all repos — nixfiles @ 26db73316e573d8d468f3bb18adf8a3d93c5cd2b

System and user configuration, managed by nix and home-manager

nanopi: set up tailscale subnet routing

Alan Pearce
commit

26db73316e573d8d468f3bb18adf8a3d93c5cd2b

parent

3023e9e0195e548a9eabcf42d7248ba59853156d

1 file changed, 18 insertions(+), 1 deletion(-)

jump to
M system/nanopi.nixsystem/nanopi.nix
@@ -152,6 +152,8 @@ };
extraForwardRules = '' iifname { "wan0", "wlan0", "wwan0" } oifname { "lan1", "lan2", "bridge0" } icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, mld-listener-query, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept iifname { "lan1", "lan2", "bridge0" } oifname { "wan0", "wlan0", "wwan0" } accept + iifname "tailscale0" oifname "bridge0" accept + iifname "bridge0" oifname "tailscale0" accept ''; }; nftables = {
@@ -456,6 +458,9 @@ ];
interface = [ "bridge0" ]; + no-dhcp-interface = [ + "tailscale0" + ]; # auth-zone = "lan,wan0"; # auth-server = [ # "nanopi.alanpearce.eu,wan0"
@@ -513,7 +518,7 @@ systemd.services.dnsmasq.wants = [ "network-online.target" ];
services.networkd-dispatcher = { # broken? - enable = false; + enable = true; rules = { update-home-address = { onState = [ "configured" "configuring" ];
@@ -526,6 +531,18 @@ then
systemctl start dynamic-dns-update.service fi exit 0 + ''; + }; + tailscale-subnet-router-optimisation = { + onState = [ "routable" ]; + script = '' + #!${pkgs.runtimeShell} + set -eu + + if [[ $IFACE == "wan0" && $OperationalState == "routable" ]] + then + ${pkgs.ethtool}/bin/ethtool -K $IFACE rx-udp-gro-forwarding on rx-gro-list off + fi ''; }; };