fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post #71

Merged

beatzaplenty merged 1 commits from worktree-lovely-spinning-bubble into main

2026-07-26 00:01:49 +00:00

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	e9b225d2d6	fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s Details extraCommands runs after nixos-nat-post is deleted but before it is re-created, so -A nixos-nat-post silently fails every time. POSTROUTING is a built-in chain that always exists; target it directly instead. The -C idempotency check prevents duplicate rules on firewall reloads. Drop networking.nat.enable -- it was only needed for the sub-chain that turned out to be the wrong target. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 10:00:47 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

e9b225d2d6

fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s

Details

extraCommands runs after nixos-nat-post is deleted but before it is
re-created, so -A nixos-nat-post silently fails every time.  POSTROUTING
is a built-in chain that always exists; target it directly instead.

The -C idempotency check prevents duplicate rules on firewall reloads.
Drop networking.nat.enable -- it was only needed for the sub-chain that
turned out to be the wrong target.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-26 10:00:47 +10:00