wf: allow limited broadcast to/from permitted interfaces when using an exit node on Windows

Similarly to allowing link-local multicast in #13661, we should also allow broadcast traffic
on permitted interfaces when the killswitch is enabled due to exit node usage on Windows.
This always includes internal interfaces, such as Hyper-V/WSL2, and also the LAN when
"Allow local network access" is enabled in the client.

Updates #18504

Signed-off-by: Nick Khyl <nickk@tailscale.com>
This commit is contained in:
Nick Khyl
2026-01-23 17:53:00 -06:00
committed by Nick Khyl
parent 3ec5be3f51
commit 2a69f48541
2 changed files with 79 additions and 6 deletions
+3
View File
@@ -18,3 +18,6 @@ reference to an issue or PR about the feature.
When the option is disabled, we should still permit it for internal interfaces,
such as Hyper-V/WSL2 on Windows.
- Inbound and outbound broadcasts when an exit node is used, both with and without
the "Allow local network access" option enabled. When the option is disabled,
we should still permit traffic on internal interfaces, such as Hyper-V/WSL2 on Windows.