[Bug] ACL and SSH Policies not working

[svar2388]

Is this a support request?

• This is not a support request

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I am trying to write a simple ACL Policy for my fresh tailnet but I have been stopped pretty much at the beginning after only adding two nodes and trying to get them to talk to each other.

Below is my first attempt at writing a simple policy. With this policy, both nodes can see + ping each other but I cannot SSH into the tagged device, it times out.

{
  "tagOwners": {
    "tag:exit": ["lm@"],
    "tag:exit-vpn": ["lm@"],
  },

  "acls": [
    {
      "action": "accept",
      "src": ["lm@"],
      "dst": ["tag:exit-vpn:*"],
    },
  ],

  "ssh": [
    {
      "action": "accept",
      "src": ["lm@"],
      "dst": ["tag:exit-vpn"],
      "users": ["root"],
    },
  ],
}

I then changed the policies to be a little more "as expected" using groups and autogroups, and the result was that my user could only see itself, the tagged device could see itself and the user, and still SSH is not working.

{
  "groups": {
    "group:admins": ["lm@"],
  },
  
  "tagOwners": {
    "tag:exit": ["group:admins"],
    "tag:exit-vpn": ["group:admins"],
  },

  "acls": [
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["autogroup:tagged:*"],
    },
  ],

  "ssh": [
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["autogroup:tagged"],
      "users": ["root"],
    },
  ],
}

In both cases, tailscale debug netmap on the tagged device shows me an SSHPolicy of { "rules": null }

Expected Behavior

Given the above ACL policies, my expectation is that the user (or group) should see the tagged device (or all tagged devices) and that the tagged device should get an SSH Policy that allows the user[s] to access it via SSH.

Steps To Reproduce

1. Created a fresh Tailnet using Headscale 0.28, Headplane 0.6.2, and Traefik via Docker Compose
2. Generate an API key for Headplane and connect it
3. Created a new user and connected a node via preauth key
4. Connected a tagged device via preauth key and some tags
5. Draft a very simple ACL policy as seen above
6. Restart Headscale before testing new policies due to known bug

Environment

- OS: Ubuntu 24.04 LTS
- Headscale version: 0.28
- Tailscale version: 1.94.1
- Headplane version: 0.6.2
- Docker Compose

Runtime environment

• Headscale is behind a (reverse) proxy
• Headscale runs in a container

Debug information

.

[nblock]

but I cannot SSH into the tagged device, it times out.

I tested your 1st ACL as-is and it works as intended on Headscale 0.28 (native, no docker, no headplane). Steps:

• Setup config that points to your policy
• headscale user create lm
• n1: tailscale up --login-server https://headscale.example.com and register on headscale
• n2: tailscale up --login-server https://headscale.example.com --advertise-tags tag:exit-vpn --ssh
• tailscale ssh root@100.64.0.2 (tailscale IP of n2)

$ headscale nodes list
ID | Hostname | Name | MachineKey | NodeKey | User           | Tags         | IP addresses                  | Ephemeral | Last seen           | Expiration | Connected | Expired
1  | n1       | n1   | [CMV4y]    | [+Gw8r] | lm             |              | 100.64.0.1, fd7a:115c:a1e0::1 | false     | 2026-03-17 18:50:23 | N/A        | online    | no     
2  | n2       | n2   | [5DF5+]    | [p/79A] | tagged-devices | tag:exit-vpn | 100.64.0.2, fd7a:115c:a1e0::2 | false     | 2026-03-17 18:51:37 | N/A        | online    | no  

Could it be that you forgot --ssh on the tagged node? You can enable SSH via: tailscale set --ssh=true on the tagged node. What is the output of tailscale ssh root@IP_OF_TAGGED_NODE. What is the output of tailscaled logs on both nodes?

[svar2388]

Thanks for taking a look. I definitely have --ssh enabled on the tagged device as I am getting "SSH is enabled but policies don't allow access" warning on it. I have created my users and such through Headplane using preauth keys whereas you used headscale directly. I can't see that being an issue as both of my devices have successfully connected to the network and I can see them both in headscale CLI and in headplane. The only difference I see is that you are using the --advertise-tags option wheras I am baking the tags into the preauth key. When I try using that option, it errors and tells me it is not compatible with my key. However when I check headscale nodes list I do see my tags and I also see them in headplane so again, it should be working?

When I ssh root@100.64.0.2 it just times out. Below is debug output from the laptop

$ journalctl -u tailscaled | tail -n 50
...
tailscaled[1885]: open-conn-track: flow TCP 100.64.0.1:35910 > 100.64.0.2:22 rejected due to acl
tailscaled[1885]: open-conn-track: flow TCP 100.64.0.1:35910 > 100.64.0.2:22 rejected due to acl
tailscaled[1885]: open-conn-track: flow TCP 100.64.0.1:35910 > 100.64.0.2:22 rejected due to acl
tailscaled[1885]: open-conn-track: flow TCP 100.64.0.1:35910 > 100.64.0.2:22 rejected due to acl
tailscaled[1885]: open-conn-track: flow TCP 100.64.0.1:35910 > 100.64.0.2:22 rejected due to acl
tailscaled[1885]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v")
tailscaled[1885]: [RATELIMIT] format("open-conn-track: flow %v %v > %v rejected due to %v") (2 dropped)
tailscaled[1885]: open-conn-track: flow TCP 100.64.0.1:35910 > 100.64.0.2:22 rejected due to acl

From the tagged device, I see paired DROP ... 60 no rules match. errors. I can't copy/paste from that node right now as I am accessing it over VNC.

[nblock]

The only difference I see is that you are using the --advertise-tags option wheras I am baking the tags into the preauth key.

Tried it with preauthkeys (docs) and it works as expected (native, no docker, no headplane):

• Setup config that points to your policy
• headscale user create lm
• headscale preauthkeys create --user 1
• headscale preauthkeys create --tags tag:exit-vpn
• n1: tailscale up --login-server https://headscale.example.com --authkey hskey-auth-FOR-USER-1
• n2: tailscale up --login-server https://headscale.example.com --authkey hskey-auth-FOR-TAG-EXIT-VPN --ssh
• tailscale ssh root@100.64.0.2 (tailscale IP of n2)

Note that n2 is registered with the preauthkey alone, no tags are passed.

ID | Hostname | Name | MachineKey | NodeKey | User           | Tags         | IP addresses                  | Ephemeral | Last seen           | Expiration          | Connected | Expired
1  | n1       | n1   | [utbkp]    | [UDoNg] | lm             |              | 100.64.0.1, fd7a:115c:a1e0::1 | false     | 2026-03-18 14:51:56 | 0001-01-01 00:00:00 | online    | no     
2  | n2       | n2   | [FkNu2]    | [47p1E] | tagged-devices | tag:exit-vpn | 100.64.0.2, fd7a:115c:a1e0::2 | false     | 2026-03-18 14:53:30 | N/A                 | online    | no

[svar2388]

Issue resolved! What ended up happening was I was creating my usernames with trailing @ symbols. I got confused by the wording in the documentation and used the policy naming as user names.

• user:lm -> policy:lm@
• user:lm@domain.com -> policy:lm@domain.com
• user:lm@ -> WILL NEVER MATCH A POLICY