andreas/vanlink
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nftables: don't masquerade traffic leaving via ZeroTier

Browse Source 
Hosts on the van LAN were all NATed to the router's ZT address when
reaching ZeroTier peers, hiding real source IPs from logs and
source-based firewall rules. Exclude ztuga7c2kh alongside br0.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
andreas
2026-10-17 09:45:03 -04:00
co-authored by Claude Sonnet 5.5
parent d896fc908b
commit 11d3fccf75
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -114,7 +114,7 @@ This directory is the source of truth. The live system files live under `/etc`,
| `21-van-br0.network` | `/etc/systemd/network/21-van-br0.network` | static `10.42.1.1/24` on `br0` (`ConfigureWithoutCarrier`) |
| `22-van-lan.network` | `/etc/systemd/network/22-van-lan.network` | enslaves the wired LAN port `enx00e04c331140` to `br0` |
| `van-ap-unmanaged.conf` | `/etc/NetworkManager/conf.d/van-ap-unmanaged.conf` | tells NM to leave the AP wlan **and** the wired LAN port alone |
| `nftables.conf` | `/etc/nftables.conf` | NAT: `masquerade ip saddr 10.42.1.0/24 oifname != br0` → follows whatever WAN is active |
| `nftables.conf` | `/etc/nftables.conf` | NAT: `masquerade ip saddr 10.42.1.0/24 oifname != { br0, ztuga7c2kh }` (ZeroTier keeps real source IPs) → follows whatever WAN is active |
| `99-van-router.conf` | `/etc/sysctl.d/99-van-router.conf` | `net.ipv4.ip_forward=1` |
| `regdomain.service` | `/etc/systemd/system/regdomain.service` | `iw reg set CA` at boot, before NetworkManager |
| `rtw89.conf` | `/etc/modprobe.d/rtw89.conf` | 5GHz dongle: `disable_ps_mode=Y` (else AP drops beacon when idle) + blacklists in-kernel rtw89 so the out-of-tree morrownr/rtw89 dkms driver (installed separately, not by deploy.sh) loads instead — see gotchas below |
ap/nftables.conf
+4 -2
View File
@@ -1,11 +1,13 @@
#!/usr/sbin/nft -f
# van-router NAT — masquerade LAN out whatever the WAN of the moment is
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G)
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G).
# ZeroTier (ztuga7c2kh) is excluded too: it is a routed overlay, so van hosts keep
# their real 10.42.x source addresses there instead of all appearing as the van's ZT IP.
table ip van_router_nat
delete table ip van_router_nat
table ip van_router_nat {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ip saddr @GATEWAY_NETWORK@ oifname != "br0" masquerade;
ip saddr @GATEWAY_NETWORK@ oifname != { "br0", "ztuga7c2kh" } masquerade;
}
}