Andreas WredeandClaude Opus 4.8
830ef52641
Add a wired LAN port on the same 10.42.0.0/24 segment as VanLink WiFi by bridging both into br0. The gateway IP, dnsmasq, and NAT move off the wlan name onto br0; hostapd (not networkd) enslaves the wlan via bridge=br0, since a station-mode wlan can't be bridged until it's in AP mode. NM leaves the wired port unmanaged so networkd owns it. Failover/Starlink (enxd8ec5eeb3512) untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
1.4 KiB
Plaintext
Executable File
27 lines
1.4 KiB
Plaintext
Executable File
#!/usr/sbin/nft -f
|
|
# van-router NAT — masquerade LAN out whatever the WAN of the moment is
|
|
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G)
|
|
table ip van_router_nat
|
|
delete table ip van_router_nat
|
|
table ip van_router_nat {
|
|
chain prerouting {
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
# Expose the Home Assistant VM (on libvirt's NAT net, 192.168.122.50) on the
|
|
# router's own LAN IP, so VanLink clients reach it at http://10.42.0.1:8123.
|
|
# The matching FORWARD accept lives in iptables (re-applied by the libvirt
|
|
# /etc/libvirt/hooks/network hook), since libvirt's reject is in that chain.
|
|
ip daddr 10.42.0.1 tcp dport 8123 dnat to 192.168.122.50:8123
|
|
}
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
ip saddr 10.42.0.0/24 oifname != "br0" masquerade
|
|
# ZeroTier clients reaching the HA VM via the 10.42.0.1:8123 DNAT: masquerade
|
|
# them onto virbr0 so HA sees the router (192.168.122.1) and the reply path is
|
|
# symmetric, exactly like VanLink clients. Matched by ZT ingress interface so it
|
|
# covers direct members (192.168.196.x) AND the LAN subnets routed in behind other
|
|
# ZT nodes (192.168.0/6/8/10/13.x). Scoped to virbr0 so ZT<->ZT and ZT->WAN are
|
|
# untouched.
|
|
iifname "ztuga7c2kh" oifname "virbr0" masquerade
|
|
}
|
|
}
|