tailscale / tailscale/tailscale

upgrade of tailscale to 1.74.0 on linux modifies iptables and disables icmp and ssh on local interface

Open
#13,532 7 comments 0 reactions 0 assignees View on GitHub
bug needs-triage OS-linux
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
2d 3h
Merged PRs (30d)
123

Description

### What is the issue?

upgraded to tailscale 1.74.0
sshd only accepts connection on tailscale IP

table ip filter {
chain INPUT {
type filter hook input priority filter; policy accept;
counter packets 1649 bytes 597470 jump ts-input
}

chain FORWARD {
type filter hook forward priority filter; policy accept;
counter packets 0 bytes 0 jump ts-forward
}

chain ts-input {
iifname "lo" ip saddr 100.91.59.28 counter packets 0 bytes 0 accept
iifname != "tailscale0" ip saddr 100.115.92.0/23 counter packets 0 bytes 0 return
iifname != "tailscale0" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop
iifname "tailscale0" counter packets 185 bytes 12318 accept
udp dport 41641 counter packets 696 bytes 85644 accept
}

chain ts-forward {
iifname "tailscale0" counter packets 0 bytes 0 meta mark set mark and 0xff00ffff xor 0x40000
meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 accept
oifname "tailscale0" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop
oifname "tailscale0" counter packets 0 bytes 0 accept

### Steps to reproduce

_No response_

### Are there any recent changes that introduced the issue?

upgraded to 1.74.0

### OS

Linux

### OS version

6.6.47-current-rockchip64 #1 SMP PREEMPT Mon Aug 19 04:04:32 UTC 2024 aarch64 GNU/Linux

### Tailscale version

_No response_

### Other software

_No response_

### Bug report

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.