Tailscale: Control of advertised routes to nodes.

[JayDoubleu]

Is your feature request related to a problem? Please describe.

To my understanding (I might be proved wrong) when I "Enable subnet routes" it will advertise routes to all of the nodes and then only control i have is the ACL.

Describe the solution you'd like

I would like to filter/whitelist/blacklist where my routes are advertised.

Describe alternatives you've considered
I believe -accept-routes allows me to toggle routes on/off on the clients however I would like to see the functionality to either accept specific routes or allow to centrally manage it via ACL like JSON schema.

Also would be nice to add -accept-routes to windows client GUI.

Additional context

PS. might need updating, step 5.2 "Authorize subnet routes on the machine, so that Tailscale distributes the subnet routes to the rest of the nodes on your Tailscale network." It's not exactly clear that you have to click "Enable Subnet Routes". Docs on github would be nice.

┆Issue is synchronized with this Asana task by Unito

[apenwarr]

Under which conditions would you only want to accept some of the subnet routes on some of the machines? That seems like an odd setup. Do you have overlapping routes in different locations, or something?

[shrkmz]

Overlapping routes in different locations is the problem in my case. Working with customers/vendors and giving them access to internal resources without disrupting their access to their own network resources becomes challenging:

1. Have multiple address ranges in a cloud environment for various data segregation e.g. 192.168.1.x/24, 192.168.50.x/24, 192.168.100.x/24 and so on
2. Internal machines need to get those ranges so we spin up a tailscale relay and advertise those routes (either by 192.168.0.0/16 or by individual networks)
3. Customer/vendor is working on a network with 192.168.100.x/24 IPs
4. We get them on our TS network to give them access to 192.168.50.x/24

Unfortunate result: Now they can't access their internal resources because all their traffic for 192.168.100.x/24 is being routed to us.

[JayDoubleu]

@apenwarr well described by shrkmz.

Overlapping CIDR/s is going to be a very common issue. If bunch of routes can be advertised from single point without the ability to control it on client side, IMHO it creates large concern about the stability of clients. Single accidental route advertisement has the potential to create a lot of chaos.

[ShantanuNair]

Are there any proposed solutions or workarounds for overlapping CIDRs? I'm having a similar issue where a client cannot access a device on the network which is advertised by a relay, but has an overlapping CIDR with their network. They cannot access devices advertised via my Tailscale relay node.

[apenwarr]

Shantanu, what platform are you seeing that problem on? It's a bit of a
separate issue from this one.
ᐧ

On Mon, Oct 12, 2020 at 7:14 AM Shantanu Nair [e-mail]
wrote:

Are there any proposed solutions or workarounds for overlapping CIDRs? I'm
having a similar issue where a client cannot access a device on the network
which is advertised by a relay, but has an overlapping CIDR with their
network. They cannot access devices advertised via my Tailscale relay node.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/tailscale/tailscale/issues/286#issuecomment-707055600,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAFA4HDGSRPPVN4WQJ7DYLSKLQHZANCNFSM4MFZFZZA
.

--
Avery Pennarun // CEO @ Tailscale

[ShantanuNair]

Shantanu, what platform are you seeing that problem on? It's a bit of a separate issue from this one. ᐧ
…
On Mon, Oct 12, 2020 at 7:14 AM Shantanu Nair @.*> wrote: Are there any proposed solutions or workarounds for overlapping CIDRs? I'm having a similar issue where a client cannot access a device on the network which is advertised by a relay, but has an overlapping CIDR with their network. They cannot access devices advertised via my Tailscale relay node. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#286 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAFA4HDGSRPPVN4WQJ7DYLSKLQHZANCNFSM4MFZFZZA .
-- Avery Pennarun // CEO @ Tailscale

Client is running the macOS client. The relay advertising the routes is running on a raspberry pi running debian.