From fb3e2864d65ecca11806b5428bf6ea621826471c Mon Sep 17 00:00:00 2001 From: aaron Date: Tue, 20 Oct 2026 12:48:41 +0200 Subject: [PATCH] fix(tailscale): open Tailscale's WireGuard port in the firewall services.tailscale.openFirewall defaults to false while the NixOS firewall is enabled, so argon, krypton and neon dropped unsolicited inbound 41641/udp. Direct connections then only succeed if the other peer accepts inbound; between two of these hosts (or a host and a phone) traffic can fall back to a DERP relay. Co-Authored-By: Claude Opus 5.5 --- modules/nixos/services.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/nixos/services.nix b/modules/nixos/services.nix index cb716d2..b38b5f8 100644 --- a/modules/nixos/services.nix +++ b/modules/nixos/services.nix @@ -4,6 +4,10 @@ tuned.enable = true; upower.enable = true; fwupd.enable = true; - tailscale.enable = true; + tailscale = { + enable = true; + # inbound 41641/udp so peers can connect directly instead of via DERP + openFirewall = true; + }; }; } -- 2.52.0