From c2f7417e4f76cd4230c950a7a91f068b3f21d76e Mon Sep 17 00:00:00 2001 From: Ahmed AbdelHalim Date: Tue, 7 Jul 2026 12:28:16 +0200 Subject: Enable ipv6 on the rpi --- roles/gateway/templates/gateway-apply-rules.sh.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'roles/gateway') diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2 index 2e6bfb70..715f6b34 100644 --- a/roles/gateway/templates/gateway-apply-rules.sh.j2 +++ b/roles/gateway/templates/gateway-apply-rules.sh.j2 @@ -57,7 +57,7 @@ apply_direct_rules() { iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j ACCEPT iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT if [ -n "$GATEWAY_SUBNET_V6" ]; then - ip6tables -t nat -A POSTROUTING -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j MASQUERADE + # No MASQUERADE for IPv6: LAN devices have public SLAAC addresses, native routing applies ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -o "$GATEWAY_INTERFACE" -j ACCEPT ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -- cgit v1.2.3