Mike Jensen c9c2113a6e util/linuxfw: match egress DNAT tun exemption on input interface (#21228) ...

DNATNonTailscaleTraffic in the nftables runner installs its exemption rule in the nat PREROUTING chain but matches on meta `oifname`, which routing has  not yet selected at that hook. The exemption was therefore always true, so  tailnet-arrived packets to the proxy's own address were DNATed to the egress target, forwarded back out tailscale0 and SNATed to the proxy's IP. This let any peer allowed to reach the proxy reach the target on all ports, bypassing tailnet ACLs.

This change matches on meta `iifname` instead, so traffic that arrived on the tun interface is exempt from the DNAT, mirroring the iptables runner's `"!" -i <tun>` semantics. Tailnet-originated packets now fall through to local delivery where the node's own ACL filters apply.

Reported by @KR-Ravindra

Fixes tailscale/corp#47962

Change-Id: I1861a348b792ad4ae8e295447078a302f99d7d77

Signed-off-by: Mike Jensen <mikej@tailscale.com>

2026-09-14 08:51:34 -06:00

..

detector.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

fake_netfilter.go

go.mod,wgengine/magicsock: pull wireguard-go fix for roaming endpoints (#20118)

2026-06-12 10:50:35 -07:00

fake.go

util/linuxfw: fix nil pointer panic in connmark rules without IPv6 (#18946)

2026-03-10 15:19:15 -04:00

helpers.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

iptables_disabled.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

iptables_for_svcs_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

iptables_for_svcs.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

iptables_runner_test.go

wgengine/router/osrouter,util/linuxfw: remove orphaned tailnet addrs (#20199)

2026-06-24 13:41:36 -07:00

iptables_runner.go

wgengine/router/osrouter,util/linuxfw: remove orphaned tailnet addrs (#20199)

2026-06-24 13:41:36 -07:00

iptables.go

all: use Go 1.26 things, run most gofix modernizers

2026-03-06 13:32:03 -08:00

linuxfw.go

util/linuxfw: fix nftables endianness and add connmark conditional check (#19725)

2026-05-14 09:11:24 -04:00

nftables_for_svcs_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

nftables_for_svcs.go

all: use Go 1.26 things, run most gofix modernizers

2026-03-06 13:32:03 -08:00

nftables_runner_test.go

util/linuxfw: match egress DNAT tun exemption on input interface (#21228)

2026-09-14 08:51:34 -06:00

nftables_runner.go

util/linuxfw: match egress DNAT tun exemption on input interface (#21228)

2026-09-14 08:51:34 -06:00

nftables_types.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

nftables.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00