Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stateful filtering is now off by default #368

Merged
merged 2 commits into from
May 21, 2024
Merged

Stateful filtering is now off by default #368

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a9bf7e2
Stateful filtering is now off by default
lmagyar May 21, 2024
347bb0e
fix grammar
lmagyar May 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 4 additions & 8 deletions tailscale/DOCS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,7 +280,7 @@ router, and this simplifies routing configuration.
When not set, this option is enabled by default.

To support advanced [Site-to-site networking][tailscale_info_site_to_site] (eg.
to traverse multiple networks), you can disable this functionality, and execute
to traverse multiple networks), you can disable this functionality, and follow
steps 2 and 3 as described on [Site-to-site
networking][tailscale_info_site_to_site]. But do it only when you really
understand why you need this.
Expand All @@ -292,11 +292,7 @@ nodes, subnet routers, and app connectors), to only allow return packets for
existing outbound connections. Inbound packets that don't belong to an existing
connection are dropped.

When not set, this option is enabled by default.

To support basic [Site-to-site networking][tailscale_info_site_to_site], you can
disable this functionality, and execute steps 2 and 3 as described on
[Site-to-site networking][tailscale_info_site_to_site].
When not set, this option is disabled by default.

### Option: `tags`

Expand Down Expand Up @@ -328,8 +324,8 @@ instance, disable userspace networking mode, which will create a `tailscale0`
network interface on your host.

If you want to access other clients on your tailnet even from your local subnet,
disable `stateful_filtering` and execute steps 2 and 3 as described on
[Site-to-site networking][tailscale_info_site_to_site].
follow steps 2 and 3 as described on [Site-to-site
networking][tailscale_info_site_to_site].

In case your local subnets collide with subnet routes within your tailnet, your
local network access has priority, and these addresses won't be routed toward
Expand Down
8 changes: 4 additions & 4 deletions tailscale/rootfs/etc/s6-overlay/s6-rc.d/post-tailscaled/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,13 +72,13 @@ then
options+=(--login-server="${login_server}")
fi

# Support basic site-to-site networking, disable stateful filtering
# Enable stateful filtering (it's disabled by default from v1.66.4)
if ! bashio::config.has_value "stateful_filtering" || \
bashio::config.true "stateful_filtering";
bashio::config.false "stateful_filtering";
then
options+=(--stateful-filtering)
else
options+=(--stateful-filtering=false)
else
options+=(--stateful-filtering)
fi

# Support advanced site-to-site networking, disable source addresses NAT
Expand Down
3 changes: 1 addition & 2 deletions tailscale/translations/en.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,7 @@ configuration:
This option enables stateful packet filtering on packet-forwarding nodes (exit
nodes, subnet routers, and app connectors), to only allow return packets for
existing outbound connections.
To support basic Site-to-site networking, you can disable this functionality.
When not set, this option is enabled by default.
When not set, this option is disabled by default.
tags:
name: Tags
description: >-
Expand Down