WIP: router: tailscale

modules/router/firewall.nix

@@ -15,6 +15,11 @@ let
         ${ifs.lan50.name},
         ${ifs.wg0.name},
     }
+    # Tailscale is its own zone, since tailnet traffic is already filtered by tailscale ACLs
+    # and needs some special handling (exit node NAT with CGNAT/ULA addrs)
+    define ZONE_TAILSCALE_IFS = { ${ifs.ts0.name} }
+    define TAILSCALE_NET4 = ${ifs.ts0.net4}
+    define TAILSCALE_NET6 = ${ifs.ts0.net6}
     define OPNSENSE_NET6 = ${vars.extra.opnsense.net6}
     define ZONE_LAN_EXTRA_NET6 = {
         # TODO: reevaluate this statement
@@ -80,6 +85,8 @@ in
 
           # Masquerade LAN addrs
           oifname $ZONE_WAN_IFS ip saddr $RFC1918 masquerade
+          # Masquerade tailnet addrs (tailscale exit node)
+          oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 masquerade
       }
     '';
   };
@@ -97,12 +104,28 @@ in
     '';
   };
 
+  # IPv6 masquerading for tailnet addrs only (tailscale exit node)
+  # Tailscale only assigns ULAs from $TAILSCALE_NET6, so NAT is unavoidable here
+  networking.nftables.tables.nat6_tailscale = {
+    family = "ip6";
+    content = ''
+      ${nftIdentifiers}
+      chain postrouting {
+          type nat hook postrouting priority srcnat; policy accept;
+          oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 masquerade
+      }
+    '';
+  };
+
   networking.nftables.tables.firewall = {
     family = "inet";
     content = ''
       ${nftIdentifiers}
       define ALLOWED_TCP_PORTS = { ssh }
-      define ALLOWED_UDP_PORTS = { ${toString vars.ifs.wg0.listenPort} }
+      define ALLOWED_UDP_PORTS = {
+          ${toString vars.ifs.wg0.listenPort},
+          ${toString vars.ifs.ts0.listenPort},  # tailscale direct connections
+      }
       define ALLOWED_TCP_LAN_PORTS = { ssh, https }
       define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
       set port_forward_v6 {
@@ -161,6 +184,8 @@ in
           # iifname $ZONE_LAN_IFS accept
           iifname $ZONE_LAN_IFS jump zone_lan_input
           ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_input
+          # Tailscale zone input rules
+          iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_input
 
           # log
       }
@@ -176,6 +201,8 @@ in
           # LAN zone forward rules
           iifname $ZONE_LAN_IFS jump zone_lan_forward
           ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_forward
+          # Tailscale zone forward rules
+          iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_forward
       }
 
       chain zone_wan_input {
@@ -215,6 +242,23 @@ in
 
           # Allow traffic between LANs
           oifname $ZONE_LAN_IFS accept
+
+          # Allow LAN to reach tailnet (no SNAT, tailnet peers see real LAN addrs)
+          oifname $ZONE_TAILSCALE_IFS accept
+      }
+
+      chain zone_tailscale_input {
+          # Tailnet access is restricted by tailscale ACLs, treat like LAN
+          jump zone_lan_input
+      }
+
+      chain zone_tailscale_forward {
+          # Subnet router: allow tailnet to LANs (advertised routes)
+          oifname $ZONE_LAN_IFS accept
+
+          # Exit node: allow tailnet to WAN (masqueraded in nat4 / nat6_tailscale)
+          oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 accept
+          oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 accept
       }
 
       chain output {