tailscale / tailscale/tailscale

wgengine/router: on Linux, stop trying to detect IPv6 NAT support

Open
#4,462 1 comment 1 reaction 0 assignees View on GitHub
connectivity exit-node L5 All users OS-linux P1 Nuisance T5 Usability
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
2d 3h
Merged PRs (30d)
123

Description

We currently try to detect whether the Linux kernel we're on supports IPv6 NAT.

But the mechanism we use (`func supportsV6NAT` checking `/proc/net/ip6_tables_names`) doesn't work on systems using nftables (#4459). A quick incremental improvement fix for 1.24.0 (#4461) made that also detect whether the `ip6table_nat` module is loadable/loaded, but such games are silly, as @danderson noted on #4461.

Instead, let's just try to add the IPv6 NAT rules and see what happens.

If we discover it failed, then we can register the failure with the `health` package (so it shows up in various places as broken for debugging/support), and maybe we can also then just disable advertising the `::/0` route, forcing the client to then stop using it and have their Happy Eyeballs clients fall back to IPv4.

We could also collect some metrics on how often that IPv6 NAT rule fails to register these days in the wild.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.