[Bug] Unable To Update Approved Routes

[farmergreg]

Is this a support request?

• This is not a support request

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I upgraded to 0.28 from 0.27 yesterday. Today I tried to add an exit node (Apple TV), but was unable to approve the route:

root@headscale ~# headscale nodes list-routes
ID | Hostname    | Approved  | Available | Serving (Primary)
71 | exit1       | 0.0.0.0/0 | 0.0.0.0/0 | 0.0.0.0/0
   |             | ::/0      | ::/0      | ::/0
93 | exit2       | 0.0.0.0/0 | 0.0.0.0/0 | 0.0.0.0/0
   |             | ::/0      | ::/0      | ::/0
97 | exit3       |           | 0.0.0.0/0 |
   |             |           | ::/0      |

root@headscale ~# headscale nodes approve-routes -i 97 "0.0.0.0/0"
Node updated
root@headscale ~# headscale nodes list-routes
ID | Hostname    | Approved  | Available | Serving (Primary)
71 | exit1       | 0.0.0.0/0 | 0.0.0.0/0 | 0.0.0.0/0
   |             | ::/0      | ::/0      | ::/0
93 | exit2       | 0.0.0.0/0 | 0.0.0.0/0 | 0.0.0.0/0
   |             | ::/0      | ::/0      | ::/0
97 | exit3       |           | 0.0.0.0/0 |
   |             |           | ::/0      |

As a workaround, I was able to run update nodes set approved_routes='["0.0.0.0/0","::/0"]' where id=97; directly on db.sqlite. Then I restarted headscale and everything worked as expected.

Expected Behavior

The approved routes should be updated for exit3. In my example, it should show "0.0.0.0/0" in the Approved column.

Steps To Reproduce

1. Configure a node to be an exit node.
2. try to approve the 0.0.0.0/0 and/or ::/0 routes.
3. list the approved routes on the new node.

Environment

- OS: Debian
headscale version v0.28.0
commit: 97fa117c48a58bee3941e5e8b4393873501afe14
build time: 2026-02-04T20:26:22Z
built with: go1.25.5 linux/amd64

Runtime environment

• Headscale is behind a (reverse) proxy
• Headscale runs in a container

Debug information

N/A

[farmergreg]

Closing because I neglected to put the --routes flag in. It works correctly.
nodes approve-routes -i 97 --routes "0.0.0.0/0,::/0"