Enable Vega as an IPv4-only Nebula exit node #48

New issue

Closed

opened 2026-07-04 20:52:17 +01:00 by nimmo · 1 comment

nimmo commented

2026-07-04 20:52:17 +01:00

Owner

Goal

Configure Vega to forward and NAT IPv4 traffic arriving from the Nebula mesh so mobile clients can use it as a home egress gateway.

Context

Port forwarding for UDP 4242 to Vega is already in place, and Vega is already a Nebula lighthouse/resolver. What is missing is the explicit NixOS-side exit-node behavior: forwarding, masquerade/NAT, and the related firewall policy for mesh-to-internet traffic.

Acceptance Checklist

Enable IPv4 forwarding declaratively for Vega.
Masquerade/NAT traffic arriving from nebula.mesh out Vega’s normal internet-facing interface.
Allow forwarding from nebula.mesh to the internet-facing interface and related return traffic.
Keep IPv6 forwarding disabled.
Preserve existing Nebula lighthouse and resolver behavior on Vega.

Constraints

Scope is IPv4 full-tunnel only.
Do not broaden this into a fleet-wide exit-node abstraction unless the implementation naturally stays small and clear.

Verification

Vega still forms Nebula tunnels normally after deployment.
A client using exit-node routes can reach the internet through Vega.
Existing non-exit-node clients continue to behave exactly as before.

## Goal Configure Vega to forward and NAT IPv4 traffic arriving from the Nebula mesh so mobile clients can use it as a home egress gateway. ## Context Port forwarding for UDP 4242 to Vega is already in place, and Vega is already a Nebula lighthouse/resolver. What is missing is the explicit NixOS-side exit-node behavior: forwarding, masquerade/NAT, and the related firewall policy for mesh-to-internet traffic. ## Acceptance Checklist - Enable IPv4 forwarding declaratively for Vega. - Masquerade/NAT traffic arriving from nebula.mesh out Vega’s normal internet-facing interface. - Allow forwarding from nebula.mesh to the internet-facing interface and related return traffic. - Keep IPv6 forwarding disabled. - Preserve existing Nebula lighthouse and resolver behavior on Vega. ## Constraints - Scope is IPv4 full-tunnel only. - Do not broaden this into a fleet-wide exit-node abstraction unless the implementation naturally stays small and clear. ## Verification - Vega still forms Nebula tunnels normally after deployment. - A client using exit-node routes can reach the internet through Vega. - Existing non-exit-node clients continue to behave exactly as before.

nimmo added this to the Nebula Mesh Network milestone

2026-07-04 20:52:17 +01:00

nimmo added the

project:nebula-mesh-network

phase:deploy

host:vega

labels

2026-07-04 20:52:17 +01:00

nimmo commented

2026-07-05 10:37:20 +01:00

Author

Owner

Completed and deployed on Vega.

IPv4 forwarding is enabled and IPv6 forwarding remains disabled.
NixOS NAT/forwarding rules allow nebula.mesh traffic out enp86s0 with masquerading and return traffic.
Nebula 1.10 unsafe-route traffic is explicitly allowed with local_cidr = "0.0.0.0/0".
Existing lighthouse and resolver behavior remains active.

Runtime validation confirmed the exit-node firewall rule loaded and the phone tunnel passed traffic.

Relevant commits: 0b40f4e, 3b4f8a5.

Completed and deployed on Vega. - IPv4 forwarding is enabled and IPv6 forwarding remains disabled. - NixOS NAT/forwarding rules allow `nebula.mesh` traffic out `enp86s0` with masquerading and return traffic. - Nebula 1.10 unsafe-route traffic is explicitly allowed with `local_cidr = "0.0.0.0/0"`. - Existing lighthouse and resolver behavior remains active. Runtime validation confirmed the exit-node firewall rule loaded and the phone tunnel passed traffic. Relevant commits: `0b40f4e`, `3b4f8a5`.

nimmo closed this issue

2026-07-05 10:37:25 +01:00