How to deny subnet to subnet routing using acls with TailScale? - Stack Overflow

admin管理员组

文章数量:1180552

I have a tailscale network configured where I have a central admin computer and several remote LANs. Each LAn has a subnet router.

There is also another LAN with a common NAS unit.

I can allow the office to talk to all sites, and I can allow the office and all sites to talk to the NAS. Where I am having difficulty is blocking one site subnet to another site subnet.

I tagged each subnet router and allowed traffic that should be allowed, and removed the allow all acl. By my understanding, if there is no explicit allow rule, in this configuration, the remote LANs should not be allowed to talk with each other, but they can.

How can I explicitly deny traffic from one subnet to another?

Below is a copy of my ACL.

    // Declare static groups of users. Use autogroups for all users or users with a specific role.
    "groups": {
        "group:admin": ["[email protected]"],
    },

    // Define the tags which can be applied to devices and by which users.
    "tagOwners": {
        "tag:main-office":         ["autogroup:admin"],
        "tag:cloud-lan":           ["autogroup:admin"],
        "tag:customer-l":       ["autogroup:admin"],
        "tag:remote-l":         ["autogroup:admin"],
        "tag:customer-k":     ["autogroup:admin"],
        "tag:customer-s": ["autogroup:admin"],
        "tag:customer-m":      ["autogroup:admin"],
        "tag:customer-pi":       ["autogroup:admin"],
    },

    // Define access control lists for users, groups, autogroups, tags,
    // Tailscale IP addresses, and subnet ranges.
    "acls": [
        // Allow the main office to access all sites
        {
            "action": "accept",
            "src":    ["tag:main-office"],
            "dst":    ["*:*"],
        },
        // Allow the cloud site to access the office site
        {
            "action": "accept",
            "src":    ["tag:cloud-lan"],
            "dst":    ["tag:main-office:*"],
        },
        // Allow remote lago office to access Lago LAN
        {
            "action": "accept",
            "src":    ["tag:remote-l"],
            "dst":    ["tag:customer-l:*"],
        },
        // Allow access to the cloud NAS
        {
            "action": "accept",
            "src": [
                "tag:customer-l",
                "tag:customer-k",
                "tag:customer-s",
                "tag:customer-m",
            ],
            "dst": ["192.168.39.11:*"],
        },
        // Allow Raspberry Pi systems to access a single IP in the main office
        {
            "action": "accept",
            "src":    ["tag:customer-pi"],
            "dst":    ["192.168.100.40:*"],
        },
    ],

    // Define users and devices that can use Tailscale SSH.
    "ssh": [
        // Allow all users to SSH into their own devices in check mode.
        // Comment this section out if you want to define specific restrictions.
        {
            "action": "check",
            "src":    ["autogroup:member"],
            "dst":    ["autogroup:self"],
            "users":  ["autogroup:nonroot", "root"],
        },
    ],
    "nodeAttrs": [
        {
            // Funnel policy, which lets tailnet members control Funnel
            // for their own devices.
            // Learn more at /
            "target": ["autogroup:member"],
            "attr":   ["funnel"],
        },
    ]
}

本文标签： How to deny subnet to subnet routing using acls with TailScaleStack Overflow