From 022c4553347441c478f66f1adc36a216a47e2bb8 Mon Sep 17 00:00:00 2001 From: alexz Date: Sun, 28 Dec 2025 13:14:29 +0000 Subject: [PATCH] fix(rego-tunnel): detect outbound iface for NAT --- apps/rego-tunnel/build/setup-network.sh | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/apps/rego-tunnel/build/setup-network.sh b/apps/rego-tunnel/build/setup-network.sh index 19e078f..2596f93 100644 --- a/apps/rego-tunnel/build/setup-network.sh +++ b/apps/rego-tunnel/build/setup-network.sh @@ -5,6 +5,13 @@ set -e +# Pick the outbound interface based on the container's default route. +# (In Docker, this is not always eth0 when multiple networks are attached.) +WAN_IF="$(ip route show default 0.0.0.0/0 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}')" +if [ -z "${WAN_IF}" ]; then + WAN_IF="eth0" +fi + # Create bridge if not exists if ! ip link show br0 &>/dev/null; then ip link add br0 type bridge @@ -25,7 +32,14 @@ fi echo 1 > /proc/sys/net/ipv4/ip_forward # Setup NAT/masquerade for outbound traffic from VM -iptables -t nat -C POSTROUTING -s 100.100.0.0/24 -o eth0 -j MASQUERADE 2>/dev/null || iptables -t nat -A POSTROUTING -s 100.100.0.0/24 -o eth0 -j MASQUERADE +iptables -t nat -C POSTROUTING -s 100.100.0.0/24 -o "$WAN_IF" -j MASQUERADE 2>/dev/null || \ + iptables -t nat -A POSTROUTING -s 100.100.0.0/24 -o "$WAN_IF" -j MASQUERADE + +# Ensure forwarding between the VM bridge and outbound interface +iptables -C FORWARD -i br0 -o "$WAN_IF" -j ACCEPT 2>/dev/null || \ + iptables -A FORWARD -i br0 -o "$WAN_IF" -j ACCEPT +iptables -C FORWARD -i "$WAN_IF" -o br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \ + iptables -A FORWARD -i "$WAN_IF" -o br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # Forward traffic destined for VPN networks to VM (10.35.33.230 = IBM i) # The VM will route this through its VPN tunnel @@ -39,3 +53,4 @@ echo "Network setup complete" echo "Bridge: br0 = 100.100.0.1/24" echo "TAP: tap0 attached to br0" echo "Route: 10.35.33.230 via 100.100.0.2 (VM)" +echo "Outbound interface: ${WAN_IF}"