tailscale / tailscale/tailscale

No connectivity from docker container when tailscale exit-node is set

Open
#13,367 2 comments 2 reactions 0 assignees View on GitHub
bug connectivity containers needs-triage
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
2d 3h
Merged PRs (30d)
123

Description

### What is the issue?

When I set exit-node to forward outgoing traffic though exit node I can't access external hosts from docker containers.
tcpdump shows that request packets are successfully forwarded via tailscale to the remote host, response packets are received but a wrong network interfaces is chosen to forward responses at the end (tailscale0 instead of docker0):
(`172.117.0.2` is IP address of the docker container)

```
18:43:31.284266 vethdf34757 P IP 172.117.0.2 > 1.1.1.1: ICMP echo request, id 20, seq 1, length 64
18:43:31.284266 docker0 In IP 172.117.0.2 > 1.1.1.1: ICMP echo request, id 20, seq 1, length 64
18:43:31.284291 tailscale0 Out IP 100.64.0.1 > 1.1.1.1: ICMP echo request, id 20, seq 1, length 64
18:43:31.388878 tailscale0 In IP 1.1.1.1 > 100.64.0.1: ICMP echo reply, id 20, seq 1, length 64
18:43:31.388937 tailscale0 Out IP 1.1.1.1 > 172.117.0.2: ICMP echo reply, id 20, seq 1, length 64
```

`ip ro get 172.117.0.2` shows:

```
172.117.0.2 dev tailscale0 table 52 src 100.64.0.1 uid 1000
cache
```

### Steps to reproduce

1. Setup tailscale
2. Set exit node using `tailscale up --exit-node=xxxx`
3. Try to ping external host from docker container `docker run --rm -ti arunvelsriram/utils ping -c4 1.1.1.1`
4. Ping command in docker container fails

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

ArchLinux

### Tailscale version

1.72.1

### Other software

_No response_

### Bug report

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.