feat(mesh): advertise exit nodes at all three sites (SNAT re-enabled); usage + tradeoff documented

2026-09-06 00:09:43 -07:00
parent 815c283e44
commit b846a7c870
2 changed files with 30 additions and 0 deletions
@@ -275,3 +275,24 @@ NH3↔colo, NH3↔ESH, colo↔ESH. FortiGate mgmt via WAN SSH OPEN; ana-wg WG fa
 State: **Site Magic disabled (UI); both IPsec tunnels dormant (UDM ends disabled, config
 retained); headscale is the sole active site-to-site transport.** Tunnels re-enablable for
 backup (Site Magic in UI; IPsec by flipping the UDM objects enabled=true). Goal met.
+
+## 2026-09-06 — exit nodes advertised (multi-location egress proxy)
+
+All three routers advertise + serve exit nodes; approved on headscale (each shows
+`0.0.0.0/0` + `::/0` Serving). Clients see three: `nh3-scale` (100.64.0.1, NH3 residential
+egress 70.230.226.88), `esh-scale` (100.64.0.2, ESH 23.164.40.160), `ana-scale`
+(100.64.0.3, colo 38.120.12.42).
+
+⚠ **Design reversal:** exit nodes REQUIRE SNAT, so `--snat-subnet-routes` was flipped back to
+**true** (NoSNAT=false) on all three routers — this undoes the earlier source-preserving
+choice. Consequence: cross-site subnet-route traffic now appears to come from the local
+router's IP, not the original host. Site-to-site re-verified OK after the flip. If per-host
+source visibility is later needed, the alternative is NoSNAT + a manual selective masquerade
+rule (`-s 100.64.0.0/10 ! -d 10.0.0.0/8 -o eth0 -j MASQUERADE`) on each router, made
+persistent — not done.
+
+**Use one from a client:** `tailscale set --exit-node=nh3-scale` (or `esh-scale` /
+`ana-scale`), `--exit-node=` to clear. A node that itself advertises an exit node cannot
+consume one (so the routers can't be used to test egress; use the laptop/iPad).
+Replaces the nh3-dev SOCKS5 residential-egress proxy — retire that once confirmed on real
+clients.