starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Feature Request] Support for IP Sets and "Via" in Headscale ACL #939

New Issue
Open
opened 2025-12-29 02:26:27 +01:00 by adam · 6 comments
adam commented 2025-12-29 02:26:27 +01:00
Owner
Copy Link

Originally created by @aradng on GitHub (Feb 6, 2025).

Use case

Currently, I have implemented these features manually using complex ipset and iptables configurations on the client side. Native support for these in Headscale ACL would be highly beneficial, particularly for:

  • Restricting access to external services that allow only specific whitelisted IPs or regions/countries.
  • Enabling conditional routing in high-availability (HA) database and backend environments that are frequently migrating.
  • Optimizing client-side routing for improved network performance.

Description

Since Tailscale clients already support custom routing configurations, would it be possible to implement similar functionality within Headscale ACL? Specifically:

Both of these are already available in Tailscale’s control plane ACL grants. Adding them to Headscale ACL would greatly enhance flexibility and ease of use for users managing self-hosted deployments.

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

No response

Originally created by @aradng on GitHub (Feb 6, 2025). ### Use case Currently, I have implemented these features manually using complex `ipset` and `iptables` configurations on the client side. Native support for these in Headscale ACL would be highly beneficial, particularly for: - Restricting access to external services that allow only specific whitelisted IPs or regions/countries. - Enabling conditional routing in high-availability (HA) database and backend environments that are frequently migrating. - Optimizing client-side routing for improved network performance. ### Description Since Tailscale clients already support custom routing configurations, would it be possible to implement similar functionality within Headscale ACL? Specifically: - **IP Sets:** [[Tailscale Docs](https://tailscale.com/kb/1387/ipsets)](https://tailscale.com/kb/1387/ipsets) - **"Via" Routing:** [[Tailscale Docs](https://tailscale.com/kb/1378/via)](https://tailscale.com/kb/1378/via) Both of these are already available in Tailscale’s control plane ACL grants. Adding them to Headscale ACL would greatly enhance flexibility and ease of use for users managing self-hosted deployments. ### Contribution - [ ] I can write the design doc for this feature - [ ] I can contribute this feature ### How can it be implemented? _No response_
adam added the enhancementno-stale-botpolicy 📝 labels 2025-12-29 02:26:27 +01:00
adam commented 2025-12-29 02:26:28 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Feb 6, 2025):

I have added no stale to this so it sticks around.

I want to managed expectations by saying that currently our ACL implementation part of the policy is severely lacking, which I aim to work on. There are currently no plans in the future to work on implementing grants, that doesnt mean we will not add them, but that there are a lot of other things to work on first (fixing Tags comes to mind and reworking the very hard to maintain routing system, as well as our large backlog of bugs).

I think it would be years before we are able to have the right building blocks in place (working ACLs, then autogroups, fixing routes/exits, then grants) before we can even consider starting on some of this work.

But, we can remain optimistic, open source projects are for the long run.

@kradalby commented on GitHub (Feb 6, 2025): I have added no stale to this so it sticks around. I want to managed expectations by saying that currently our ACL implementation part of the policy is severely lacking, which I aim to work on. There are currently no plans in the future to work on implementing `grants`, that doesnt mean we will not add them, but that there are a lot of other things to work on first (fixing [Tags](https://github.com/juanfont/headscale/issues/1369) comes to mind and reworking the very hard to maintain routing system, as well as our large backlog of bugs). I think it would be years before we are able to have the right building blocks in place (working ACLs, then autogroups, fixing routes/exits, then grants) before we can even consider starting on some of this work. But, we can remain optimistic, open source projects are for the long run.
adam commented 2025-12-29 02:26:28 +01:00
Author
Owner
Copy Link

@anuragbhatia commented on GitHub (Mar 31, 2025):

+1 would be great to have this feature.

@anuragbhatia commented on GitHub (Mar 31, 2025): +1 would be great to have this feature.
adam commented 2025-12-29 02:26:28 +01:00
Author
Owner
Copy Link

@yumork commented on GitHub (May 30, 2025):

+1 Очень нужно ограничение прав на выход

@yumork commented on GitHub (May 30, 2025): +1 Очень нужно ограничение прав на выход
adam commented 2025-12-29 02:26:28 +01:00
Author
Owner
Copy Link

@dblanque commented on GitHub (Sep 16, 2025):

+1 would be a good feature addition!

@dblanque commented on GitHub (Sep 16, 2025): +1 would be a good feature addition!
adam commented 2025-12-29 02:26:28 +01:00
Author
Owner
Copy Link

@benidk commented on GitHub (Oct 23, 2025):

+1

@benidk commented on GitHub (Oct 23, 2025): +1
adam commented 2025-12-29 02:26:29 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Oct 23, 2025):

+1 are not helpful. It gives everyone who has subscribed to this issue a notification and it sends the wrong signal since it is not worked on.

@kradalby commented on GitHub (Oct 23, 2025): +1 are not helpful. It gives everyone who has subscribed to this issue a notification and it sends the wrong signal since it is not worked on.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement no-stale-bot policy 📝
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#939
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?