mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-15 07:20:36 -04:00
Mike Jensen
c9c2113a6e
DNATNonTailscaleTraffic in the nftables runner installs its exemption rule in the nat PREROUTING chain but matches on meta `oifname`, which routing has not yet selected at that hook. The exemption was therefore always true, so tailnet-arrived packets to the proxy's own address were DNATed to the egress target, forwarded back out tailscale0 and SNATed to the proxy's IP. This let any peer allowed to reach the proxy reach the target on all ports, bypassing tailnet ACLs. This change matches on meta `iifname` instead, so traffic that arrived on the tun interface is exempt from the DNAT, mirroring the iptables runner's `"!" -i <tun>` semantics. Tailnet-originated packets now fall through to local delivery where the node's own ACL filters apply. Reported by @KR-Ravindra Fixes tailscale/corp#47962 Change-Id: I1861a348b792ad4ae8e295447078a302f99d7d77 Signed-off-by: Mike Jensen <mikej@tailscale.com>