1565c4cb5c
Strict RPF (NixOS default) drops the encrypted return traffic of an active exit node: table 52's 'default dev tailscale0' makes the reverse-path lookup for packets arriving on the physical interface resolve to tailscale0, so they are dropped before Tailscale decrypts them (rx stays 0). Loose RPF still blocks spoofed/unroutable sources but removes the interface-match requirement, as recommended by Tailscale/NixOS for exit nodes and subnet routers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
564 B
Nix
21 lines
564 B
Nix
{ config, lib, ... }:
|
|
|
|
{
|
|
networking = {
|
|
useDHCP = lib.mkDefault true;
|
|
nftables.enable = true;
|
|
firewall = {
|
|
enable = true;
|
|
checkReversePath = "loose"; # exit nodes/subnet routes need loose RPF
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
allowedUDPPorts = [ config.services.tailscale.port ];
|
|
};
|
|
};
|
|
systemd = {
|
|
network.wait-online.enable = false;
|
|
services.tailscaled.serviceConfig.Environment = [
|
|
"TS_DEBUG_FIREWALL_MODE=nftables"
|
|
];
|
|
};
|
|
boot.initrd.systemd.network.wait-online.enable = false;
|
|
}
|