fix(tailscale-router): masquerade LAN traffic into Tailscale #69

Merged

beatzaplenty merged 1 commits from worktree-lovely-spinning-bubble into main

2026-07-25 23:48:13 +00:00

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	cda2132d6a	fix(tailscale-router): masquerade LAN traffic into Tailscale Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s Details Without SNAT on tailscale0, Tailscale drops forwarded packets from LAN source IPs (192.168.2.x) because they are not recognised Tailscale addresses. With networking.nat.externalInterface = "tailscale0", all traffic leaving through the Tailscale tunnel is masqueraded to the router's own Tailscale IP (100.x.x.x), making it indistinguishable from locally-originated traffic. Conntrack handles the return path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 09:45:07 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

cda2132d6a

fix(tailscale-router): masquerade LAN traffic into Tailscale

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s

Details

Without SNAT on tailscale0, Tailscale drops forwarded packets from LAN
source IPs (192.168.2.x) because they are not recognised Tailscale
addresses.  With networking.nat.externalInterface = "tailscale0", all
traffic leaving through the Tailscale tunnel is masqueraded to the
router's own Tailscale IP (100.x.x.x), making it indistinguishable from
locally-originated traffic.  Conntrack handles the return path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-26 09:45:07 +10:00