Archived
beatzaplentyandClaude Sonnet 4.6
cda2132d6a
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s
Without SNAT on tailscale0, Tailscale drops forwarded packets from LAN source IPs (192.168.2.x) because they are not recognised Tailscale addresses. With networking.nat.externalInterface = "tailscale0", all traffic leaving through the Tailscale tunnel is masqueraded to the router's own Tailscale IP (100.x.x.x), making it indistinguishable from locally-originated traffic. Conntrack handles the return path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
33 lines
1.4 KiB
Nix
33 lines
1.4 KiB
Nix
{ vars, ... }:
|
|
|
|
{
|
|
imports = [
|
|
../tailscale/subnet-router.nix
|
|
];
|
|
|
|
# "server", not "both": this build type advertises LAN subnet routes but
|
|
# doesn't use another tailscale exit node itself, so it doesn't need the
|
|
# "client"-side loose reverse-path filtering that "both" would also enable.
|
|
# Deliberately kept explicit here (not just relying on subnet-router.nix's
|
|
# own setting) so the intent is clear at the build-type level.
|
|
services.tailscale.useRoutingFeatures = "server";
|
|
|
|
# Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
|
|
# Must also be approved in the Tailscale admin console (Machines → Edit route settings).
|
|
services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
|
|
|
|
# Forwarded subnet-router traffic arrives on tailscale0 already
|
|
# tailscale-authenticated -- the firewall's normal per-port allow-list
|
|
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
|
|
# SNAT traffic from LAN machines going out through Tailscale so the remote
|
|
# peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
|
|
# than a raw LAN IP. Without this, Tailscale drops the forwarded packets
|
|
# because the source is not a recognised Tailscale address.
|
|
networking.nat = {
|
|
enable = true;
|
|
externalInterface = "tailscale0";
|
|
};
|
|
}
|