andreas/vanlink
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nftables: don't masquerade traffic leaving via ZeroTier

Browse Source 
Hosts on the van LAN were all NATed to the router's ZT address when
reaching ZeroTier peers, hiding real source IPs from logs and
source-based firewall rules. Exclude ztuga7c2kh alongside br0.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
andreas
2026-10-17 09:45:03 -04:00
co-authored by Claude Sonnet 5.5
parent d896fc908b
commit 11d3fccf75
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ap/nftables.conf
+4 -2
View File
@@ -1,11 +1,13 @@
#!/usr/sbin/nft -f
# van-router NAT — masquerade LAN out whatever the WAN of the moment is
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G)
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G).
# ZeroTier (ztuga7c2kh) is excluded too: it is a routed overlay, so van hosts keep
# their real 10.42.x source addresses there instead of all appearing as the van's ZT IP.
table ip van_router_nat
delete table ip van_router_nat
table ip van_router_nat {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ip saddr @GATEWAY_NETWORK@ oifname != "br0" masquerade;
ip saddr @GATEWAY_NETWORK@ oifname != { "br0", "ztuga7c2kh" } masquerade;
}
}