From 1565c4cb5c7dca01a3ad2c985e75661baab1d0d8 Mon Sep 17 00:00:00 2001 From: randogoth Date: Tue, 21 Jul 2026 19:30:08 +0200 Subject: [PATCH] networking: loose reverse-path filtering for tailscale exit nodes Strict RPF (NixOS default) drops the encrypted return traffic of an active exit node: table 52's 'default dev tailscale0' makes the reverse-path lookup for packets arriving on the physical interface resolve to tailscale0, so they are dropped before Tailscale decrypts them (rx stays 0). Loose RPF still blocks spoofed/unroutable sources but removes the interface-match requirement, as recommended by Tailscale/NixOS for exit nodes and subnet routers. Co-Authored-By: Claude Opus 4.8 --- modules/system/networking.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/system/networking.nix b/modules/system/networking.nix index e718735..dbc1290 100644 --- a/modules/system/networking.nix +++ b/modules/system/networking.nix @@ -6,6 +6,7 @@ nftables.enable = true; firewall = { enable = true; + checkReversePath = "loose"; # exit nodes/subnet routes need loose RPF trustedInterfaces = [ "tailscale0" ]; allowedUDPPorts = [ config.services.tailscale.port ]; };