From b6aeee483f45f5e69f050b2d287d06c8eaf0ca40 Mon Sep 17 00:00:00 2001 From: Ahmed AbdelHalim Date: Thu, 9 Jul 2026 15:38:15 +0200 Subject: Fix IPv6 direct mode routing for LAN clients - Remove static network_ipv6_gateway from LAN hosts so they pick up Pi's radvd RA (pref high) instead of FritzBox (pref low) - Add missing ip6tables FORWARD ACCEPT rule for new connections in direct mode (only ESTABLISHED was present, blocking new flows) - Flush ip6tables nat POSTROUTING table on clear instead of fragile per-rule -D deletion to prevent stale rule accumulation --- roles/gateway/templates/gateway-apply-rules.sh.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'roles/gateway') diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2 index daddb180..0cbdd67a 100644 --- a/roles/gateway/templates/gateway-apply-rules.sh.j2 +++ b/roles/gateway/templates/gateway-apply-rules.sh.j2 @@ -27,8 +27,7 @@ clear_rules() { iptables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true if [ -n "$GATEWAY_SUBNET_V6" ]; then ip6tables -F FORWARD 2>/dev/null || true - ip6tables -t nat -D POSTROUTING -o wg+ -j MASQUERADE 2>/dev/null || true - ip6tables -t nat -D POSTROUTING -o "$GATEWAY_INTERFACE" -j MASQUERADE 2>/dev/null || true + ip6tables -t nat -F POSTROUTING 2>/dev/null || true ip6tables -D OUTPUT -o wg+ -j ACCEPT 2>/dev/null || true ip6tables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true fi @@ -59,6 +58,7 @@ apply_direct_rules() { if [ -n "$GATEWAY_SUBNET_V6" ]; then ip6tables -t nat -A POSTROUTING -o "$GATEWAY_INTERFACE" -j MASQUERADE ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT + ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT fi log_message "Direct mode rules applied - normal routing active" -- cgit v1.2.3