search

juanfont / headscale

An open source, self-hosted implementation of the Tailscale control server
BSD 3-Clause "New" or "Revised" License
20.75k stars 1.15k forks source link

Request for Configuration of --verify-clients Parameter in Built-in DERP #1836

Open zsio opened 3 months ago

zsio commented 3 months ago

I am currently using the built-in DERP in Headscale and I noticed that the --verify-clients parameter is not configurable. This situation implies that the DERP I am using could be publicly accessible, which raises security concerns.

I am writing to inquire if there is a possibility to restrict the use of the built-in DERP to my clients only. This feature will greatly enhance the security of my connections and ensure that only authorized clients can use the DERP.

Looking forward to your response and potential solutions to this issue.

StudyingLover commented 3 months ago

I am considering migrating from Tailscale to Headscale, but I hesitated when I suddenly notice this issue because I cannot tolerate others freeloading on my server without my permission.

masterwishx commented 3 months ago

Also interested in this future as using my own DERP server...

ShadowJonathan commented 3 months ago

When researching tailscale I noticed this fairly subtle codepath being used for it, it requires an active embedded tailscale client to be sending peer updates to the derp server, apparantly.

github-actions[bot] commented 6 days ago

This issue is stale because it has been open for 90 days with no activity.

ShadowJonathan commented 6 days ago

No.

https://nostalebots.xyz/