tailscale / tailscale/tailscale
No connectivity from docker container when tailscale exit-node is set
- Dominant language
- Go
- Stars
- 36.5k
- Forks
- 3.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 123
Description
### What is the issue?
When I set exit-node to forward outgoing traffic though exit node I can't access external hosts from docker containers.
tcpdump shows that request packets are successfully forwarded via tailscale to the remote host, response packets are received but a wrong network interfaces is chosen to forward responses at the end (tailscale0 instead of docker0):
(`172.117.0.2` is IP address of the docker container)
```
18:43:31.284266 vethdf34757 P IP 172.117.0.2 > 1.1.1.1: ICMP echo request, id 20, seq 1, length 64
18:43:31.284266 docker0 In IP 172.117.0.2 > 1.1.1.1: ICMP echo request, id 20, seq 1, length 64
18:43:31.284291 tailscale0 Out IP 100.64.0.1 > 1.1.1.1: ICMP echo request, id 20, seq 1, length 64
18:43:31.388878 tailscale0 In IP 1.1.1.1 > 100.64.0.1: ICMP echo reply, id 20, seq 1, length 64
18:43:31.388937 tailscale0 Out IP 1.1.1.1 > 172.117.0.2: ICMP echo reply, id 20, seq 1, length 64
```
`ip ro get 172.117.0.2` shows:
```
172.117.0.2 dev tailscale0 table 52 src 100.64.0.1 uid 1000
cache
```
### Steps to reproduce
1. Setup tailscale
2. Set exit node using `tailscale up --exit-node=xxxx`
3. Try to ping external host from docker container `docker run --rm -ti arunvelsriram/utils ping -c4 1.1.1.1`
4. Ping command in docker container fails
### Are there any recent changes that introduced the issue?
_No response_
### OS
Linux
### OS version
ArchLinux
### Tailscale version
1.72.1
### Other software
_No response_
### Bug report
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.