Archived
beatzaplentyandClaude Sonnet 4.6
36f5ebdf86
FreeIPA (the new authoritative DNS) cannot reach 100.100.100.100
(Tailscale's internal MagicDNS resolver) directly because the DC is not
a Tailscale node. The tailscale-router IS a Tailscale node and can
reach 100.100.100.100 via tailscale0, so it now runs a dnsmasq
instance on its LAN interface that forwards all ts.net queries to
Tailscale's resolver.
After deploying this host, configure FreeIPA with:
kinit admin
ipa dnsforwardzone-add ts.net \
--forwarder=192.168.2.222 \
--forward-policy=only
This replaces Pi-hole's conditional forwarder for ts.net and restores
resolution of Tailscale MagicDNS names (e.g. raspberrypi.tail13f623.ts.net)
for all LAN hosts using FreeIPA as their DNS server.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ
45 lines
2.0 KiB
Nix
45 lines
2.0 KiB
Nix
{ vars, ... }:
|
|
|
|
{
|
|
imports = [
|
|
../tailscale/subnet-router.nix
|
|
../tailscale/ts-dns-forwarder.nix
|
|
../beszel/enable-agent.nix
|
|
];
|
|
|
|
# "server", not "both": this build type advertises LAN subnet routes but
|
|
# doesn't use another tailscale exit node itself, so it doesn't need the
|
|
# "client"-side loose reverse-path filtering that "both" would also enable.
|
|
# Deliberately kept explicit here (not just relying on subnet-router.nix's
|
|
# own setting) so the intent is clear at the build-type level.
|
|
services.tailscale.useRoutingFeatures = "server";
|
|
|
|
# Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
|
|
# Must also be approved in the Tailscale admin console (Machines → Edit route settings).
|
|
services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
|
|
|
|
networking.firewall = {
|
|
# Forwarded subnet-router traffic arrives on tailscale0 already
|
|
# tailscale-authenticated -- the firewall's normal per-port allow-list
|
|
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
|
|
# SNAT LAN traffic going into Tailscale so the remote peer sees it as
|
|
# coming from this router's Tailscale IP rather than a raw LAN IP.
|
|
# Without this, Tailscale drops forwarded packets whose source is not a
|
|
# recognised Tailscale address.
|
|
#
|
|
# We target POSTROUTING directly (always-existing built-in chain) rather
|
|
# than nixos-nat-post: extraCommands runs after the old nixos-nat-post is
|
|
# deleted but before the new one is created, so -A nixos-nat-post silently
|
|
# fails. The -C check makes the rule idempotent across firewall reloads.
|
|
extraCommands = ''
|
|
iptables -t nat -C POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || \
|
|
iptables -t nat -A POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
|
|
'';
|
|
extraStopCommands = ''
|
|
iptables -t nat -D POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
|
|
'';
|
|
};
|
|
}
|