Pinging devices using subnet routing on Apple TV does not work #10393

stevetrease · 2023-11-27T20:42:54Z

What is the issue?

I cannot get the new tvOS Test Flight subnet router option to work.

Having configured a subnet router in the tvOS app, I try to ping a device on the subnet from a device connected to the tailnet (which does not have access to the subnet or device). I get no ping response. Using a Synology as a subnet router works.

Subnet is 192.168.1.0/24.
Target device is 192.168.1.1.

nas2 - Synology running DSM 7.2-64570 Update 3 and Tailscale 1.54.0. Has IPv4 address on subnet.
bedroom - AppleTV running tvOS 17.2 and Tailscale 1.55.67. Has IPv4 address on subnet,
droplet-2 - a Digital Ocean Ubuntu VM running Tailscale 1.54.0. Does not have access to subnet.

Steps to reproduce

Disable subnet routing of the subnet on the AppleTV. Enable it on the Synology (both using 'edit route settings' on the Tailscale admin portal for the tailnet).
Logon onto the Digital Ocean VM and ping 192.168.1.1. Get response.
Disable subnet routing on the Synology, Enable it on the AppleTV.
PIng 192.168.1.1 from the DO VM. Get no response.
BUG-0f48b278de4c4bdb69455a9c9c2e105bade5d3c6f2ca422c07c5e228a5d94ea9-20231127203608Z-3c980f9b9bb9a865

Are there any recent changes that introduced the issue?

No.

OS

Linux, Synology, Other

OS version

DSM 7.2-64570 Update 3, tvOS 17.2. Detailed further above.

Tailscale version

1.54.0 and 1.55.67

Other software

Let me know if you need more information to help troubleshoot. Hopefully I am just doing something silly. :-)

I have no Tailscale ACL config to allow the subnet routing, but since it works on the Synology, I don't think I do.

Synology, AppleTV and Digital Ocean VM are all set with the same page (tag: service).

Bug report

BUG-0f48b278de4c4bdb69455a9c9c2e105bade5d3c6f2ca422c07c5e228a5d94ea9-20231127203608Z-3c980f9b9bb9a865

agottardo · 2023-11-27T21:23:52Z

Does this affect all traffic, or only pings? Are you able to talk to route traffic to devices other than 192.168.1.1?

stevetrease · 2023-11-27T21:38:34Z

Interesting. Ping doesn't work via the AppleTV to two different devices on the LAN but does with routes enabled on only the Synology.

I've just tried curl and can get a webpage via both the Synology and the AppleTV from the 192.168.1.1 device.
I can also SSH into another device on the LAN via both Synology and AppleTV.

So it seems to be ping (ICMP?) not being passed via the AppleTV when it is passed via the Synology.

agottardo · 2023-11-27T22:33:19Z

Okay, this matches what I am seeing. Relaying pings appears to be broken on tvOS due to a sandboxing issue. I'll report back once I have more details to share.

tysecure · 2024-02-10T15:07:41Z

I can confirm this. You can connect to the device but you can't ping it. I hope this gets addressed.

pti-cjones · 2024-02-28T05:57:10Z

@agottardo just wondering if there is any insight as to why both TCP/UDP work but not ICMP with the sanboxing? I'm stoked to have a subnet router on a small and powerful device like the Apple TV, but not having ICMP breaks my monitoring.

With that said, thank you for the work you have put into making this happen on the Apple TV.

agottardo · 2024-02-28T06:56:01Z

@agottardo just wondering if there is any insight as to why both TCP/UDP work but not ICMP with the sanboxing? I'm stoked to have a subnet router on a small and powerful device like the Apple TV, but not having ICMP breaks my monitoring.

With that said, thank you for the work you have put into making this happen on the Apple TV.

Sure, check out the comment for the userPing function here:

tailscale/wgengine/netstack/netstack.go

Lines 834 to 846 in 3dd8ae2

    
           // userPing tried to ping dstIP and if it succeeds, injects pingResPkt 
        
           // into the tundev. 
        
           // 
        
           // It's used in userspace/netstack mode when we don't have kernel 
        
           // support or raw socket access. As such, this does the dumbest thing 
        
           // that can work: runs the ping command. It's not super efficient, so 
        
           // it bounds the number of pings going on at once. The idea is that 
        
           // people only use ping occasionally to see if their internet's working 
        
           // so this doesn't need to be great. 
        
           // 
        
           // TODO(bradfitz): when we're running on Windows as the system user, use 
        
           // raw socket APIs instead of ping child processes. 
        
           func (ns *Impl) userPing(dstIP netip.Addr, pingResPkt []byte) {

To route pings, that code currently attempts to run the ping command in the CLI, but the sandbox on iOS/tvOS prevents that. We should be able to send ICMP traffic directly there, I just haven't had the time to build it out.

tysecure · 2024-03-07T10:04:21Z

You CAN use the AppleTV as a subnet router but you can't PING any of the devices. This threw me off at first as well. If you enter the local IP for your device, you can connect to it successfully.

openclosure · 2024-04-24T07:02:01Z

This threw me for a loop as well. An easy check for me was:

iPhone, MacBook, Apple TV all on tailnet. Apple TV configured to advertise subnet routes.
Disconnect iPhone from Wifi, attempt to ping (using fing) MacBook via tailnet IP (Success)
Attempt to ping MacBook via local network IP (Fail)
Run python3 -m http.server 8000 on MacBook, now navigate to http://<local_ip>:8000 on iPhone. Success!

Not really a big deal but spent 30 minutes in confusion on why ping wasn't working.

Fixes #10393 On Apple platforms, exit nodes and subnet routers have been unable to relay pings from Tailscale devices to non-Tailscale devices due to sandbox restrictions imposed on our network extensions by Apple. The sandbox prevented the code in netstack.go from spawning the `ping` process which we were using. Replace that exec call with logic to send an ICMP echo request directly, which appears to work in userspace, and not trigger a sandbox violation in the syslog.

Fixes #10393 Fixes tailscale/corp#15412 Fixes tailscale/corp#19808 On Apple platforms, exit nodes and subnet routers have been unable to relay pings from Tailscale devices to non-Tailscale devices due to sandbox restrictions imposed on our network extensions by Apple. The sandbox prevented the code in netstack.go from spawning the `ping` process which we were using. Replace that exec call with logic to send an ICMP echo request directly, which appears to work in userspace, and not trigger a sandbox violation in the syslog.

Fixes #10393 Fixes tailscale/corp#15412 Fixes tailscale/corp#19808 On Apple platforms, exit nodes and subnet routers have been unable to relay pings from Tailscale devices to non-Tailscale devices due to sandbox restrictions imposed on our network extensions by Apple. The sandbox prevented the code in netstack.go from spawning the `ping` process which we were using. Replace that exec call with logic to send an ICMP echo request directly, which appears to work in userspace, and not trigger a sandbox violation in the syslog. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>

agottardo · 2024-05-16T18:58:48Z

This should land in the 1.68 update (and sooner on TestFlight).

labrnth · 2024-05-16T19:34:07Z

Amazing thank you

Fixes tailscale#10393 Fixes tailscale/corp#15412 Fixes tailscale/corp#19808 On Apple platforms, exit nodes and subnet routers have been unable to relay pings from Tailscale devices to non-Tailscale devices due to sandbox restrictions imposed on our network extensions by Apple. The sandbox prevented the code in netstack.go from spawning the `ping` process which we were using. Replace that exec call with logic to send an ICMP echo request directly, which appears to work in userspace, and not trigger a sandbox violation in the syslog. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>

stevetrease added bug Bug needs-triage labels Nov 27, 2023

agottardo added the OS-tvOS Issues concerning Apple's tvOS label Nov 27, 2023

agottardo changed the title ~~Subnet routing on AppleTV Test Flight app does not work~~ Pinging devices using subnet routing on Apple TV does not work Nov 27, 2023

This comment was marked as off-topic.

Sign in to view

jimmybrancaccio mentioned this issue Feb 27, 2024

Unable to Use Exit Node & Subnet Routing Functions in AppleTV tvOS #11268

Open

agottardo self-assigned this Feb 28, 2024

agottardo mentioned this issue May 7, 2024

xcode: allow ICMP ping relay on macOS + iOS/tvOS platforms #12048

Merged

agottardo linked a pull request May 7, 2024 that will close this issue

xcode: allow ICMP ping relay on macOS + iOS/tvOS platforms #12048

Merged

agottardo closed this as completed in #12048 May 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pinging devices using subnet routing on Apple TV does not work #10393

Pinging devices using subnet routing on Apple TV does not work #10393

stevetrease commented Nov 27, 2023 •

edited

agottardo commented Nov 27, 2023

stevetrease commented Nov 27, 2023 •

edited

agottardo commented Nov 27, 2023

This comment was marked as off-topic.

tysecure commented Feb 10, 2024

pti-cjones commented Feb 28, 2024

agottardo commented Feb 28, 2024 •

edited

tysecure commented Mar 7, 2024

openclosure commented Apr 24, 2024 •

edited

agottardo commented May 16, 2024

labrnth commented May 16, 2024

Pinging devices using subnet routing on Apple TV does not work #10393

Pinging devices using subnet routing on Apple TV does not work #10393

Comments

stevetrease commented Nov 27, 2023 • edited

What is the issue?

Steps to reproduce

Are there any recent changes that introduced the issue?

OS

OS version

Tailscale version

Other software

Bug report

agottardo commented Nov 27, 2023

stevetrease commented Nov 27, 2023 • edited

agottardo commented Nov 27, 2023

This comment was marked as off-topic.

tysecure commented Feb 10, 2024

pti-cjones commented Feb 28, 2024

agottardo commented Feb 28, 2024 • edited

tysecure commented Mar 7, 2024

openclosure commented Apr 24, 2024 • edited

agottardo commented May 16, 2024

labrnth commented May 16, 2024

stevetrease commented Nov 27, 2023 •

edited

stevetrease commented Nov 27, 2023 •

edited

agottardo commented Feb 28, 2024 •

edited

openclosure commented Apr 24, 2024 •

edited