From cda2132d6af4586ac36bf72c2dcc6b89c4972d92 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Sun, 26 Jul 2026 09:45:07 +1000 Subject: [PATCH] fix(tailscale-router): masquerade LAN traffic into Tailscale Without SNAT on tailscale0, Tailscale drops forwarded packets from LAN source IPs (192.168.2.x) because they are not recognised Tailscale addresses. With networking.nat.externalInterface = "tailscale0", all traffic leaving through the Tailscale tunnel is masqueraded to the router's own Tailscale IP (100.x.x.x), making it indistinguishable from locally-originated traffic. Conntrack handles the return path. Co-Authored-By: Claude Sonnet 4.6 --- modules/build-types/tailscale-router.nix | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/modules/build-types/tailscale-router.nix b/modules/build-types/tailscale-router.nix index be481d2..5140a06 100644 --- a/modules/build-types/tailscale-router.nix +++ b/modules/build-types/tailscale-router.nix @@ -1,4 +1,4 @@ -{ ... }: +{ vars, ... }: { imports = [ @@ -12,8 +12,21 @@ # own setting) so the intent is clear at the build-type level. services.tailscale.useRoutingFeatures = "server"; + # Advertise the LAN subnet so Tailscale peers can route back to LAN machines. + # Must also be approved in the Tailscale admin console (Machines → Edit route settings). + services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ]; + # Forwarded subnet-router traffic arrives on tailscale0 already # tailscale-authenticated -- the firewall's normal per-port allow-list # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance. networking.firewall.trustedInterfaces = [ "tailscale0" ]; + + # SNAT traffic from LAN machines going out through Tailscale so the remote + # peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather + # than a raw LAN IP. Without this, Tailscale drops the forwarded packets + # because the source is not a recognised Tailscale address. + networking.nat = { + enable = true; + externalInterface = "tailscale0"; + }; } -- 2.54.0