Tailscale
I see there is also a 'selfhosted' community that is more broad than tailscale
I am setting up a homelab server with Tailscale, and I am also trying to learn new stuff along the way. I've never worked with xtables/nftables, so I wanted to try it out instead of ufw. My goals for the setup were: - Tailscale manages its own traffic (aka everything on tailscale0). Otherwise: - all outgoing traffic is allowed - forwarding is _not_ allowed - incoming is _not_ allowed, unless it's port 22 from my local LAN (for quick at-home debugging) - ICMP is allowed for pinging I've scouted Arch Linux wiki and nftables wiki and have made this config: ``` flush ruleset table inet my_chain { set LANv4 { type ipv4_addr flags interval elements = { 192.168.1.0/24 } } set LANv6 { type ipv6_addr flags interval elements = { fe80::/64 } } chain my_lan_input { tcp dport ssh accept comment "Accept SSH on port 22" } chain my_input { type filter hook input priority filter; policy drop; iif lo accept comment "Accept localhost traffic" ct state invalid drop comment "Drop invalid connections" ct state established,related accept comment "Accept traffic originated from us" meta l4proto ipv6-icmp accept comment "Accept ICMPv6" meta l4proto icmp accept comment "Accept ICMP" ip6 saddr @LANv6 jump my_lan_input comment "Connections from private IPv6 address ranges" ip saddr @LANv4 jump my_lan_input comment "Connections from private IPv4 address ranges" } chain my_forward { type filter hook forward priority filter; policy drop; } chain my_output { type filter hook output priority filter; policy accept; } } ``` I put this config in `/etc/nftables.conf`, set `TS_DEBUG_FIREWALL_MODE=nftables`, and restarted my machine. After booting, Tailscale added its own chains, as expected: ```sh $ sudo nft list tables table inet my_chain table ip filter table ip nat table ip6 filter table ip6 nat ``` But now, I can't connect to my machine over HTTP(S) from Tailscale; When I go to the node's address in the browser, I get a timeout. I've tried setting the priority of my chain to `filter + 1`, but to no avail. How do I make this work? (I realise this is more a networking question than a Tailscale one, but maybe someone had faced a similar situation)