start-os

mirror of https://github.com/Start9Labs/start-os.git synced 2026-03-31 12:33:40 +00:00

Files

Aiden McClelland f46cdc6ee5 fix: correct hairpin NAT rules and bind hairpin check to gateway interface

The POSTROUTING MASQUERADE rules in forward-port failed to handle two
hairpin scenarios:

1. Host-to-target hairpin (OUTPUT DNAT): when sip is a WAN IP (tunnel
   case), the old rule matched `-s sip` but the actual source of
   locally-originated packets is a local interface IP, not the WAN IP.
   Fix: use `-m addrtype --src-type LOCAL -m conntrack --ctorigdst sip`
   to match any local source while tying the rule to the specific sip.

2. Same-subnet self-hairpin (PREROUTING DNAT): when a WireGuard peer
   connects to itself via the tunnel's public IP, traffic is DNAT'd back
   to the peer. Without MASQUERADE the response takes a loopback shortcut,
   bypassing the tunnel server's conntrack and breaking NAT reversal.
   Fix: add `-s dip/dprefix -d dip` to masquerade same-subnet traffic,
   which also subsumes the old bridge_subnet rule.

Also bind the hairpin detection socket to the gateway interface and local
IP for consistency with the echoip client.

2026-03-30 11:52:53 -06:00

apt

chore: update dependencies and build scripts

2026-03-18 23:47:05 -06:00

dpkg-deps

feat: raspberry pi U-Boot + GPT + btrfs boot chain

2026-03-12 11:12:04 -06:00

env

Refactor/project structure (#3085 )

2025-12-22 13:39:38 -07:00

image-recipe

feat: add --arch flag to start-cli registry package download