct 13, 2025):
As stated in this comment about DNS and exit nodes DNS queries are sent to the exit node and resolved on the exit node using its local DNS configuration.
FWIW, here's the gist of my working exit node setup:
dns.override_local_dns: falsedns.split: .... This might be confusing, see https://github.com/tailscale/tailscale/issues/17401autogroup:internet:*to allow some clients to use said exit node@vborioni-onit commented on GitHub (Dec 21, 2025):
Ouch, just found the issue, lost two days on this one :(
I may add that this is the error i get with tailscail dns query, 100.64.0.1 is the ip of the exit node :
And here is the output of tailscale dns status :