fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post

extraCommands runs after nixos-nat-post is deleted but before it is
re-created, so -A nixos-nat-post silently fails every time.  POSTROUTING
is a built-in chain that always exists; target it directly instead.

The -C idempotency check prevents duplicate rules on firewall reloads.
Drop networking.nat.enable -- it was only needed for the sub-chain that
turned out to be the wrong target.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/build-types/tailscale-router.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ vars, ... }:
 
 {
   imports = [
@@ -12,8 +12,31 @@
   # own setting) so the intent is clear at the build-type level.
   services.tailscale.useRoutingFeatures = "server";
 
-  # Forwarded subnet-router traffic arrives on tailscale0 already
-  # tailscale-authenticated -- the firewall's normal per-port allow-list
-  # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
-  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+  # Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
+  # Must also be approved in the Tailscale admin console (Machines → Edit route settings).
+  services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
+
+  networking.firewall = {
+    # Forwarded subnet-router traffic arrives on tailscale0 already
+    # tailscale-authenticated -- the firewall's normal per-port allow-list
+    # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
+    trustedInterfaces = [ "tailscale0" ];
+
+    # SNAT LAN traffic going into Tailscale so the remote peer sees it as
+    # coming from this router's Tailscale IP rather than a raw LAN IP.
+    # Without this, Tailscale drops forwarded packets whose source is not a
+    # recognised Tailscale address.
+    #
+    # We target POSTROUTING directly (always-existing built-in chain) rather
+    # than nixos-nat-post: extraCommands runs after the old nixos-nat-post is
+    # deleted but before the new one is created, so -A nixos-nat-post silently
+    # fails.  The -C check makes the rule idempotent across firewall reloads.
+    extraCommands = ''
+      iptables -t nat -C POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || \
+        iptables -t nat -A POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
+    '';
+    extraStopCommands = ''
+      iptables -t nat -D POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
+    '';
+  };
 }

modules/tailscale/subnet-router.nix

@@ -1,4 +1,4 @@
-_:
+{ pkgs, ... }:
 
 {
   imports = [ ./enable-service.nix ];
@@ -12,4 +12,24 @@ _:
     # instead of relaying through DERP.
     openFirewall = true;
   };
+
+  # Tailscale recommends these ethtool flags on the uplink interface to get
+  # full UDP GRO throughput on subnet routers (https://tailscale.com/s/ethtool-config-udp-gro).
+  # The interface is derived from the default route so it works regardless of
+  # what the NIC is named on a given host.
+  systemd.services.tailscale-udp-gro = {
+    description = "Enable UDP GRO forwarding on uplink for Tailscale subnet router";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.ethtool pkgs.iproute2 ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = pkgs.writeShellScript "tailscale-udp-gro" ''
+        NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
+        ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off
+      '';
+    };
+  };
 }