andreasandClaude Sonnet 5.5
11d3fccf75
Hosts on the van LAN were all NATed to the router's ZT address when reaching ZeroTier peers, hiding real source IPs from logs and source-based firewall rules. Exclude ztuga7c2kh alongside br0. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
14 lines
607 B
Plaintext
Executable File
14 lines
607 B
Plaintext
Executable File
#!/usr/sbin/nft -f
|
|
# van-router NAT — masquerade LAN out whatever the WAN of the moment is
|
|
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G).
|
|
# ZeroTier (ztuga7c2kh) is excluded too: it is a routed overlay, so van hosts keep
|
|
# their real 10.42.x source addresses there instead of all appearing as the van's ZT IP.
|
|
table ip van_router_nat
|
|
delete table ip van_router_nat
|
|
table ip van_router_nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
ip saddr @GATEWAY_NETWORK@ oifname != { "br0", "ztuga7c2kh" } masquerade;
|
|
}
|
|
}
|