Mike O'Driscoll 33342aec32

The connmark save/restore rules in mangle/PREROUTING restore the Tailscale bypass fwmark (0x80000) onto reply packets so that rp_filter's reverse-path check routes through the main table instead of table 52. However, the kernel only uses the packet's fwmark during the rp_filter lookup when net.ipv4.conf.all.src_valid_mark=1. (#19537) ...

On systems where this sysctl defaults to 0 (including GCP VMs), rp_filter performs its lookup with fwmark=0, hits rule 5270 then table 52 and routes to 0.0.0.0/0 dev tailscale0, and drops every reply packet arriving on the physical interface as a martian. This breaks all connectivity when using an exit node: DERP, DNS, control plane, and even the cloud metadata service.

Set src_valid_mark=1 when enabling the connmark rules so the rp_filter workaround actually works in these cases.

Updates #3310
Updates tailscale/corp#37846

Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>

2026-04-27 13:52:45 -04:00

..

osrouter

The connmark save/restore rules in mangle/PREROUTING restore the Tailscale bypass fwmark (0x80000) onto reply packets so that rp_filter's reverse-path check routes through the main table instead of table 52. However, the kernel only uses the packet's fwmark during the rp_filter lookup when net.ipv4.conf.all.src_valid_mark=1. (#19537)

2026-04-27 13:52:45 -04:00

callback.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

consolidating_router_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

consolidating_router.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

router_fake.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

router_test.go

util/linuxfw,wgengine/router: allow incoming CGNAT range traffic with nodeattr

2026-04-14 16:45:06 -04:00

router.go

util/linuxfw,wgengine/router: allow incoming CGNAT range traffic with nodeattr

2026-04-14 16:45:06 -04:00