I want to create a middleware for my express.js app that will reject requests not coming from a machine that's not connected to my Tailscale network.

How can I do that? Do I need to grab the request ip and then verify it somehow against Tailscale?

CodePudding user response：

On Linux Tailscale installs an iptables rule that 100.64.0.0/10 can only ingress via tailscale0. You can make the app check the source IP against 100.64.0.0/10 as the simplest solution.

There is Go code in https://github.com/tailscale/tailscale/tree/main/tsnet which provides more extensive information, like the User who is connecting. Eventually we'd expect there to be supported APIs which would be easier to get to from JavaScript, but for right now if you're willing to write a bit of Go scaffolding you might be able to run a binary from thge JavaScript to get the information you're looking for.