starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] test #852

New Issue
Closed
opened 2025-12-29 02:24:49 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:24:49 +01:00
Owner
Copy Link

Originally created by @maxpain on GitHub (Nov 8, 2024).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

I have deployed Tailscale as a subnet router (--advertise-routes=10.99.0.0/16) in my Kubernetes cluster to give access to my developers to postgres server 10.99.0.2.

Our developers can't access 10.99.0.2 when using 10.99.0.2/32:* rule.

The developer machine:
ts-netmap-exact-address.json

tailscale status
100.64.0.1      maxpain-macbook      m.csgo.com   macOS   -

The subnet router on the Kubernetes side:

tailscale status
100.64.0.3      subnet-router        admin        linux   -

But 10.99.0.0/16:* works.

The developer machine:
ts-netmap-slash-16-subnet.json

tailscale status
100.64.0.1      maxpain-macbook      m.csgo.com   macOS   -
100.64.0.3      subnet-router        admin        linux   active; direct

The subnet router on the Kubernetes side:

tailscale status
100.64.0.3      subnet-router        admin        linux   -
100.64.0.1      maxpain-macbook      m.csgo.com   macOS   active; direct

ACL configuration:

{
	"groups": {
		"group:admin": [],
		"group:test-project": ["m.csgo.com"]
	},
	"tagOwners": {
		"tag:test-project": ["group:admin"]
	},
	"acls": [{
		"action": "accept",
		"src": ["group:test-project"],
		"dst": [
			// "10.99.0.0/16:*" // Works
			"10.99.0.2/32:*" // Doesn't work
		]
	}]
}

Expected Behavior

10.99.0.2/32:* acl rule should work.

Steps To Reproduce

  1. Run tailscale subnet router:
tailscale up --login-server=https://headscale.example.com --advertise-routes=10.99.0.0/16 --auth-key=REDACTED --hostname=subnet-router
  1. Run tailscale on client machine

Environment

- OS: Ubuntu 24.04
- Headscale version: 0.23.0
- Tailscale version: 1.76.6

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

No response

Originally created by @maxpain on GitHub (Nov 8, 2024). ### Is this a support request? - [X] This is not a support request ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current Behavior I have deployed Tailscale as a subnet router (`--advertise-routes=10.99.0.0/16`) in my Kubernetes cluster to give access to my developers to postgres server `10.99.0.2`. **Our developers can't access `10.99.0.2` when using `10.99.0.2/32:*` rule.** The developer machine: [ts-netmap-exact-address.json](https://github.com/user-attachments/files/17683795/ts-netmap-exact-address.json) ``` tailscale status 100.64.0.1 maxpain-macbook m.csgo.com macOS - ``` The subnet router on the Kubernetes side: ``` tailscale status 100.64.0.3 subnet-router admin linux - ``` **But `10.99.0.0/16:*` works.** The developer machine: [ts-netmap-slash-16-subnet.json](https://github.com/user-attachments/files/17683791/ts-netmap-slash-16-subnet.json) ``` tailscale status 100.64.0.1 maxpain-macbook m.csgo.com macOS - 100.64.0.3 subnet-router admin linux active; direct ``` The subnet router on the Kubernetes side: ``` tailscale status 100.64.0.3 subnet-router admin linux - 100.64.0.1 maxpain-macbook m.csgo.com macOS active; direct ``` **ACL configuration:** ```json { "groups": { "group:admin": [], "group:test-project": ["m.csgo.com"] }, "tagOwners": { "tag:test-project": ["group:admin"] }, "acls": [{ "action": "accept", "src": ["group:test-project"], "dst": [ // "10.99.0.0/16:*" // Works "10.99.0.2/32:*" // Doesn't work ] }] } ``` ### Expected Behavior `10.99.0.2/32:*` acl rule should work. ### Steps To Reproduce 1. Run tailscale subnet router: ```bash tailscale up --login-server=https://headscale.example.com --advertise-routes=10.99.0.0/16 --auth-key=REDACTED --hostname=subnet-router ``` 2. Run tailscale on client machine ### Environment ```markdown - OS: Ubuntu 24.04 - Headscale version: 0.23.0 - Tailscale version: 1.76.6 ``` ### Runtime environment - [ ] Headscale is behind a (reverse) proxy - [X] Headscale runs in a container ### Anything else? _No response_
adam added the bug label 2025-12-29 02:24:49 +01:00
adam closed this issue 2025-12-29 02:24:49 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#852
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?