Merge pull request 'fix(tailscale-router): masquerade LAN traffic into Tailscale' (#69) from worktree-lovely-spinning-bubble into main

Reviewed-on: #69

modules/build-types/tailscale-router.nix

@@ -16,27 +16,17 @@
   # Must also be approved in the Tailscale admin console (Machines → Edit route settings).
   services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
 
-  networking.firewall = {
-    # Forwarded subnet-router traffic arrives on tailscale0 already
-    # tailscale-authenticated -- the firewall's normal per-port allow-list
-    # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
-    trustedInterfaces = [ "tailscale0" ];
+  # Forwarded subnet-router traffic arrives on tailscale0 already
+  # tailscale-authenticated -- the firewall's normal per-port allow-list
+  # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
-    # SNAT LAN traffic going into Tailscale so the remote peer sees it as
-    # coming from this router's Tailscale IP rather than a raw LAN IP.
-    # Without this, Tailscale drops forwarded packets whose source is not a
-    # recognised Tailscale address.
-    #
-    # We target POSTROUTING directly (always-existing built-in chain) rather
-    # than nixos-nat-post: extraCommands runs after the old nixos-nat-post is
-    # deleted but before the new one is created, so -A nixos-nat-post silently
-    # fails.  The -C check makes the rule idempotent across firewall reloads.
-    extraCommands = ''
-      iptables -t nat -C POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || \
-        iptables -t nat -A POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
-    '';
-    extraStopCommands = ''
-      iptables -t nat -D POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
-    '';
+  # SNAT traffic from LAN machines going out through Tailscale so the remote
+  # peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
+  # than a raw LAN IP.  Without this, Tailscale drops the forwarded packets
+  # because the source is not a recognised Tailscale address.
+  networking.nat = {
+    enable = true;
+    externalInterface = "tailscale0";
   };
 }