Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make stateful filtering configurable #357

Merged
merged 2 commits into from
May 18, 2024
Merged

Make stateful filtering configurable #357

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e0c380d
stateful_filtering option
lmagyar May 16, 2024
e678e10
remove note and notice
lmagyar May 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 20 additions & 4 deletions tailscale/DOCS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ login_server: "https://controlplane.tailscale.com"
proxy: false
proxy_and_funnel_port: 443
snat_subnet_routes: true
stateful_filtering: true
tags:
- tag:example
- tag:homeassistant
Expand Down Expand Up @@ -262,8 +263,23 @@ router, and this simplifies routing configuration.
When not set, this option is enabled by default.

To support advanced [Site-to-site networking][tailscale_info_site_to_site] (eg.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct the abbreviation for consistency.

- to traverse multiple networks), you can disable this functionality, and execute steps 2 and 3 as described on [Site-to-site networking][tailscale_info_site_to_site] (eg. to traverse multiple networks), you can...
+ to traverse multiple networks), you can disable this functionality, and execute steps 2 and 3 as described on [Site-to-site networking][tailscale_info_site_to_site] (e.g., to traverse multiple networks), you can...
Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation.

Suggested change
To support advanced [Site-to-site networking][tailscale_info_site_to_site] (eg.
To support advanced [Site-to-site networking][tailscale_info_site_to_site] (e.g., to traverse multiple networks), you can disable this functionality, and execute steps 2 and 3 as described on [Site-to-site networking][tailscale_info_site_to_site] (e.g., to traverse multiple networks), you can...

to traverse multiple networks), you can disable this functionality. But do it
only when you really understand why you need this.
to traverse multiple networks), you can disable this functionality, and execute
steps 2 and 3 as described on [Site-to-site
networking][tailscale_info_site_to_site]. But do it only when you really
understand why you need this.

### Option: `stateful_filtering`

This option enables stateful packet filtering on packet-forwarding nodes (exit
nodes, subnet routers, and app connectors), to only allow return packets for
existing outbound connections. Inbound packets that don't belong to an existing
connection are dropped.

When not set, this option is enabled by default.

To support basic [Site-to-site networking][tailscale_info_site_to_site], you can
disable this functionality, and execute steps 2 and 3 as described on
[Site-to-site networking][tailscale_info_site_to_site].

### Option: `tags`

Expand Down Expand Up @@ -295,8 +311,8 @@ instance, disable userspace networking mode, which will create a `tailscale0`
network interface on your host.

If you want to access other clients on your tailnet even from your local subnet,
execute steps 2 and 3 as described on [Site-to-site
networking][tailscale_info_site_to_site].
disable `stateful_filtering` and execute steps 2 and 3 as described on
[Site-to-site networking][tailscale_info_site_to_site].

In case your local subnets collide with subnet routes within your tailnet, your
local network access has priority, and these addresses won't be routed toward
Expand Down
1 change: 1 addition & 0 deletions tailscale/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ schema:
proxy: bool?
proxy_and_funnel_port: match(^(443|8443|10000)$)?
snat_subnet_routes: bool?
stateful_filtering: bool?
tags:
- "match(^tag:[a-zA-Z][a-zA-Z0-9-]*$)?"
taildrop: bool?
Expand Down
9 changes: 9 additions & 0 deletions tailscale/rootfs/etc/s6-overlay/s6-rc.d/post-tailscaled/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,15 @@ then
options+=(--login-server="${login_server}")
fi

# Support basic site-to-site networking, disable stateful filtering
if ! bashio::config.has_value "stateful_filtering" || \
bashio::config.true "stateful_filtering";
then
options+=(--stateful-filtering)
else
options+=(--stateful-filtering=false)
fi

# Support advanced site-to-site networking, disable source addresses NAT
if ! bashio::config.has_value "snat_subnet_routes" || \
bashio::config.true "snat_subnet_routes";
Expand Down
8 changes: 8 additions & 0 deletions tailscale/translations/en.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,14 @@ configuration:
To support advanced Site-to-site networking (eg. to traverse multiple
networks), you can disable this functionality.
When not set, this option is enabled by default.
stateful_filtering:
name: Stateful packet filtering
description: >-
This option enables stateful packet filtering on packet-forwarding nodes (exit
nodes, subnet routers, and app connectors), to only allow return packets for
existing outbound connections.
To support basic Site-to-site networking, you can disable this functionality.
When not set, this option is enabled by default.
tags:
name: Tags
description: >-
Expand Down