beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(tailscale-router): masquerade LAN traffic into Tailscale #69

Merged
beatzaplenty merged 1 commits from worktree-lovely-spinning-bubble into main 2026-07-25 23:48:13 +00:00
Conversation 0 Commits 1 Files Changed 1
+14 -1
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/build-types/tailscale-router.nix
+14 -1
View File
@@ -1,4 +1,4 @@
{ ... }: { vars, ... }:
{ {
imports = [ imports = [
@@ -12,8 +12,21 @@
# own setting) so the intent is clear at the build-type level. # own setting) so the intent is clear at the build-type level.
services.tailscale.useRoutingFeatures = "server"; services.tailscale.useRoutingFeatures = "server";
# Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
# Must also be approved in the Tailscale admin console (Machines → Edit route settings).
services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
# Forwarded subnet-router traffic arrives on tailscale0 already # Forwarded subnet-router traffic arrives on tailscale0 already
# tailscale-authenticated -- the firewall's normal per-port allow-list # tailscale-authenticated -- the firewall's normal per-port allow-list
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance. # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
networking.firewall.trustedInterfaces = [ "tailscale0" ]; networking.firewall.trustedInterfaces = [ "tailscale0" ];
# SNAT traffic from LAN machines going out through Tailscale so the remote
# peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
# than a raw LAN IP. Without this, Tailscale drops the forwarded packets
# because the source is not a recognised Tailscale address.
networking.nat = {
enable = true;
externalInterface = "tailscale0";
};
} }