Archived
beatzaplentyandClaude Sonnet 4.6
781b1d324e
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m34s
networking.nat.externalInterface without internalInterfaces creates the nixos-nat-post chain but inserts no MASQUERADE rule into it — confirmed by inspecting the live firewall-start script on the deployed host. Add the rule explicitly via firewall.extraCommands targeting nixos-nat-post, scoped to LAN source traffic (vars.lanCidr) going out tailscale0. extraStopCommands removes it on firewall stop. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
45 lines
1.9 KiB
Nix
45 lines
1.9 KiB
Nix
{ vars, ... }:
|
|
|
|
{
|
|
imports = [
|
|
../tailscale/subnet-router.nix
|
|
];
|
|
|
|
# "server", not "both": this build type advertises LAN subnet routes but
|
|
# doesn't use another tailscale exit node itself, so it doesn't need the
|
|
# "client"-side loose reverse-path filtering that "both" would also enable.
|
|
# Deliberately kept explicit here (not just relying on subnet-router.nix's
|
|
# own setting) so the intent is clear at the build-type level.
|
|
services.tailscale.useRoutingFeatures = "server";
|
|
|
|
# Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
|
|
# Must also be approved in the Tailscale admin console (Machines → Edit route settings).
|
|
services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
|
|
|
|
networking = {
|
|
# SNAT traffic from LAN machines going out through Tailscale so the remote
|
|
# peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
|
|
# than a raw LAN IP. Without this, Tailscale drops the forwarded packets
|
|
# because the source is not a recognised Tailscale address.
|
|
#
|
|
# networking.nat.externalInterface alone does not insert a MASQUERADE rule
|
|
# (it only does so when internalInterfaces is also set). We use
|
|
# extraCommands to add the rule into the nixos-nat-post chain that
|
|
# networking.nat.enable creates, and extraStopCommands to clean it up.
|
|
nat.enable = true;
|
|
|
|
firewall = {
|
|
# Forwarded subnet-router traffic arrives on tailscale0 already
|
|
# tailscale-authenticated -- the firewall's normal per-port allow-list
|
|
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
extraCommands = ''
|
|
iptables -t nat -A nixos-nat-post -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
|
|
'';
|
|
extraStopCommands = ''
|
|
iptables -t nat -D nixos-nat-post -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
|
|
'';
|
|
};
|
|
};
|
|
}
|