diff options
Diffstat (limited to 'roles/gateway/templates/gateway-apply-rules.sh.j2')
| -rw-r--r-- | roles/gateway/templates/gateway-apply-rules.sh.j2 | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2 index 2e6bfb70..715f6b34 100644 --- a/roles/gateway/templates/gateway-apply-rules.sh.j2 +++ b/roles/gateway/templates/gateway-apply-rules.sh.j2 @@ -57,7 +57,7 @@ apply_direct_rules() { iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j ACCEPT iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT if [ -n "$GATEWAY_SUBNET_V6" ]; then - ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j MASQUERADE + # No MASQUERADE for IPv6: LAN devices have public SLAAC addresses, native routing applies ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |