fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post #71

2026-07-26T00:01:44Z

beatzaplenty commented

2026-07-26 00:01:44 +00:00

extraCommands runs after nixos-nat-post is deleted but before it is
re-created, so -A nixos-nat-post silently fails every time. POSTROUTING
is a built-in chain that always exists; target it directly instead.

The -C idempotency check prevents duplicate rules on firewall reloads.
Drop networking.nat.enable -- it was only needed for the sub-chain that
turned out to be the wrong target.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

extraCommands runs after nixos-nat-post is deleted but before it is re-created, so -A nixos-nat-post silently fails every time. POSTROUTING is a built-in chain that always exists; target it directly instead. The -C idempotency check prevents duplicate rules on firewall reloads. Drop networking.nat.enable -- it was only needed for the sub-chain that turned out to be the wrong target. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

beatzaplenty added 1 commit 2026-07-26 00:01:44 +00:00

fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s

Details

e9b225d2d6

extraCommands runs after nixos-nat-post is deleted but before it is
re-created, so -A nixos-nat-post silently fails every time.  POSTROUTING
is a built-in chain that always exists; target it directly instead.

The -C idempotency check prevents duplicate rules on firewall reloads.
Drop networking.nat.enable -- it was only needed for the sub-chain that
turned out to be the wrong target.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

beatzaplenty merged commit 9872b8ff1d into main

2026-07-26 00:01:49 +00:00

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#71