1565c4cb5c
Strict RPF (NixOS default) drops the encrypted return traffic of an active exit node: table 52's 'default dev tailscale0' makes the reverse-path lookup for packets arriving on the physical interface resolve to tailscale0, so they are dropped before Tailscale decrypts them (rx stays 0). Loose RPF still blocks spoofed/unroutable sources but removes the interface-match requirement, as recommended by Tailscale/NixOS for exit nodes and subnet routers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| desktop | ||
| development | ||
| profile | ||
| system | ||
| users | ||