This repository has no description
container-bridge: remove redundant IPv4 MASQUERADE rule
The rule was masquerading ALL outgoing IPv4 traffic, which caused
TCP connections to fail while ICMP worked. Jool already does SNAT
with the pool4 address for NAT64 traffic, so no separate masquerade
is needed.
author
lassulus
date
(Jan 20, 2026, 7:29 PM CET)
commit
2b650229
2b650229134e88e84b3cf2aedf5749e7bf533dfc
parent
af1ae007
af1ae007d9e3bfcbea9882926ee46752ae3b040e
+1
-7
+1
-7
2configs/container-bridge.nix
+1
-7
2configs/container-bridge.nix
···
158
158
];
159
159
160
160
# NAT66 - masquerade container IPv6 to reach public IPv6 (when host has IPv6)
161
-
# NAT44 - masquerade NAT64 translated IPv4 packets (exclude localhost!)
161
+
# Note: No IPv4 MASQUERADE needed - jool does SNAT with pool4 address for NAT64 traffic
162
162
krebs.iptables.tables.nat.POSTROUTING.rules = [
163
163
{
164
164
v4 = false;
···
166
166
predicate = "-s fd00:c700::/64 ! -d fd00:c700::/64";
167
167
target = "MASQUERADE";
168
168
}
169
-
{
170
-
v4 = true;
171
-
v6 = false;
172
-
predicate = "! -d 127.0.0.0/8 ! -o lo";
173
-
target = "MASQUERADE";
174
-
} # Don't masquerade localhost
175
169
];
176
170
177
171
# Allow containers to reach host's DNS64 resolver (IPv6 only)