This repository has no description
2configs.container-bridge: use iptables mode for Jool NAT64
Switch from --netfilter to --iptables mode so Jool only processes
container traffic. --netfilter mode intercepts all packets to
64:ff9b::/96, breaking upstream NAT64 (e.g., Android hotspot tethering).
author
lassulus
date
(Feb 3, 2026, 8:26 PM CET)
commit
7ff18a8c
7ff18a8c6973344bfd98abf09b9e5780af6aaedd
parent
a10ffa2a
a10ffa2a77b15a34e4bdbe1a5a1335a17fad8111
+14
-1
+14
-1
2configs/container-bridge.nix
+14
-1
2configs/container-bridge.nix
···
86
86
serviceConfig = {
87
87
Type = "oneshot";
88
88
RemainAfterExit = true;
89
-
ExecStart = "${pkgs.jool-cli}/bin/jool instance add --netfilter --pool6 64:ff9b::/96";
89
+
# Use --iptables mode so we can control which packets Jool processes
90
+
# (--netfilter mode intercepts ALL traffic to pool6, breaking upstream NAT64)
91
+
ExecStart = "${pkgs.jool-cli}/bin/jool instance add --iptables --pool6 64:ff9b::/96";
90
92
ExecStop = "${pkgs.jool-cli}/bin/jool instance remove";
91
93
};
92
94
};
···
181
183
v6 = true;
182
184
predicate = "-s fd00:c700::/64 -p tcp --dport 53";
183
185
target = "ACCEPT";
186
+
}
187
+
];
188
+
189
+
# Send only container traffic to Jool NAT64 (--iptables mode)
190
+
# Host traffic to 64:ff9b::/96 passes through to upstream NAT64 (e.g., Android hotspot)
191
+
krebs.iptables.tables.mangle.PREROUTING.rules = [
192
+
{
193
+
v4 = false;
194
+
v6 = true;
195
+
predicate = "-i ctr0 -d 64:ff9b::/96";
196
+
target = "JOOL";
184
197
}
185
198
];
186
199
}