start-os

mirror of https://github.com/Start9Labs/start-os.git synced 2026-03-31 12:33:40 +00:00

Files

Aiden McClelland f46cdc6ee5 fix: correct hairpin NAT rules and bind hairpin check to gateway interface

The POSTROUTING MASQUERADE rules in forward-port failed to handle two
hairpin scenarios:

1. Host-to-target hairpin (OUTPUT DNAT): when sip is a WAN IP (tunnel
   case), the old rule matched `-s sip` but the actual source of
   locally-originated packets is a local interface IP, not the WAN IP.
   Fix: use `-m addrtype --src-type LOCAL -m conntrack --ctorigdst sip`
   to match any local source while tying the rule to the specific sip.

2. Same-subnet self-hairpin (PREROUTING DNAT): when a WireGuard peer
   connects to itself via the tunnel's public IP, traffic is DNAT'd back
   to the peer. Without MASQUERADE the response takes a loopback shortcut,
   bypassing the tunnel server's conntrack and breaking NAT reversal.
   Fix: add `-s dip/dprefix -d dip` to masquerade same-subnet traffic,
   which also subsumes the old bridge_subnet rule.

Also bind the hairpin detection socket to the gateway interface and local
IP for consistency with the echoip client.

2026-03-30 11:52:53 -06:00

add-apt-sources

More svc effect handlers (#2610 )

2024-05-10 19:20:24 +00:00

chroot-and-upgrade

fix: use tmpfs and lazy unmounts in chroot-and-upgrade

2026-03-19 01:07:23 -06:00

enable-kiosk

Feature/start tunnel (#3037 )

2025-11-07 10:12:05 +00:00

fake-apt

consolidate and streamline build (#2469 )