tailscale / tailscale/tailscale
wgengine/router: on Linux, stop trying to detect IPv6 NAT support
- Dominant language
- Go
- Stars
- 36.5k
- Forks
- 3.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 123
Description
We currently try to detect whether the Linux kernel we're on supports IPv6 NAT.
But the mechanism we use (`func supportsV6NAT` checking `/proc/net/ip6_tables_names`) doesn't work on systems using nftables (#4459). A quick incremental improvement fix for 1.24.0 (#4461) made that also detect whether the `ip6table_nat` module is loadable/loaded, but such games are silly, as @danderson noted on #4461.
Instead, let's just try to add the IPv6 NAT rules and see what happens.
If we discover it failed, then we can register the failure with the `health` package (so it shows up in various places as broken for debugging/support), and maybe we can also then just disable advertising the `::/0` route, forcing the client to then stop using it and have their Happy Eyeballs clients fall back to IPv4.
We could also collect some metrics on how often that IPv6 NAT rule fails to register these days in the wild.
Contributor guide
Assessment
This issue has not been assessed yet.