feat(mesh): selective masquerade — exit nodes AND site-to-site source preservation both work

2026-09-06 00:16:18 -07:00
parent b846a7c870
commit 7ce398f069
2 changed files with 20 additions and 3 deletions
@@ -296,3 +296,20 @@ persistent — not done.
 consume one (so the routers can't be used to test egress; use the laptop/iPad).
 Replaces the nh3-dev SOCKS5 residential-egress proxy — retire that once confirmed on real
 clients.
+
+## 2026-09-06 — selective masquerade applied (supersedes the SNAT-reversal note above)
+
+Restored `--snat-subnet-routes=false` (NoSNAT=true) on all three routers AND added a
+persistent selective-masquerade rule, so BOTH properties now hold: exit nodes work (internet
+egress masqueraded) and site-to-site keeps the original host source.
+
+Per router: `/usr/local/sbin/mesh-exit-masq.sh` + `mesh-exit-masq.service` (oneshot, After
+tailscaled, enabled). Rule = a `MESH-EXIT` nat chain jumped from POSTROUTING for
+`-s 100.64.0.0/10 -o eth0`: RETURN for 10/8, 172.16/12, 192.168/16, 100.64/10 (source
+preserved), MASQUERADE the rest (real internet). ⚠ nf_tables iptables forbids multiple `-d`
+in one rule — hence the chain-with-RETURNs shape, not a single `! -d ... ! -d ...` rule.
+
+Verified: nh3-docker→ana-docker seen at colo as **10.100.50.40** (real host, preserved);
+nh3-dev via ana-scale exit → egress **38.120.12.42** (colo), via nh3-scale → 70.230.226.88
+(NH3). Persistent across CT reboot via the systemd unit. `tailscale set --operator` NOT set;
+drive nh3-dev's tailscale via `ssh infra-ops@10.100.10.50 sudo tailscale ...`.