aaron/nixconfig
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(tailscale): open Tailscale's WireGuard port in the firewall #109

Merged
aaron merged 1 commits from fix/tailscale-open-firewall into main 2026-10-20 12:50:24 +02:00
Conversation 0 Commits 1 Files Changed 1
+5 -1
aaron commented 2026-10-20 12:48:42 +02:00
Owner
Copy Link
Copy Source

Problem

services.tailscale.openFirewall defaults to false, and the NixOS firewall is enabled, so argon, krypton and neon drop unsolicited inbound 41641/udp. A direct Tailscale connection then only works if the other peer accepts inbound. Between two of these hosts, or a host and a phone (both behind NAT/firewall), traffic can fall back to a DERP relay.

This is the NixOS counterpart of homelab/ansible-play-infra#4, which opened the port on the Rocky servers (all five now connect directly from argon and from the public host).

Change

modules/nixos/services.nix: services.tailscale.openFirewall = true. The module is shared, so this applies to argon, krypton and neon.

Testing

  • networking.firewall.allowedUDPPorts on argon, krypton and neon: [10400,10401,27015,27036] → [10400,10401,27015,27036,41641], with nothing else changed
  • nix build --dry-run of all three system.build.toplevel: evaluates without errors
  • lint (statix + deadnix): passes

Takes effect on each host's next nixos-rebuild switch; tailscaled doesn't need a restart.

🤖 Generated with Claude Code

## Problem `services.tailscale.openFirewall` defaults to `false`, and the NixOS firewall is enabled, so argon, krypton and neon drop unsolicited inbound `41641/udp`. A direct Tailscale connection then only works if the *other* peer accepts inbound. Between two of these hosts, or a host and a phone (both behind NAT/firewall), traffic can fall back to a DERP relay. This is the NixOS counterpart of homelab/ansible-play-infra#4, which opened the port on the Rocky servers (all five now connect directly from argon and from the public host). ## Change `modules/nixos/services.nix`: `services.tailscale.openFirewall = true`. The module is shared, so this applies to argon, krypton and neon. ## Testing - `networking.firewall.allowedUDPPorts` on argon, krypton and neon: `[10400,10401,27015,27036]` → `[10400,10401,27015,27036,41641]`, with nothing else changed - `nix build --dry-run` of all three `system.build.toplevel`: evaluates without errors - `lint` (statix + deadnix): passes Takes effect on each host's next `nixos-rebuild switch`; tailscaled doesn't need a restart. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
aaron added 1 commit 2026-10-20 12:48:42 +02:00
fix(tailscale): open Tailscale's WireGuard port in the firewall fb3e2864d6 
services.tailscale.openFirewall defaults to false while the NixOS
firewall is enabled, so argon, krypton and neon dropped unsolicited
inbound 41641/udp. Direct connections then only succeed if the other
peer accepts inbound; between two of these hosts (or a host and a
phone) traffic can fall back to a DERP relay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aaron merged commit 6c1c4403c2 into main 2026-10-20 12:50:24 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aaron (Aaron)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: aaron/nixconfig#109