andreas/vanlink
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ap: bridge wired LAN port (enx00e04c331140) into br0 with the AP

Browse Source 
Add a wired LAN port on the same 10.42.0.0/24 segment as VanLink WiFi by
bridging both into br0. The gateway IP, dnsmasq, and NAT move off the wlan name
onto br0; hostapd (not networkd) enslaves the wlan via bridge=br0, since a
station-mode wlan can't be bridged until it's in AP mode. NM leaves the wired
port unmanaged so networkd owns it. Failover/Starlink (enxd8ec5eeb3512)
untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Andreas Wrede
2026-06-30 13:46:03 -04:00
co-authored by Claude Opus 4.8
parent c93997c06d
commit 830ef52641
10 changed files with 84 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ap/nftables.conf
+17 -2
View File
@@ -1,11 +1,26 @@
#!/usr/sbin/nft -f
# van-router NAT — masquerade LAN out whatever the WAN of the moment is
# (anything that is NOT the AP interface: ethernet/Starlink, wifi, future 4G)
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G)
table ip van_router_nat
delete table ip van_router_nat
table ip van_router_nat {
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
# Expose the Home Assistant VM (on libvirt's NAT net, 192.168.122.50) on the
# router's own LAN IP, so VanLink clients reach it at http://10.42.0.1:8123.
# The matching FORWARD accept lives in iptables (re-applied by the libvirt
# /etc/libvirt/hooks/network hook), since libvirt's reject is in that chain.
ip daddr 10.42.0.1 tcp dport 8123 dnat to 192.168.122.50:8123
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ip saddr 10.42.0.0/24 oifname != "wlxc83a35a4ee55" masquerade
ip saddr 10.42.0.0/24 oifname != "br0" masquerade
# ZeroTier clients reaching the HA VM via the 10.42.0.1:8123 DNAT: masquerade
# them onto virbr0 so HA sees the router (192.168.122.1) and the reply path is
# symmetric, exactly like VanLink clients. Matched by ZT ingress interface so it
# covers direct members (192.168.196.x) AND the LAN subnets routed in behind other
# ZT nodes (192.168.0/6/8/10/13.x). Scoped to virbr0 so ZT<->ZT and ZT->WAN are
# untouched.
iifname "ztuga7c2kh" oifname "virbr0" masquerade
}
}