beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(tailscale-router): actually insert MASQUERADE rule via extraCommands
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m34s
Details

Browse Source 
networking.nat.externalInterface without internalInterfaces creates the
nixos-nat-post chain but inserts no MASQUERADE rule into it — confirmed
by inspecting the live firewall-start script on the deployed host.

Add the rule explicitly via firewall.extraCommands targeting nixos-nat-post,
scoped to LAN source traffic (vars.lanCidr) going out tailscale0.
extraStopCommands removes it on firewall stop.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
beatzaplenty
2026-07-26 09:54:33 +10:00
co-authored by Claude Sonnet 4.6
parent cda2132d6a
commit 781b1d324e
1 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/build-types/tailscale-router.nix
+23 -11
View File
@@ -16,17 +16,29 @@
# Must also be approved in the Tailscale admin console (Machines → Edit route settings).
services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
# Forwarded subnet-router traffic arrives on tailscale0 already
# tailscale-authenticated -- the firewall's normal per-port allow-list
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
networking.firewall.trustedInterfaces = [ "tailscale0" ];
networking = {
# SNAT traffic from LAN machines going out through Tailscale so the remote
# peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
# than a raw LAN IP. Without this, Tailscale drops the forwarded packets
# because the source is not a recognised Tailscale address.
#
# networking.nat.externalInterface alone does not insert a MASQUERADE rule
# (it only does so when internalInterfaces is also set). We use
# extraCommands to add the rule into the nixos-nat-post chain that
# networking.nat.enable creates, and extraStopCommands to clean it up.
nat.enable = true;
# SNAT traffic from LAN machines going out through Tailscale so the remote
# peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
# than a raw LAN IP. Without this, Tailscale drops the forwarded packets
# because the source is not a recognised Tailscale address.
networking.nat = {
enable = true;
externalInterface = "tailscale0";
firewall = {
# Forwarded subnet-router traffic arrives on tailscale0 already
# tailscale-authenticated -- the firewall's normal per-port allow-list
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
trustedInterfaces = [ "tailscale0" ];
extraCommands = ''
iptables -t nat -A nixos-nat-post -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
'';
extraStopCommands = ''
iptables -t nat -D nixos-nat-post -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
'';
};
};
}