From 11d3fccf7535686885b1c2bc5e833ec16d71ee11 Mon Sep 17 00:00:00 2001 From: Andreas Wrede Date: Sat, 17 Oct 2026 09:45:03 -0400 Subject: [PATCH] nftables: don't masquerade traffic leaving via ZeroTier Hosts on the van LAN were all NATed to the router's ZT address when reaching ZeroTier peers, hiding real source IPs from logs and source-based firewall rules. Exclude ztuga7c2kh alongside br0. Co-Authored-By: Claude Sonnet 5.5 --- README.md | 2 +- ap/nftables.conf | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index cbee2ec..0a4f9f3 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ This directory is the source of truth. The live system files live under `/etc`, | `21-van-br0.network` | `/etc/systemd/network/21-van-br0.network` | static `10.42.1.1/24` on `br0` (`ConfigureWithoutCarrier`) | | `22-van-lan.network` | `/etc/systemd/network/22-van-lan.network` | enslaves the wired LAN port `enx00e04c331140` to `br0` | | `van-ap-unmanaged.conf` | `/etc/NetworkManager/conf.d/van-ap-unmanaged.conf` | tells NM to leave the AP wlan **and** the wired LAN port alone | -| `nftables.conf` | `/etc/nftables.conf` | NAT: `masquerade ip saddr 10.42.1.0/24 oifname != br0` → follows whatever WAN is active | +| `nftables.conf` | `/etc/nftables.conf` | NAT: `masquerade ip saddr 10.42.1.0/24 oifname != { br0, ztuga7c2kh }` (ZeroTier keeps real source IPs) → follows whatever WAN is active | | `99-van-router.conf` | `/etc/sysctl.d/99-van-router.conf` | `net.ipv4.ip_forward=1` | | `regdomain.service` | `/etc/systemd/system/regdomain.service` | `iw reg set CA` at boot, before NetworkManager | | `rtw89.conf` | `/etc/modprobe.d/rtw89.conf` | 5GHz dongle: `disable_ps_mode=Y` (else AP drops beacon when idle) + blacklists in-kernel rtw89 so the out-of-tree morrownr/rtw89 dkms driver (installed separately, not by deploy.sh) loads instead — see gotchas below | diff --git a/ap/nftables.conf b/ap/nftables.conf index 37ad1b1..0fa3fc8 100755 --- a/ap/nftables.conf +++ b/ap/nftables.conf @@ -1,11 +1,13 @@ #!/usr/sbin/nft -f # van-router NAT — masquerade LAN out whatever the WAN of the moment is -# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G) +# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G). +# ZeroTier (ztuga7c2kh) is excluded too: it is a routed overlay, so van hosts keep +# their real 10.42.x source addresses there instead of all appearing as the van's ZT IP. table ip van_router_nat delete table ip van_router_nat table ip van_router_nat { chain postrouting { type nat hook postrouting priority srcnat; policy accept; - ip saddr @GATEWAY_NETWORK@ oifname != "br0" masquerade; + ip saddr @GATEWAY_NETWORK@ oifname != { "br0", "ztuga7c2kh" } masquerade; } }