3 ms·

It looks like the authentication rests upon looking up the owner of the incoming packet's (tailnet) IP address[0]. Does anyone know whether they have measures

• avianlyric 5y ago
  It should be spoof resistance by virtue of the fact that every node on a Tailscale network sets up public key authenticated wireguard tunnel directly to any peer it’s trying to contact. The Tailscale client its self will automatically drop any packets that arrive over the tunnel with an unexpected IP address or protocol number (TCP, UDP, ICMP only).
  • codethief 5y ago
    > It should be spoof resistance by virtue of the fact that every node on a Tailscale network sets up public key authenticated wireguard tunnel directly to any peer it’s trying to contact. innernet does exactly that but that doesn't help with spoofed packets arriving through some other network interface, as long as you don't explicitly tell your server (in this case Minecraft) to listen exclusively on wg0. Hence my question.
    • avianlyric 5y ago
      You asked about Tailscales ability to detect and prevent spoofing. Tailscale can because, like I said, it sets up direct P2P authenticated WireGuard tunnels. Tailscale runs wireguard in the userspace and their clients consume packets directly out of the WireGuard tunnels before passing them onto a single Tailscale virtual interface. At no point is the Tailscale wireguard tunnel attached directly to a virtual interface, the Tailscale client inspects every packet moving in either direction first. I would strongly recommend reading up on how Tailscale handle ACLs, I think you’ll find it enlightening. I can’t make any comments about Minecraft’s ability to detect spoofed packets, like you say that depended on the servers setup. But at point it’s no longer a Tailscale problem, Tailscale can only protect you from stuff sent over Tailscale. You want protection from the internet, you need to look else where.
• bradfitz 5y ago
  Tailscale engineer here. I confirm. Only cryptographically valid packets are accepted, and then we only return peer identity information for flows from said authenticated & authorized packets.
  • matthewaveryusa 5y ago
    For services you run where you do ip <-> identity authentication you have to make sure that you're only listening on the tailscale interface right? ie, if your server is listen on 0.0.0.0 then you may be open to IP spoofing?
    • codethief 5y ago
      IIUC the way the server (Graphana/Minecraft) and the proxy described in the OP interact is the following: All incoming packets pass through the proxy which is running WireGuard in user space and which then passes them on to the server (which only listens on 127.0.0.1): > By setting the whitelist setting to 127.0.0.1, you only allow connections from the Grafana authentication proxy to be able to bypass Grafana’s normal authentication mechanisms. Since the proxy runs WireGuard in user space it will take care of assigning the IP addresses itself (after successful authentication), meaning no IP address spoofing or network interface "confusion" is possible.
    • dave_universetf 5y ago
      Not necessarily. On linux for example, you'll find netfilter firewall rules installed by tailscale that implement strict reverse path filtering, which will ensure that tailscale IPs can only reach your userspace process if they originated from the tailscale network interface. (you might ask why we don't use the rp_filter sysctl for this; unfortunately linux has a broken precedence order where loose filtering overrides strict filtering, so even if we ask for strict behavior for tailscale0, if the systemwide default is loose, we get the insufficient loose behavior - so we implement RPF by hand in netfilter instead, sigh)