tailscale / tailscale/tailscale

Tailsacle accepted subnet routes should not not have a higher priority than main table

Open
#6,231 22 comments 22 reactions 0 assignees View on GitHub
bug L1 Very few P2 Aggravating T3 Performance/Debugging
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
1d 23h
Merged PRs (30d)
132

Description

### What is the issue?

In a simple Tailscale setup, we have two nodes. The node 1 advertises some routes and the node 2 accepts them:

image

Tailscale accepts subnet routes from other nodes and adds them to the routing table. But Tailscale is not adding them to the main table, it's adding them to the table 52 and adding a rule to let the traffic lookup table 52 firstly and then the main table:

https://github.com/tailscale/tailscale/blob/74637f2c156a91d24d429f44dd0f0b888cd7a4f2/wgengine/router/router_linux.go#L1039-L1047

1. I think it's dangerous since it introduces the risk to lose remote access from local network (outgoing traffic even belonging to connection from local network is routed to Tailscale).2.
2. It breaks static routes -- e.g. static routes configured in network management tools (e.g. systemd-networkd) are added to main table with a customizable metric -- but I can't enforce which one has higher priority by setting the static routes' metric. The only way is adding `ip rule`s manully and adding static routes to another separated route table -- messing up the rules and routes.

In my opinion, as a **overlay network**, Tailscale should not trying to override the **physical network** and break current configuration on the installed router/host. It should use the general practice for solving routing conflict in network systems -- route metric, to give the control to the user, not forcing the priority by `ip rule`s.

### Steps to reproduce

_No response_

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

_No response_

### Tailscale version

1.32.2

### Bug report

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in wgengine/router/router_linux.go around lines 1039-1047 and inspect how accepted subnet routes and ip rules are installed. Reproduce the two-node setup with Linux routing tables and rules, then compare behavior with existing static routes. Done means accepted routes no longer forcibly outrank the main table or otherwise disrupt the host's configured routing.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.