thakares/nx9-wg
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: include selected networks in dataplane NAT

Browse Source
This commit is contained in:
thakares committed 2026-09-01 18:21:58 +05:30
1 parent 5599e1b5c8
commit 34227efd2b
10 files changed
+545 -54
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/NFTABLES.md
+2 -1
View File
@@ -66,8 +66,9 @@ table inet nx9_wg {
Outbound NAT masquerading is dynamically scoped exclusively to managed WireGuard client subnets:
1. **Subnet Deduplication**: Overlapping subnets are merged to prevent redundant rules.
2. **Interface Exclusion**: Traffic routing back into the WireGuard interface (`oifname != "wg0"`) is not masqueraded to preserve true source IPs for site-to-site tunnels.
2. **Interface Exclusion**: Traffic routing back into the WireGuard interface (`oifname != "wg*"`) is not masqueraded to preserve true source IPs for site-to-site tunnels.
3. **No Catch-All Masquerade**: `nx9-wg` never creates a catch-all `masquerade` rule that affects non-WireGuard traffic on the host.
4. **Interface and Subnet Network CIDRs**: Masquerade sources include each enabled Interface address CIDR and each enabled Subnet Network CIDR. A peer allocated from a selected Network (for example outside the WireGuard interface `/24`) is masqueraded from that Network CIDR; the Interface address itself is unchanged.
---