From 2b58f8cac05057a90fc22963375bd49e759fc861 Mon Sep 17 00:00:00 2001
From: Joshua Gilman <joshuagilman@gmail.com>
Date: Wed, 26 Aug 2026 12:42:11 -0700
Subject: [PATCH] fix(gw01): masquerade tailnet clients into the sandbox VLAN

Tailnet-member hosts on VLAN 40 (sandbox01) reply to tailnet client
addresses through their own tailscale0 peer routes instead of gw01,
so un-SNATed subnet-routed traffic gets dropped asymmetrically.
Masquerading 100.64.0.0/10 out br40 keeps replies symmetric. Home
and inter-VLAN traffic remain un-NATed.
---
 vyos/gw01/config.boot.tmpl | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/vyos/gw01/config.boot.tmpl b/vyos/gw01/config.boot.tmpl
index 3e4e898..a00f639 100644
--- a/vyos/gw01/config.boot.tmpl
+++ b/vyos/gw01/config.boot.tmpl
@@ -696,6 +696,18 @@ nat {
                 address masquerade
             }
         }
+        rule 110 {
+            description "Masquerade Tailscale clients into the sandbox VLAN so tailnet-member hosts reply symmetrically"
+            outbound-interface {
+                name br40
+            }
+            source {
+                address 100.64.0.0/10
+            }
+            translation {
+                address masquerade
+            }
+        }
     }
 }
 protocols {