randogoth/nanuqsaurus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

networking: loose reverse-path filtering for tailscale exit nodes

Browse source 
Strict RPF (NixOS default) drops the encrypted return traffic of an active
exit node: table 52's 'default dev tailscale0' makes the reverse-path lookup
for packets arriving on the physical interface resolve to tailscale0, so they
are dropped before Tailscale decrypts them (rx stays 0). Loose RPF still blocks
spoofed/unroutable sources but removes the interface-match requirement, as
recommended by Tailscale/NixOS for exit nodes and subnet routers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
randogoth 2026-07-21 19:30:08 +02:00
parent b7bb444f3d
commit 1565c4cb5c
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/system/networking.nix
View file

@ -6,6 +6,7 @@
nftables.enable = true; nftables.enable = true;
firewall = { firewall = {
enable = true; enable = true;
checkReversePath = "loose"; # exit nodes/subnet routes need loose RPF
trustedInterfaces = [ "tailscale0" ]; trustedInterfaces = [ "tailscale0" ];
allowedUDPPorts = [ config.services.tailscale.port ]; allowedUDPPorts = [ config.services.tailscale.port ];
}; };