Allow tailnet members to route to internet via exit nodes - #10
Merged
Conversation
Adds an ACL rule permitting `autogroup:member → autogroup:internet:*`. Without it, Tailscale's control plane strips `Hostinfo.RoutableIPs` from peer netmaps (i.e., hides the exit-node advertisement) as a "this peer can't actually use these routes anyway per ACL" optimization — even when: - the device advertises with `--advertise-exit-node`, - autoApprovers in this policy auto-approves the routes, - per-machine `enabledRoutes` confirms the routes are approved. Diagnosed today: pi-zero-exit's exit-node advertisement was correctly landing in the control plane (verified via the Tailscale API: `enabledRoutes` showed both 0.0.0.0/0 and ::/0) but `tailscale exit-node list` from gandalf/iPhone/MacBook reported "no exit nodes found." Tracing the netmap difference between pi-zero-exit's SelfNode (routes present) and gandalf's view of pi-zero-exit as a peer (Hostinfo sans RoutableIPs) pointed at this ACL filter behavior. Scoped tightly: only `autogroup:member` gets the internet egress permission — homelab-tagged servers can still only reach other homelab-tagged servers. Members are personal devices the operator controls (per the existing tagOwners model).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an ACL rule permitting
autogroup:member → autogroup:internet:*. Without it, Tailscale's control plane stripsHostinfo.RoutableIPsfrom peer netmaps (i.e., hides exit-node advertisements) as a "this peer can't use these routes anyway per ACL" optimization — even when the device is correctly advertising and routes are approved.Diagnosis chain (why this matters)
pi-zero-exitre-advertised with--advertise-exit-node.tailscale exit-node listfrom gandalf / iPhone / MacBook → "no exit nodes found."GET /api/v2/device/{id}/routesconfirmedenabledRoutes: ["0.0.0.0/0", "::/0"]. Approval is in.RoutableIPsfield at all.RoutableIPs: ["0.0.0.0/0","::/0"]present, prefs / kernel forwarding / etc all clean.Validation
The rule was first added via the Tailscale admin UI during diagnosis; this PR codifies that change in HCL so IaC is source-of-truth-consistent.
tofu applyfrom this branch is a no-op.tofu validategreen.tofu planshows zero changes (state already matches after manual UI edit).tofu applyclean: 0 added, 0 changed, 0 destroyed.tag:homelab → tag:homelab:*traffic still works (k3s cluster reachable; 3 nodes Ready).Security note
Scoped to
autogroup:member(operator's personal devices). Homelab-tagged servers can still only reach other homelab-tagged servers — they don't get internet egress through other tailnet exit nodes.