tailscale / tailscale/tailscale

FR: Please add ability to disable IPv6 for app connector subnet routes

Open
#18,282 1 comment 3 reactions 0 assignees View on GitHub
fr needs-triage
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
2d 3h
Merged PRs (30d)
123

Description

### What are you trying to do?

Hi there, searching around I found the referenced [comment](https://github.com/tailscale/tailscale/issues/13705#issuecomment-2397634228) that is somewhat related here, I'd like to ask that you all please consider adding a feature to disable IPv6 subnet routes, really it could be specifically to disable IPv6 app connector subnet routes, depending on what makes the most sense. This specifically is where I run into issues with this and a very large number of subnet routes due to using a broader range of domains in my app connector that auto-resolve to a large number of `/32` IPv4 CIDR blocks and `/128` IPv6 blocks, I will repeatedly run into an issue where there's "too many" subnet routes and I have to manually `--reset` the tailnet device that functions as the app connector/subnet router.

I don't use IPv6 in my tailnet overlay nor my underlay network and while I realize there's probably use cases where disabling IPv6 could be "dangerous" or problematic there's use cases where people don't use IPv6 or need IPv6 translated for subnet routes and it just creates an abundance of extra CIDR blocks in the list of approved subnet routes that are not needed and only serve to "max out" the number of subnet routes and serve no functional purpose that I'm currently aware of.

### How should we solve this?

Please strongly consider adding a feature/flag that allows disabling of IPv6 addresses which are translated for app connector domains. Or even consider adding the ability to disable IPv6 for the overlay network for more advanced users that understand the risk and don't have a use case for cross-tailnet situations etc.

What I'm not sure about...I do not know if this could create problems somehow if Tailscale internally relies on IPv6 in some unknown fashion to me for some important functions like MagicDNS? or proper route validation? I am not sure exactly how various internal functions like this operate off-hand so I could be missing something in this regard.

### What is the impact of not solving this?

Repeated annoyance and requiring frequent avoidable manual intervention with important use of the otherwise amazing app connector feature.

### Anything else?

You guys rock : )

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.