Tailscale: NAT (DNAT) conflicting subnets in advertise-routes

[apenwarr]

Some users report that they have the same subnet (say, 192.168.1.0/24) in multiple locations, containing different devices. If they advertise these unrelated subnets into the same tailscale network, there's no way to differentiate between them.

Obviously the "right" solution is to change those subnet numbers to all be non-overlapping, but that can be intrusive and hard to justify for legacy reasons.

As a workaround, we could have tailscale NAT the traffic to/from those subnets on the way through. The syntax could be something like: --advertise-routes=192.168.1.0/24=10.11.0.0/16,192.168.2.0/24=10.12.1.0/24 which means map the 192.168.1.0/24 addresses into the 10.11.0.0 subnet, and advertise that to peers as if it were 10.11.0.0/16 (and similar with the second subnet).

Front conversations

[CMor1184]

This is exactly the problem I currently have. I have several industrial machines with the same subnet in different locations and want to connect them with Tailscale. Unfortunately I have not been able to do this yet. Therefore I would like to vote very strongly for a solution!

[apenwarr]

Quick poll: would IPv6 subnets help any of the people in this thread? Maybe
give this comment a thumbs up/down for yes/no. Thanks!
ᐧ

On Tue, Oct 20, 2020 at 2:26 PM CMor1184 [e-mail] wrote:

This is exactly the problem I currently have. I have several industrial
machines with the same subnet in different locations and want to connect
them with Tailscale. Unfortunately I have not been able to do this yet.
Therefore I would like to vote very strongly for a solution!

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/tailscale/tailscale/issues/826#issuecomment-713051904,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAFA4DEFT2JDL4GBZ5JLRLSLXI4HANCNFSM4ST5EAIQ
.

--
Avery Pennarun // CEO @ Tailscale

[philm88]

Thought about running into this issue as I begin to field test Tailscale, I envision some way to select with exposed subnet route you want to access, and a way to make all exposed routes unable to speak to each other unless otherwise permitted.