TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2024-11-29 13:05:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

wgengine\router: fix the Tailscale-In firewall rule to work on domain networks

Browse Source 
The Network Location Awareness service identifies networks authenticated against
an Active Directory domain and categorizes them as "Domain Authenticated".
This includes the Tailscale network if a Domain Controller is reachable through it.

If a network is categories as NLM_NETWORK_CATEGORY_DOMAIN_AUTHENTICATED,
it is not possible to override its category, and we shouldn't attempt to do so.
Additionally, our Windows Firewall rules should be compatible with both private
and domain networks.

This fixes both issues.

Fixes #11813

Signed-off-by: Nick Khyl <nickk@tailscale.com>
This commit is contained in:
Nick Khyl 2024-04-19 14:36:20 -05:00 committed by Nick Khyl
parent bff527622d
commit 9e1c86901b
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wgengine/router/ifconfig_windows.go
View File

@ -210,7 +210,7 @@ func setPrivateNetwork(ifcLUID winipcfg.LUID) (bool, error) {
return false, fmt.Errorf("GetCategory: %v", err) return false, fmt.Errorf("GetCategory: %v", err)
} }
if cat != categoryPrivate { if cat != categoryPrivate && cat != categoryDomain {
if err := n.SetCategory(categoryPrivate); err != nil { if err := n.SetCategory(categoryPrivate); err != nil {
return false, fmt.Errorf("SetCategory: %v", err) return false, fmt.Errorf("SetCategory: %v", err)
} }

2
wgengine/router/router_windows.go
View File

@ -329,7 +329,7 @@ func (ft *firewallTweaker) doSet(local []string, killswitch bool, clear bool, pr
for _, cidr := range local { for _, cidr := range local {
ft.logf("adding Tailscale-In rule to allow %v ...", cidr) ft.logf("adding Tailscale-In rule to allow %v ...", cidr)
var d time.Duration var d time.Duration
d, err := ft.runFirewall("add", "rule", "name=Tailscale-In", "dir=in", "action=allow", "localip="+cidr, "profile=private", "enable=yes") d, err := ft.runFirewall("add", "rule", "name=Tailscale-In", "dir=in", "action=allow", "localip="+cidr, "profile=private,domain", "enable=yes")
if err != nil { if err != nil {
ft.logf("error adding Tailscale-In rule to allow %v: %v", cidr, err) ft.logf("error adding Tailscale-In rule to allow %v: %v", cidr, err)
return err return err