| 1 |
<?xml version="1.0" encoding="utf-8"?> |
| 2 |
|
| 3 |
Alloy's copy of firewalld's `trusted` zone, which exists for one line: the |
| 4 |
interface binding at the bottom. A file here overrides the package's copy in |
| 5 |
/usr/lib/firewalld/zones/, so the rest of this is that file verbatim. |
| 6 |
|
| 7 |
WHY tailscale0 IS PINNED HERE. tailscaled writes its own nftables tables |
| 8 |
(ts-input, ts-forward, ts-postrouting) and has no firewalld awareness at all: |
| 9 |
zero matching strings in the 1.102.3 binary this image ships. Under nftables |
| 10 |
every base chain on a hook returns its own verdict, so firewalld dropping a |
| 11 |
packet in its table is final no matter what tailscale accepted in its own. |
| 12 |
|
| 13 |
That is measured, not reasoned: two tables in a network namespace, one with |
| 14 |
an accepting base chain at priority -100 and one with `policy drop` at |
| 15 |
priority 10, and the packet dies. Without this file, bringing firewalld up on |
| 16 |
a machine running tailscaled kills every inbound tailnet connection, and the |
| 17 |
whole tree is addressed by tailnet name. |
| 18 |
|
| 19 |
WHAT IT COSTS, stated because `trusted` means what it says: anything reaching |
| 20 |
this machine over the tailnet is accepted, on any port, including ports the |
| 21 |
default zone refuses from the LAN. That is not a new position. Tailscale SSH |
| 22 |
already bypasses authorized_keys on these hosts, so the tailnet ACL has been |
| 23 |
the access control here for as long as the tailnet has existed. If that ever |
| 24 |
stops being true, this file is where the change goes. |
| 25 |
|
| 26 |
The binding is declarative rather than a `firewall-cmd` at first boot: a |
| 27 |
command that has to run is a command that can fail to run, and on a headless |
| 28 |
box its failure is invisible until someone cannot reach it. |
| 29 |
|
| 30 |
tailscaled is disabled by default (etc/systemd/system-preset/50-alloy.preset). |
| 31 |
An interface that does not exist binds nothing, so this file is inert until |
| 32 |
someone turns the mesh on, which is the point at which it has to already be |
| 33 |
correct. |
| 34 |
|
| 35 |
<zone target="ACCEPT"> |
| 36 |
<short>Trusted</short> |
| 37 |
<description>All network connections are accepted.</description> |
| 38 |
<forward/> |
| 39 |
<interface name="tailscale0"/> |
| 40 |
</zone> |
| 41 |
|